ISA 265 – Communicating Deficiencies in Internal Control to Those Charged with Governance and Management

2 Significant deficiencies

Once the deficiency is identified by the auditor, he must consider whether it amounts to significant deficiency individually or in combination with other deficiencies.

Deficiency in internal control system is not considered significant only if misstatement has occurred but also depends on the chances that misstatement could occur and its impact on financial statements. That means significant deficiencies exist even if no misstatements are detected by auditor’s procedures. The reason for such is that auditor’s procedures (substantive procedures) are meant to detect existing misstatements. However, chances are that if no misstatement exists then potential deficiency will go unnoticed.

Following factors help auditor determine if deficiency is significant:

1. Likelihood of deficiency causing material misstatements
2. Level of complexity and subjectivity involved in determining accounting figures
3. Figures in the financial statements that may get effected by the deficiency
4. Effectiveness of controls over fraud, selection of policies, transactions with related parties, unusual transactions
5. Susceptibility of asset or liability to fraud
6. How frequently deficiency can result in misstatement
7. Effect of deficiency on financial information in combination with other deficiencies

Factors that indicate the significant deficiencies exist include:

1. Existence of management fraud
2. No adherence to deficiencies communicated previously
3. No oversight of those charged with governance on transactions in which management has monetary interest.
4. No risk assessment process exists or is ineffective or not operating at the level auditor expects it to be
5. Misstatements detected that are expected to be prevented or detected and corrected by internal control system
6. Information questioning management’s effectiveness regarding financial statements preparation

3 Communication to those charged with governance

Auditor is required to communicate deficiencies in internal control system in writing to those charged with governance on timely basis.

Written communication helps establish the fact that it is important and also help those charged with governance in fulfilling their role of supervision.

To decide about the timing of written communication auditor consider if written communication is required by those charged with governance to fulfill their duties effectively. If there is no such compulsion then auditor may delay the written communication until later date and convey the deficiencies orally. However, if written communication is made then the same will also form part of audit file.

The amount of details to be included in written communication is left on auditor’s judgment which he applies considering following factors:

1. Nature of entity and its business
2. Size and complexity of the entity
3. Structure of management governance
4. Nature of deficiency
5. Legal and regulatory requirements

Though auditor is required to communicate deficiencies to management and those charged with governance however, final decision regarding design and implementation of controls rests with management as they may ignore the recommendations on cost-benefit basis.

If the auditor found a deficiency that was already communicated before or in previous audit then it does not preclude auditor from communicating it again. Auditor may ask why no remedial action has been taken. And if management or those charged with governance fails to give appropriate explanation then this may amount to significant deficiency.