ISA 265 – Communicating Deficiencies in Internal Control to Those Charged with Governance and Management

4 Communication to management

The auditor shall:

1. Communicate in writing the deficiencies that has been communicated or auditor plan to communicate to those charged with governance
2. Communicate such deficiencies that management is not briefed by third person and auditor thinks require management’s attention

There may be circumstances where directly communicating to management is not advisable. For example a situation where management is found guilty of fraud or intentionally circumventing controls.

However, not all deficiencies are significant thus termed as other deficiencies but still important enough but what is important is left on auditor’s judgment. For such deficiencies auditor is not required to make formal written communication and can be conveyed orally.

Also in relation to deficiencies other than significant deficiencies that were previously communicated or conveyed by other parties to management, auditor needs not to re-communicate the same unless circumstances have changed that in auditor’s opinion are important to be brought in management’s attention.

5 Content of written communication

While detailing the possible outcomes of significant deficiencies auditor:

1. Need not to quantify the effects
2. May group different deficiencies together if appropriate
3. Suggest recommended actions to counter deficiencies
4. Management’s responses
5. Statement as to whether auditor has verified management’s steps towards deficiencies

Additionally, auditor may consider including the following if necessary:

1. Written communication is to help those charged with governance in their duties and may not be helpful in other cases
2. If audit procedures were expanded then most probably more deficiencies were identified or that some of the reported deficiencies need not to be reported.