AU-C 260 Communications Calendar: What to Tell Those Charged With Governance and When

The AU-C 260 standards page lists what the auditor must communicate. This post turns the list into a calendar, so each communication has an owner, a date and a workpaper. Audit files tend to fail on timing and evidence, not on knowing the required topics.

Step 1: Identify the audience in the planning file

Those charged with governance are the people responsible for overseeing the entity's strategic direction, accountability and financial reporting process. For a corporation that is the board or its audit committee. For a nonprofit it is the board or finance committee. For an owner-managed company it is often the owner, who is also management.

Record in the planning file:

• Names and roles of the governance contacts.
• Whether an audit committee exists and who chairs it.
• Whether all of those charged with governance are also involved in managing the entity. If they are, matters already communicated to them as managers need not be repeated.

If the structure is unclear, agree it with the client at acceptance and record the agreement. An engagement letter addressed only to the CFO, for a client with an independent board, leaves the auditor without an audience.

Step 2: Planning communication (before fieldwork)

Tell governance, at the start of the engagement:

• The auditor's responsibilities: form and express an opinion on financial statements prepared by management with governance oversight, and the audit does not relieve either party of its own responsibilities.
• An overview of planned scope and timing, including significant risks the auditor has identified.
• A request for governance's views on matters relevant to the audit: their view of business risks, areas needing attention, awareness of fraud or noncompliance, and how they oversee the financial reporting process.

Keep the overview short. Detailed program steps give clients a way to predict testing, and the standard cautions against communicating at a level that compromises effectiveness. A sample planning letter is in the planning communication example.

Step 3: Interim communications (during fieldwork)

Communicate promptly, not at year end, for items where governance can help or must act:

• Significant difficulties: delays in receiving information, unreasonably brief time to complete the work, unexpected effort to obtain evidence, or management restrictions on access.
• Suspected fraud involving management, employees with significant roles in internal control, or others where it results in a material misstatement. The auditor communicates the suspicion and discusses the audit procedures needed to complete the work.
• Identified or suspected noncompliance with laws and regulations, unless clearly inconsequential. If the auditor believes the matter is intentional and material, communicate as soon as practicable. See AU-C 250 procedures.

Step 4: Completion communication (before the report date)

The GAO Financial Audit Manual lists the completion matters below, and the same structure works for private entities:

Unless every member of governance is also management, add: material corrected misstatements brought to management's attention, significant findings discussed with management, the auditor's views on significant matters that were the subject of management's consultations with other accountants, and the written representations requested from management (the signed letter is the workpaper).

Independence is treated separately. Many firms include an independence statement in the completion letter, as a matter of practice.

Step 5: Decide oral or written

The auditor chooses the form. The auditor must communicate significant findings in writing when, in the auditor's professional judgment, oral communication would not be adequate. In practice, firms use a letter for the completion matters and a meeting for the discussion. When a matter is communicated orally, the file records the matter, when it was communicated and to whom, as a memo or minutes. When it is written, a copy is enough.

The written letter should state its purpose and say that it is not suitable for any other purpose. That sentence stops the letter being passed to lenders as an assurance report.

Step 6: Evaluate the two-way communication

The standard asks the auditor to judge whether the communication with governance has been adequate for the purposes of the audit. Document the evaluation using the indicators the FAM lists (it notes the auditor does not need specific procedures for this and may rely on observations from other work):

• Timeliness and appropriateness of governance's actions on matters raised.
• Openness of governance in dealing with the auditor.
• Willingness to meet with the auditor without management present.
• Ability to understand and challenge what the auditor communicates.
• Difficulty agreeing the form, timing and content of communications.

Inadequate two-way communication points to a weak control environment and affects the risk assessment. If the situation cannot be resolved, the options include modifying the opinion for a scope limitation, consulting legal counsel or withdrawing where permitted.

Worked example: owner-managed manufacturer

An owner-managed manufacturer has a three-person board, two of whom work in the business. The outside director chairs a small audit committee. The file shows:

• Planning letter to all three directors in October with scope, timing and the significant risks (inventory valuation, revenue cutoff).
• December call with the audit committee chair to report that inventory count support was delayed three weeks.
• Completion letter in March to the audit committee covering estimates (the inventory reserve), a $41,000 uncorrected cost of sales difference, and no disagreements.
• A memo of the committee meeting at which the chair met the engagement partner without management present.

Each communication has a date, a recipient and a workpaper. That is what a reviewer looks for.

Common file gaps

• The planning letter is addressed to management only.
• The completion letter arrives on the report date, with no time for governance to respond.
• Oral communications have no memo.
• The letter lists matters but not the audience's response.
• The letter omits the "not suitable for any other purpose" line.

CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.

Sources

• AICPA, AU-C Section 260, The Auditor's Communication With Those Charged With Governance
• AICPA, AU-C Section 240 (Consideration of Fraud in a Financial Statement Audit) and AU-C Section 250 (Consideration of Laws and Regulations in an Audit of Financial Statements), for the matters that add to the AU-C 260 list
• U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, section 550: gao.gov

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error