Determination of Whether Deficiencies inDetermination of Whether Deficiencies in Internal Control Have Been Identified (Ref: Para. 7)

Determination of Whether Deficiencies in Internal Control Have Been Identified (Ref: Para. 7)

1. In determining whether the auditor has identified one or more deficiencies in internal control, the auditor may discuss the relevant facts and circumstances of the auditor’s findings with the appropriate level of management. This discussion provides an opportunity for the auditor to alert management on a timely basis to the existence of deficiencies of which management may not have been previously aware. The level of management with whom it is appropriate to discuss the findings is one that is familiar with the internal control area concerned and that has the authority to take remedial action on any identified deficiencies in internal control. In some circumstances, it may not be appropriate for the auditor to discuss the auditor’s findings directly with management, for example, if the findings appear to call management’s integrity or competence into question (see paragraph A20).
2. In discussing the facts and circumstances of the auditor’s findings with management, the auditor may obtain other relevant information for further consideration, such as:

• Management’s understanding of the actual or suspected causes of the deficiencies.
• Exceptions arising from the deficiencies that management may have noted, for example, misstatements that were not prevented by the relevant information technology (IT) controls.
• A preliminary indication from management of its response to the findings.

Considerations Specific to Smaller Entities

1. While the concepts underlying controls in the control activities component in smaller entities are likely to be similar to those in larger entities, the formality with which they operate will vary. Further, smaller entities may find that certain types of control activities are not necessary because of controls applied by management. For example, management’s sole authority for granting credit to customers and approving significant purchases can provide effective control over important account balances and transactions, lessening or removing the need for more detailed controls.
2. Also, smaller entities often have fewer employees which may limit the extent to which segregation of duties is practicable. However, in a small owner‑managed entity, the owner‑manager may be able to exercise more effective oversight than in a larger entity. This higher level of management oversight needs to be balanced against the greater potential for management override of controls.