ISA 265 – Communicating Deficiencies in Internal Control to Those Charged with Governance and Management

1 Understanding Auditor’s responsibility

To provide an opinion on financial statements, auditor is required to lower the audit risk to a reasonable level. In doing so he has to assess entity’s internal control system as well and in that process auditor may identify certain deficiencies in the internal control system.

According to ISA 265, auditor is responsible to communicate such deficiencies to management and to those charged with governance. This standard states what deficiencies and under what circumstances deficiencies are to be communicated and their content, mode and level of communication.

However, this standard does not impose any additional requirements or responsibilities on auditor other than mentioned in ISA 315, 330 and 260. Also auditor’s communication of deficiencies should not be taken as auditor’s expression of judgment on effectiveness of internal control system. Auditor communicates the deficiencies to the extent identified by him during the course of the audit while performing audit procedures at different stages of audit engagement.

To emphasize again, auditor is under no obligation to specifically look for deficiencies in the internal control system. His responsibility is only limited to the extent of communicating the deficiencies he came to know in course of audit.

Deficiency in internal control system exists if:

  1. The control is missing that can prevent or detect and correct misstatements in financial statements; or
  2. The control exists but is unable to prevent or detect and correct misstatements in financial statements as a result of lack in design, implementation or operation of such control.

Significant deficiency is such deficiency in internal control system which in auditor’s opinion is of such importance that it needs to be brought in attention of management and those charged with governance.

This standard requires auditor to assess if deficiency has been identified during the course of audit. Such assessment is made by discussing the relevant facts with management. Such discussions help communicate deficiencies that were previously not known to management. Auditor usually communicates the matter at such level of management that is concerned with respective area of control system.

Such discussions are also necessary as auditor gains evidence regarding:

  1. Management’s understanding of actual or suspected deficiencies and their reasons
  2. Problems as a result of such deficiencies
  3. Management’s attitude towards auditor’s findings