Most audits of small and mid-size entities end with a letter about internal control. Clients call it the management letter. The standards call part of it something narrower: the written communication of significant deficiencies and material weaknesses under AU-C 265, Communicating Internal Control Related Matters Identified in an Audit. The rest of the letter, the practical suggestions about process and efficiency, is optional.
Mixing the two causes problems. A required AU-C 265 communication has specific content and a deadline. An advisory comment has neither. This guide explains how to tell them apart, how to evaluate the severity of a deficiency, what the required letter must contain, and what to document. It paraphrases AU-C 265.
What is a management letter in an audit?
A management letter is a letter from the auditor to the client, usually issued at or after the end of the audit, that reports internal control matters and other observations noticed during the engagement. In US practice it usually has two layers:
- The required communication under AU-C 265 of any significant deficiencies and material weaknesses identified during the audit, addressed to management and those charged with governance.
- Other comments, sometimes called a letter of comments or advisory comments, covering control deficiencies that are not significant, and operational or efficiency suggestions.
Some firms issue the two layers as separate letters. Others combine them under clearly labeled headings. Either works, as long as the required elements are present and the reader can tell which matters are significant deficiencies or material weaknesses.
The audit is not designed to find every control weakness. The auditor considers internal control to design audit procedures, not to express an opinion on control effectiveness. The letter has to say so.
Deficiency, significant deficiency and material weakness
AU-C 265 sets three levels. Paraphrased:
| Level | What it means | Communication |
|---|---|---|
| Deficiency in internal control | A control's design or operation does not allow management or employees, in the normal course of their functions, to prevent, or detect and correct, misstatements on a timely basis. A design deficiency means a needed control is missing or would not work as designed. An operating deficiency means a well-designed control does not operate as designed, or the person running it lacks the authority or competence. | Written or oral communication to management is required for deficiencies that, in the auditor's judgment, merit management's attention. Not required in writing to governance. |
| Significant deficiency | A deficiency, or combination of deficiencies, that is less severe than a material weakness yet important enough to merit the attention of those charged with governance. | In writing to management and those charged with governance. |
| Material weakness | A deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected, on a timely basis. | In writing to management and those charged with governance. |
"Reasonable possibility" means the likelihood is either reasonably possible or probable, using the same terms as ASC 450 for contingencies. The test is about whether a misstatement could occur, not whether one did.
How to evaluate severity
Severity depends on two things: the likelihood that the deficiency could result in a misstatement, and the magnitude of the misstatement that could result. Factors the auditor typically weighs include:
- the nature of the accounts, classes of transactions or disclosures and assertions involved
- the susceptibility of the related asset or liability to loss or fraud
- the subjectivity and complexity of the amounts involved, such as estimates
- the interaction with other deficiencies, including whether several deficiencies affecting the same account combine into a more severe one
- the volume of activity exposed to the deficiency, both in the current period and expected in future periods
- whether compensating controls exist that operate at a level of precision that would prevent, or detect and correct, a material misstatement
The absence of an identified misstatement does not make a deficiency less severe. A missing review control over a material estimate can be a material weakness even when the auditor's testing found the estimate reasonable this year.
AU-C 265 also lists indicators of a material weakness, paraphrased:
- identification of fraud, whether or not material, on the part of senior management
- restatement of previously issued financial statements to correct a material misstatement due to error or fraud
- identification by the auditor of a material misstatement that would not have been detected by the entity's internal control
- ineffective oversight of financial reporting and internal control by those charged with governance
Use the SOX deficiency evaluation worksheet to record likelihood, magnitude, compensating controls and the classification for each deficiency. The worksheet was built for SOX work, but the severity logic is the same for a nonissuer audit.
Worked example: classifying three deficiencies
Assume an illustrative distributor with $30 million of revenue and overall materiality of $300,000.
| Deficiency | Facts | Likely classification |
|---|---|---|
| No independent review of bank reconciliations | The controller prepares and approves reconciliations for the main operating account. No misstatement found. Cash activity is large, and the same person can initiate wires. | Significant deficiency at least; consider material weakness given access to cash and lack of segregation |
| Auditor proposed a $420,000 inventory reserve adjustment | Management's process did not identify slow-moving items; the auditor's analysis did. | Material weakness indicator: a material misstatement the entity's controls did not detect |
| Expense reports approved without receipts below $100 | Low volume, low dollar amounts, monthly analytical review of travel expense by the CFO. | Deficiency; communicate to management, not required in writing to governance |
The classification is a judgment. Document the reasoning for each, not just the label.
What the AU-C 265 written communication must include
The written communication of significant deficiencies and material weaknesses must include, paraphrased:
- A description of each deficiency and an explanation of its potential effects. The auditor does not need to quantify the effects.
- Sufficient information to enable those charged with governance and management to understand the context of the communication, specifically:
- that the purpose of the audit was to express an opinion on the financial statements
- that the audit included consideration of internal control over financial reporting to design audit procedures appropriate in the circumstances, but not to express an opinion on the effectiveness of internal control
- that the auditor is not expressing an opinion on the effectiveness of internal control
- that the auditor's consideration of internal control was not designed to identify all deficiencies that might be significant deficiencies or material weaknesses
- The definition of the term material weakness and, where relevant, the definition of the term significant deficiency.
