Reporting Deficiencies in Internal Control Systems

Auditors should communicate deficiencies in internal control identified during the course of an audit to those charged with governance and management. In particular, significant deficiencies should be communicated in writing to those charged with governance. This is a requirement of ISA 265 Communicating Deficiencies in Internal Control to Those Charged with Governance and Management.

The form, timing and addressees of this communication should be agreed at the start of the audit, as part of the terms of the engagement. This report, traditionally known as a management letter or report to management, is usually sent at the end of the audit process.

When the auditor reports deficiencies, it should be made clear that:

• the report is not a comprehensive list of deficiencies, but only those that have come to light during normal audit procedures
• the report is for the sole use of the company
• no disclosure should be made to a third party without the written agreement of the auditor
• no responsibility is assumed to any other parties.

Rating :	Ratings & Comments  (Click the stars to rate the page)

Tags:	deficiencies in control;those charged with governance;management letter