Definition
A management letter is a letter in which the auditor passes on observations about internal control, accounting, and efficiency. AU-C 265 requires written communication of significant deficiencies and material weaknesses to management and those charged with governance. Lesser control gaps and operational suggestions are not part of the required written communication. Many firms combine required and optional points in one document.
Why it matters in an audit or review
Clients use the letter as a to-do list, and lenders and regulators sometimes ask to see it. It records that the auditor communicated what AU-C 265 requires, so it supports the audit file. The letter should state that the audit was not designed to identify all deficiencies, so a short letter does not imply a clean control environment.
Example
Illustrative: the auditor finds that one person can both create vendors and approve payments. The letter describes the condition, the risk, and a recommended fix, and classifies the matter as a significant deficiency based on the potential effect.
Common mistakes
Burying a significant deficiency among minor points without labelling it, or omitting the statement that the letter's purpose is limited.
FAQ
Is a management letter required?
The required part is the AU-C 265 written communication. Beyond that, the form and extent of a letter are a firm choice.
Sources
- AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
- AICPA, AU-C Section 260, The Auditor’s Communication With Those Charged With Governance
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error