- An alert restricting the use of the communication to management, those charged with governance, others within the organization and any governmental authority to which the auditor is required to report.
The internal control communication template has these paragraphs in place, with sections for material weaknesses, significant deficiencies and other matters.
What the letter must not say
AU-C 265 prohibits a written communication stating that no significant deficiencies were identified during the audit. The reason is that the audit is not designed to find them, so a "no significant deficiencies" statement would imply assurance the auditor did not obtain.
Clients sometimes ask for a "clean letter" for a lender or a board. The auditor can communicate in writing that no material weaknesses were identified, if that is the case and the communication follows the requirements of the standard, but a statement about the absence of significant deficiencies is not allowed.
Management's response
Management may want to include its response or a corrective action plan in the letter. If it does, the auditor's letter can include a statement that management's written response has not been subjected to the audit procedures and that the auditor expresses no opinion on it. Without that disclaimer, a reader may assume the auditor has evaluated the response.
Timing
AU-C 265 requires the written communication to be made on a timely basis. The standard notes it is best made by the report release date, and requires it no later than 60 days following the report release date.
In practice:
- Discuss findings with management as you find them. Early discussion lets management fix a control before year end and gives the auditor management's view of the facts.
- Communicate significant deficiencies and material weaknesses orally to governance during the audit if timing matters, for example a material weakness over cash. The written letter still follows.
- Date the letter and file it with the engagement documentation. Track the 60-day deadline alongside the 60-day assembly deadline under AU-C 230.
A significant deficiency or material weakness that was communicated in an earlier audit and remains uncorrected can be addressed in the current letter by referring to the earlier written communication and its date, instead of repeating the full description.
Optional advisory comments
Advisory comments are where the auditor adds value without regulatory requirement: a better month-end close, a vendor master file clean-up, automation of a manual reconciliation, tax planning reminders. They are not required by GAAS and they have no prescribed form.
Practical rules for advisory comments:
- Label them clearly. Put them under a heading such as "Other comments and recommendations" so no reader mistakes an efficiency suggestion for a significant deficiency.
- Be specific. "Improve the close process" helps no one. "Reconcile the credit card clearing account monthly; at year end it held $38,000 of unclassified charges" does.
- Do not bury a significant deficiency. If a matter meets the significant deficiency threshold, it belongs in the required section, with the required content.
- Watch independence. Recommendations are fine. Designing and implementing the new control for the client is a nonattest service under the AICPA Code of Professional Conduct and must meet those requirements.
Relationship to other communications
The internal control letter often goes out with, or alongside, the communication with those charged with governance under AU-C 260 . They are different communications:
- AU-C 260 covers the auditor's responsibilities, planned scope and timing, significant findings such as qualitative aspects of accounting practices, difficulties encountered, uncorrected misstatements and disagreements with management.
- AU-C 265 covers control deficiencies.
Many firms combine them into one package. Keep the headings and required elements of each intact. See the governance communication template.
Uncorrected misstatements and the corrected misstatements that point to control failures connect the two letters. A long list of audit adjustments, evaluated under AU-C 450, often signals a control deficiency to communicate. See adjusting journal entries in an audit.
Audits under Government Auditing Standards and the Uniform Guidance have their own reporting on internal control. See Yellow Book (GAGAS) for how that report differs from the AU-C 265 letter.
What to document
- each deficiency identified, with the source workpaper
- the severity evaluation: likelihood, magnitude, compensating controls considered and the classification, with reasoning
- the deficiencies communicated orally to management, when and to whom
- the written communication, its date and the recipients
- management's response, if any, and the disclaimer on it
- carryforward of prior-year deficiencies and their current status
Problems to avoid
- A material weakness indicator, such as a material audit adjustment, with no evaluation of whether a deficiency exists.
- Letters missing the purpose and limitation paragraphs or the definitions.
- Letters stating that no significant deficiencies were identified.
- Significant deficiencies mixed into advisory comments with no label.
- Letters dated more than 60 days after the report release date, or not in the file at all.
- Management responses included with no statement that they were not audited.
Frequently asked questions
What is the difference between a management letter and an internal control letter?
An internal control letter is the required written communication of significant deficiencies and material weaknesses under AU-C 265. A management letter is the informal name for the auditor's letter to the client, which may include that required communication plus optional advisory comments.
Is a management letter required in every audit?
A written communication is required only when the auditor identifies significant deficiencies or material weaknesses. Other deficiencies that merit management's attention must be communicated to management, in writing or orally, and advisory comments are optional.
When is the AU-C 265 letter due?
AU-C 265 says the written communication is best made by the report release date and must be made no later than 60 days after the report release date.
Can the auditor say there were no significant deficiencies?
No. AU-C 265 prohibits a written communication stating that no significant deficiencies were identified, because the audit is not designed to identify all such deficiencies.
What is the difference between a significant deficiency and a material weakness?
A material weakness carries a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is less severe but still important enough to merit the attention of those charged with governance.
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Sources
- AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit (definitions, severity, content, timing)
- AICPA, AU-C Section 260, The Auditor's Communication With Those Charged With Governance; AU-C Section 450; AU-C Section 230
- FASB ASC 450-20 (meaning of reasonably possible and probable)
- AICPA Code of Professional Conduct, nonattest services (ET 1.295)
Part of CORAA University · Completion and reporting: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error