AU-C 260 Communication With Those Charged With Governance: Matters, Form and Timing

AU-C section 260, The Auditor's Communication With Those Charged With Governance, sets what the auditor must tell the people responsible for overseeing the entity's financial reporting, and when. It came out of SAS No. 122 and applies to GAAS audits of nonissuers.

This page paraphrases the standard. The authoritative text is AU-C 260 in AICPA Professional Standards. A working draft is in the communication with those charged with governance template.

What is the objective of AU-C 260?

The auditor's objectives are to communicate clearly with those charged with governance the auditor's responsibilities in relation to the financial statement audit and an overview of the planned scope and timing of the audit, to obtain from them information relevant to the audit, to give timely observations arising from the audit that are significant and relevant to their responsibility to oversee the financial reporting process, and to promote effective two-way communication between the auditor and those charged with governance.

Who are those charged with governance?

The standard defines them as the person or people with responsibility for overseeing the strategic direction of the entity and the obligations related to its accountability. That includes overseeing the financial reporting process. The term can mean a board of directors, an audit committee, trustees, the owners of an owner-managed business who are not in management, or a governing body in a public-sector entity. Structures differ by entity type and by state law.

If the structure is unclear, the auditor works out the appropriate people to communicate with and agrees that with the client. In many small entities the owner is also the manager. When all of those charged with governance are involved in managing the entity, matters that have already been communicated to them as managers do not need to be repeated.

The auditor can communicate with a subgroup such as an audit committee, but considers whether that is enough. Some matters need to reach the full board.

What must the auditor communicate?

The standard's communication requirements can be grouped as follows.

SAS 146 amended the application material (.A37) to say the auditor may consider communicating other matters discussed with the engagement quality reviewer, if one was appointed. That is optional. See AU-C 220.

Responsibilities and scope in the planning communication

Planning matters are often covered early, at engagement acceptance or in the engagement letter. They normally include the auditor's responsibilities under GAAS, the nature and scope of the audit and the significant risks the auditor expects to address. The auditor also asks those charged with governance for their views on matters that bear on the audit, such as the entity's objectives and strategies, business risks, areas where they want more attention, and awareness of fraud or noncompliance.

Do not read "overview of planned scope and timing" as a full audit program. The standard cautions against communicating detail that would make procedures predictable.

Significant findings from the audit

Significant findings from the audit that the standard has the auditor communicate include the following, in summary:

• qualitative aspects of significant accounting practices, including accounting policies, accounting estimates and financial statement disclosures, and the auditor's view on any practice that is not appropriate
• significant difficulties encountered during the audit
• uncorrected misstatements and the effect they may have, individually or in aggregate, on the opinion
• material corrected misstatements that the audit brought to management's attention
• disagreements with management that could be significant to the financial statements or the report
• management's consultations with other accountants on significant accounting or auditing matters, where those charged with governance are not all involved in management
• the written representations requested from management
• circumstances that affect the form and content of the auditor's report
• other findings or issues that, in the auditor's professional judgment, are significant and relevant to the oversight

The application material gives examples that make the list concrete, such as significant unusual transactions, difficulties getting information, significant delays, and matters such as an adverse impact on the going concern assessment. For uncorrected misstatements see AU-C 450 and for going concern AU-C 570.

Other standards add specific matters, for example fraud under AU-C 240, noncompliance under AU-C 250 and internal control deficiencies under AU-C 265. The AU-C 260 letter often pulls them together so the governing body gets one clear picture.

Independence

The AU-C 260 application material notes that communications about independence may be appropriate whenever significant judgments are made about threats to independence and related safeguards. The application material treats independence communications as appropriate when significant judgments are made, and state or regulatory rules or the engagement terms may add to that. Many firms include an independence statement in their governance communication as a matter of practice.

Form of communication

The auditor decides the form, which may be oral or written. The standard requires written communication of significant findings from the audit when, in the auditor's professional judgment, oral communication would not be adequate. In practice, firms use a written letter or a presentation deck, and then record the discussion.

Many firms add a line saying the communication is for the use of those charged with governance and management only. That is common practice, and it helps stop the letter being treated as a report to third parties.

If matters are communicated orally, the auditor documents them and when and to whom they were communicated. The documentation can be the auditor's own memo, minutes, or a copy of the presentation.

Timing

The auditor communicates on a timely basis. The right timing depends on the matter:

• planning matters, early in the audit and for an initial engagement often as part of the terms of the engagement
• significant difficulties, as soon as practicable if those charged with governance can help overcome them or if they are likely to lead to a modified opinion
• significant findings, early enough to allow action before the report is issued
• independence matters, whenever significant judgments are made

A letter delivered only on the report date leaves those charged with governance little time to act.

Two-way communication and its adequacy

Communication is meant to go both ways. The auditor evaluates whether the two-way communication between the auditor and those charged with governance has been adequate for the purpose of the audit. If it has not, the auditor evaluates the effect, if any, on the assessment of the risks of material misstatement and on the ability to obtain sufficient appropriate audit evidence, and takes appropriate action. The auditor documents that evaluation when relevant. Examples of action include modifying the opinion, consulting legal counsel, or withdrawing if the law allows.

Documentation

When matters are communicated orally, the auditor includes in the documentation the matters and when and to whom they were communicated. When communicated in writing, retaining a copy is sufficient. The standard also asks the auditor to document, where relevant, the evaluation of the adequacy of the two-way communication. See AU-C 230.

A practical checklist

These are practice items, not requirements of the standard:

• Identify who the governance contacts are and record their roles in the planning file
• Send a planning communication before fieldwork and keep proof of delivery
• Raise significant difficulties and findings while there is still time to act
• Pull together uncorrected misstatements from the summary of uncorrected misstatements and include them in the closing communication
• Tie the letter to the fraud, noncompliance and control deficiency communications so the same facts do not appear in different words in different documents
• File the final signed or acknowledged version, not a draft

File checks on governance communication

These are practice checks, not requirements of the standard. Weaknesses to look for:

• Governance communication that matches last year's letter nearly word for word
• No evidence that the letter reached the right person
• Uncorrected misstatements omitted from the communication
• Oral communication with nothing in the file
• Significant deficiencies sent to management under AU-C 265 but not to those charged with governance when the two are different people

Related

• Communication with those charged with governance template
• AU-C 265 communicating internal control matters
• AU-C 450 evaluating misstatements
• Summary of uncorrected misstatements calculator

Sources

• AICPA, AU-C Section 260, The Auditor's Communication With Those Charged With Governance (AICPA Professional Standards)
• AICPA, SAS No. 146 (conforming amendments to AU-C 260 application material; periods beginning on or after December 15, 2025)
• AICPA, AU-C Sections 230, 240, 250, 265, 450, 570, 580 and 705 (cross-referenced sections)

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error