ASA 265 - Communicating Deficiencies in Internal Control to Those Charged with Governance and Management - October 2009
Communication of Deficiencies in InternaCommunication of Deficiencies in Internal Control
Start here
Get a plain-English read of Communication of Deficiencies in Interna
Turn the raw legal text into a practical explanation grounded in ASA 265 - Communicating Deficiencies in Internal Control to Those Charged with Governance and Management - October 2009.
Communication of Significant Deficiencies in Internal Control to Those Charged with Governance (Ref: Para. 9)
Communicating significant deficiencies in writing to those charged with governance reflects the importance of these matters, and assists those charged with governance in fulfilling their oversight responsibilities. ASA 260 establishes relevant considerations regarding communication with those charged with governance when all of them are involved in managing the entity.[6]
In determining when to issue the written communication, the auditor may consider whether receipt of such communication would be an important factor in enabling those charged with governance to discharge their oversight responsibilities. In addition, for listed entities in certain jurisdictions, those charged with governance may need to receive the auditor’s written communication before the date of approval of the financial report in order to discharge specific responsibilities in relation to internal control for regulatory or other purposes. For other entities, the auditor may issue the written communication at a later date. Nevertheless, in the latter case, as the auditor’s written communication of significant deficiencies forms part of the final audit file, the written communication is subject to the overriding requirement[7] for the auditor to complete the assembly of the final audit file on a timely basis. ASA 230 states that an appropriate time limit within which to complete the assembly of the final audit file is ordinarily not more than 60 days after the date of the auditor’s report.[8]
Regardless of the timing of the written communication of significant deficiencies, the auditor may communicate these orally in the first instance to management and, when appropriate, to those charged with governance to assist them in taking timely remedial action to minimise the risks of material misstatement. Doing so, however, does not relieve the auditor of the responsibility to communicate the significant deficiencies in writing, as this Auditing Standard requires.
The level of detail at which to communicate significant deficiencies is a matter of the auditor’s professional judgement in the circumstances. Factors that the auditor may consider in determining an appropriate level of detail for the communication include, for example:
The nature of the entity. For instance, the communication required for a public interest entity may be different from that for a non‑public interest entity.
The size and complexity of the entity. For instance, the communication required for a complex entity may be different from that for an entity operating a simple business.
Section Communication of Deficiencies in Interna - ASA 265 - Communicating Deficiencies in Internal Control to Those Charged with Governance and Management - October 2009 - Communication of Deficiencies in Internal Control | Zoe
The nature of significant deficiencies that the auditor has identified.
The entity’s governance composition. For instance, more detail may be needed if those charged with governance include members who do not have significant experience in the entity’s industry or in the affected areas.
Legal or regulatory requirements regarding the communication of specific types of deficiency in internal control.
Management and those charged with governance may already be aware of significant deficiencies that the auditor has identified during the audit and may have chosen not to remedy them because of cost or other considerations. The responsibility for evaluating the costs and benefits of implementing remedial action rests with management and those charged with governance. Accordingly, the requirement in paragraph 9 applies regardless of cost or other considerations that management and those charged with governance may consider relevant in determining whether to remedy such deficiencies.
The fact that the auditor communicated a significant deficiency to those charged with governance and management in a previous audit does not eliminate the need for the auditor to repeat the communication if remedial action has not yet been taken. If a previously communicated significant deficiency remains, the current year’s communication may repeat the description from the previous communication, or simply reference the previous communication. The auditor may ask management or, where appropriate, those charged with governance, why the significant deficiency has not yet been remedied. A failure to act, in the absence of a rational explanation, may in itself represent a significant deficiency.
Considerations Specific to Smaller Entities
In the case of audits of smaller entities, the auditor may communicate in a less structured manner with those charged with governance than in the case of larger entities.
Communication of Deficiencies in Internal Control to Management (Ref: Para. 10)
Ordinarily, the appropriate level of management is the one that has responsibility and authority to evaluate the deficiencies in internal control and to take the necessary remedial action. For significant deficiencies, the appropriate level is likely to be the chief executive officer or chief financial officer (or equivalent) as these matters are also required to be communicated to those charged with governance. For other deficiencies in internal control, the appropriate level may be operational management with more direct involvement in the control areas affected and with the authority to take appropriate remedial action.
