Drafting the AU-C 265 Written Communication: Structure, Wording and a Worked Finding

AU-C 265 requires a written communication to management and those charged with governance of significant deficiencies and material weaknesses identified in the audit. The standard states the content. It does not say how to make the letter useful, accurate and defensible. This post covers the drafting.

The letter has fixed parts and variable parts

The fixed parts are statements the standard asks for. They appear in the same wording each year, with the dates changed.

1. Purpose. The audit was performed to express an opinion on the financial statements, not on the effectiveness of internal control.
2. No opinion on internal control. The auditor considered internal control only to the extent needed to design audit procedures.
3. Not all deficiencies identified. The auditor's consideration was not designed to identify all deficiencies, so others may exist.
4. Restricted use. The letter is for management, those charged with governance and others within the entity, and not for any other party.
5. Definitions. The letter defines a material weakness and, if reported, a significant deficiency.

The variable parts are the findings. Each finding needs a classification, a description and an explanation of potential effects.

Writing a finding: condition, cause, effect, recommendation

Reviewers expect the same elements in every finding: condition, cause, effect and recommendation, with the classification stated at the end. The GAO Financial Audit Manual builds findings from four elements (criteria, condition, cause and effect) and adds recommendations where the auditor chooses to give them. Write each element in one short paragraph.

Worked finding (illustrative). A homebuilder with $9 million of annual revenue has one bookkeeper who records receipts, prepares bank deposits and reconciles the operating account. The owner reviews monthly financial statements and compares monthly deposits to the job schedule, but does not review the reconciliation.

• Condition. The same employee receives customer checks, prepares deposits and performs the bank reconciliation. No one independent reviews the reconciliation.
• Cause. The accounting department has two people, and the second handles payables and payroll only.
• Effect. Misappropriation of receipts could occur and not be detected on a timely basis. Receipts in the audit period totalled about $8.7 million.
• Recommendation. Have the owner or a second employee open the bank statement, compare the reconciliation to the statement and initial it each month. Alternatively, move deposit preparation to the person who does not reconcile.
• Classification. Significant deficiency, because the owner's monthly comparison of deposits to the job schedule partially reduces the exposure. The auditor tested that review for several months and found it operated, but it does not examine deposit detail, so the exposure is reduced and not eliminated.

Notice that the classification explains itself. A reader sees why this finding is a significant deficiency rather than a material weakness, and what the auditor did to decide.

Classification: use the evaluation, not a habit

Severity depends on the likelihood that a misstatement could occur and not be prevented or detected, and on the magnitude of the possible misstatement. It does not depend on whether a misstatement happened. Factors include the nature of the accounts involved, susceptibility to fraud, subjectivity of the amounts, interaction with other deficiencies and the volume of activity exposed. A compensating control only counts if the auditor has evidence that it works. See design vs operating effectiveness and deficiency evaluation for the method and worksheet.

AU-C 265 lists indicators of a material weakness, including fraud by senior management, a restatement to correct a material misstatement, a material misstatement found by the auditor that the entity's controls would not have caught, and ineffective oversight by those charged with governance.

The third indicator is the one that reaches small engagements. When the auditor proposes adjusting entries that are material and the client's controls would not have found them, the file needs a documented conclusion on whether the financial close process has a material weakness.

The full list of indicators is also reproduced in North Carolina State Treasurer guidance on AU-C 265 examples (linked in sources).

What goes in the letter and what stays out

A statement that no significant deficiencies were noted invites readers to treat the letter as assurance on controls. Omit the letter when there is nothing to report and record that conclusion in the file.

Other, lesser deficiencies that merit management's attention are communicated orally or in writing. If oral, the file shows when and to whom.

Timing

Significant deficiencies and material weaknesses go to those charged with governance in writing on a timely basis, and to management in writing as well unless direct communication to management would be inappropriate. This includes deficiencies that were remediated during the audit. The 60-day outer limit after the report release date that the GAO Financial Audit Manual cites from AU-C 265 applies to other deficiencies, the ones below significant deficiency that merit management's attention. It is not a target for significant deficiencies and material weaknesses. Most firms deliver the letter with or before the AU-C 260 completion letter so that governance sees both documents together. See the AU-C 260 calendar.

Matters communicated in a prior year and still open are included again. The letter can reference the earlier letter and its date without repeating the full description, but must say they remain unremediated.

Management responses

If management writes a response, include it in the letter or as an attachment, labeled as not subjected to audit procedures. The auditor should read the response for statements that conflict with the audit findings. A response that says "we disagree there is a deficiency" for a condition the auditor observed directly leaves the finding intact and adds a note to the partner's file.

Pre-issuance checklist

• Each finding has condition, cause, effect, recommendation and classification.
• Each classification traces to the deficiency evaluation workpaper.
• The five fixed statements are present.
• The delivery date is timely against the report release date and is recorded in the file.
• Open prior-year items are carried forward.
• The letter is addressed to both management and those charged with governance.
• A copy is in the audit file and is cross-referenced to the completion checklist.
• No sentence implies assurance on controls.

CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.

Sources

• AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
• AICPA, AU-C Section 230, Audit Documentation; AU-C Section 260, The Auditor's Communication With Those Charged With Governance
• North Carolina Department of State Treasurer, AU-C 265 examples of circumstances that may be deficiencies, significant deficiencies or material weaknesses: files.nc.gov
• U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, section 580 on communicating control deficiencies and the elements of a finding: gao.gov

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error