AU-C section 265, Communicating Internal Control Related Matters Identified in an Audit, tells the auditor how to evaluate control deficiencies found during a GAAS audit of a nonissuer and how to communicate the important ones. It came out of SAS No. 122. It covers communication only. It does not turn a financial statement audit into an audit of internal control.
This page paraphrases the standard. The authoritative text is AU-C 265 in AICPA Professional Standards. For templates, see the internal control communication template and the deficiency evaluation worksheet.
What is the objective of AU-C 265?
The auditor's objective is to communicate appropriately to those charged with governance and management deficiencies in internal control that the auditor has identified during the audit and that, in the auditor's professional judgment, are of sufficient importance to merit their respective attention.
The standard does not require the auditor to perform procedures to identify deficiencies beyond what the audit needs. The auditor must evaluate and communicate what was found. Under AU-C 315 the auditor already obtains an understanding of internal control, and under AU-C 330 may test controls, so deficiencies often surface from that work and from substantive testing.
What are a deficiency, a significant deficiency and a material weakness?
A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis.
A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected, on a timely basis.
A significant deficiency is a deficiency, or a combination of deficiencies, that is less severe than a material weakness yet important enough to merit attention by those charged with governance.
How does the auditor evaluate severity?
The auditor evaluates whether each deficiency identified, individually or in combination, is a significant deficiency or a material weakness. Two things drive severity: the likelihood that a misstatement could occur and not be prevented or detected, and the magnitude of the potential misstatement. The standard stresses that severity does not depend on whether a misstatement actually occurred. A control that could have failed is as severe as one that did, if the exposure is the same.
Factors that affect the evaluation include:
- the nature of the accounts, disclosures and assertions involved
- the susceptibility of the related asset or liability to fraud
- the subjectivity and complexity of determining the amount involved
- the interaction of the deficiency with other deficiencies
- the possible future consequences
- the volume of activity exposed to the deficiency
The auditor also considers compensating controls, meaning other controls that operate at a level of precision that would prevent or detect a material misstatement. A compensating control only counts if the auditor has evidence that it works.
Indicators of a material weakness
The standard lists circumstances that are indicators of a material weakness, paraphrased:
- identification of fraud, whether or not material, by senior management
- a restatement of previously issued financial statements to correct a material misstatement
- identification by the auditor of a material misstatement in circumstances that indicate the entity's internal control would not have detected it
- ineffective oversight of the entity's financial reporting and internal control by those charged with governance
The third indicator matters on small audits. If the auditor has to propose material adjusting entries that the client's controls would not have caught, evaluate whether that points to a deficiency over the financial reporting process that is a material weakness. How far the client leans on the auditor to prepare the financial statements is also an independence question for nonattest services. See adjusting journal entries in an audit for how those entries are handled.
What must be communicated, and to whom?
| Matter | To whom | Form | Timing |
|---|---|---|---|
| Significant deficiencies and material weaknesses identified during the audit, including any remediated during the audit | Those charged with governance | In writing | On a timely basis, and no later than 60 days after the report release date |
| Significant deficiencies and material weaknesses | Management | In writing | Same, at the appropriate level of responsibility |
| Other deficiencies that merit management's attention, if not already communicated by others | Management | Oral or written | On a timely basis |
Matters previously communicated are still communicated. The written communication may refer to the earlier letter and its date, and the auditor does not need to repeat the full description.
If other deficiencies are communicated orally, the auditor documents the communication, when and to whom. If those charged with governance and management are the same people and the matter has been written to them, no second communication is needed.
The 60-day limit matches the audit file assembly period in AU-C 230. Good practice is to send the letter by the report date, since the matters are often relevant to the discussion with those charged with governance under AU-C 260.
What must the written communication say?
The written communication includes:
- a statement that the purpose of the audit was to express an opinion on the financial statements, not on the effectiveness of internal control
- a statement that the auditor is not expressing an opinion on internal control, and that the audit included consideration of internal control only to design procedures appropriate in the circumstances
- a statement that the auditor's consideration of internal control was not designed to identify all deficiencies, so there may be others not reported
- a description of the significant deficiencies and material weaknesses and an explanation of their potential effects
- a statement that the communication is intended solely for the information and use of management, those charged with governance and others within the entity, and not for use by anyone else
- the definition of material weakness and, where relevant, significant deficiency
Management's response can appear in the letter. If it does, the auditor does not audit it, and a note to that effect is usual.
Do not issue a letter saying that no significant deficiencies were noted. The standard's guidance discourages it because it can be misread as assurance on internal control.
What about smaller entities?
Smaller entities often rely on one or two people for authorization, recording and custody. Lack of segregation of duties is the common deficiency. The auditor's job is to evaluate it like any other: look at the accounts exposed, the likelihood and magnitude, and compensating controls such as owner review. A letter that lists segregation of duties in identical wording for every client does not show that the deficiency was evaluated in the client's own context.
How AU-C 265 links to other standards
- AU-C 315 and 330. The understanding of controls and the tests of controls are where deficiencies come from.
- AU-C 240. Fraud by senior management is an indicator of a material weakness.
- AU-C 260. Significant deficiencies and material weaknesses also feed the governance communication.
- AU-C 230. The auditor documents deficiencies and the communication.
Documentation
The auditor documents the evaluation (why a deficiency was or was not classified as a significant deficiency or material weakness), who the communication went to and when, and the final letter. See AU-C 230.
File checks on internal control communications
These are practice checks, not requirements of the standard. Weaknesses to look for:
- Deficiencies noted in working papers but never evaluated for severity
- Letters sent after the 60-day window, or with no evidence of delivery
- Management letters that mix required matters with operational suggestions without separating them
- Material adjustments found by the auditor with no consideration of whether they indicate a material weakness
- Generic letters repeated across clients
For the broader writing guidance, see the management letter guide.
Related
- Internal control communication template
- Deficiency evaluation worksheet
- Management letter guide
- AU-C 260 governance communication
Sources
- AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit (AICPA Professional Standards)
- AICPA, AU-C Sections 230, 240, 260, 315 and 330 (cross-referenced sections)
Part of CORAA University · Completion and reporting: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error