Communication of Significant Deficiencies in Internal Control to Management (Ref: Para. 10(a))
Certain identified significant deficiencies in internal control may call into question the integrity or competence of management. For example, there may be evidence of fraud or intentional non‑compliance with laws and regulations by management, or management may exhibit an inability to oversee the preparation of an adequate financial report that may raise doubt about management’s competence. Accordingly, it may not be appropriate to communicate such deficiencies directly to management.
ASA 250 establishes requirements and provides guidance on the reporting of identified or suspected non‑compliance with laws and regulations, including when those charged with governance are themselves involved in such non‑compliance.[9] ASA 240 establishes requirements and provides guidance regarding communication to those charged with governance when the auditor has identified fraud or suspected fraud involving management.[10]
Communication of Other Deficiencies in Internal Control to Management (Ref: Para. 10(b))
During the audit, the auditor may identify other deficiencies in internal control that are not significant deficiencies but that may be of sufficient importance to merit management’s attention. The determination as to which other deficiencies in internal control merit management’s attention is a matter of professional judgement in the circumstances, taking into account the likelihood and potential magnitude of misstatements that may arise in the financial report as a result of those deficiencies.
The communication of other deficiencies in internal control that merit management’s attention need not be in writing but may be oral. Where the auditor has discussed the facts and circumstances of the auditor’s findings with management, the auditor may consider an oral communication of the other deficiencies to have been made to management at the time of these discussions. Accordingly, a formal communication need not be made subsequently.
If the auditor has communicated deficiencies in internal control other than significant deficiencies to management in a prior period and management has chosen not to remedy them for cost or other reasons, the auditor need not repeat the communication in the current period. The auditor is also not required to repeat information about such deficiencies if it has been previously communicated to management by other parties, such as the internal audit function or regulators. It may, however, be appropriate for the auditor to re‑communicate these other deficiencies if there has been a change of management, or if new information has come to the auditor’s attention that alters the prior understanding of the auditor and management regarding the deficiencies. Nevertheless, the failure of management to remedy other deficiencies in internal control that were previously communicated may become a significant deficiency requiring communication with those charged with governance. Whether this is the case depends on the auditor’s professional judgement in the circumstances.
In some circumstances, those charged with governance may wish to be made aware of the details of other deficiencies in internal control the auditor has communicated to management, or be briefly informed of the nature of the other deficiencies. Alternatively, the auditor may consider it appropriate to inform those charged with governance of the communication of the other deficiencies to management. In either case, the auditor may report orally or in writing to those charged with governance as appropriate.
ASA 260 establishes relevant considerations regarding communication with those charged with governance when all of them are involved in managing the entity.[11]
Considerations Specific to Public Sector Entities (Ref: Para. 9‑10)
Public sector auditors may have additional responsibilities to communicate deficiencies in internal control that the auditor has identified during the audit, in ways, at a level of detail and to parties not envisaged in this Auditing Standard. For example, significant deficiencies may have to be communicated to the legislature or other governing body. Law, regulation or other authority may also mandate that public sector auditors report deficiencies in internal control, irrespective of the significance of the potential effects of those deficiencies. Further, legislation may require public sector auditors to report on broader internal control‑related matters than the deficiencies in internal control required to be communicated by this Auditing Standard, for example, controls related to compliance with legislative authorities, regulations, or provisions of contracts or grant agreements.
Content of Written Communication of Significant Deficiencies in Internal Control (Ref: Para. 11)
In explaining the potential effects of the significant deficiencies, the auditor need not quantify those effects. The significant deficiencies may be grouped together for reporting purposes where it is appropriate to do so. The auditor may also include in the written communication suggestions for remedial action on the deficiencies, management’s actual or proposed responses, and a statement as to whether or not the auditor has undertaken any steps to verify whether management’s responses have been implemented.
The auditor may consider it appropriate to include the following information as additional context for the communication:
An indication that if the auditor had performed more extensive procedures on internal control, the auditor might have identified more deficiencies to be reported, or concluded that some of the reported deficiencies need not, in fact, have been reported.
An indication that such communication has been provided for the purposes of those charged with governance, and that it may not be suitable for other purposes.
Law or regulation may require the auditor or management to furnish a copy of the auditor’s written communication on significant deficiencies to appropriate regulatory authorities. Where this is the case, the auditor’s written communication may identify such regulatory authorities.