What it is
In a financial statement audit the auditor decides whether each control deficiency noted is a deficiency, a significant deficiency or a material weakness, and communicates the last two in writing. The decision turns on whether there is a reasonable possibility the controls will fail to prevent, or detect and correct, a misstatement, and on how large the misstatement could be. It does not turn on whether a misstatement happened.
This workbook logs each deficiency with those two questions, any compensating control and the standard’s indicators of a material weakness, then proposes a classification from your thresholds. You enter the conclusion, and the sheet flags any conclusion below the screen until the rationale is written. An aggregation tab groups deficiencies by process area, and a timing column checks the communication against the 60-day deadline.
When to use it
- At the end of fieldwork, to evaluate every deficiency noted in the audit before drafting the written communication.
- When several related deficiencies in one area might be a significant deficiency or material weakness in combination.
- To track delivery of the required communication to management and those charged with governance.
What’s inside
- Parameters: materiality, performance materiality, screening threshold, release date and due date
- Log of up to 30 deficiencies with severity screen, your conclusion and rationale
- Material weakness indicators and a compensating control column
- Aggregation by process area with combined exposure against the thresholds
- Summary with counts, communication timing and tie-outs
Standard cited
This template follows AU-C 265. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use. See AU-C 265 explained.
Questions
What is the difference between a significant deficiency and a material weakness?
A material weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is less severe than a material weakness, yet important enough to merit the attention of those charged with governance.
Does the deficiency have to have caused a misstatement to be a material weakness?
No. Severity depends on the reasonable possibility of failure and the magnitude of the potential misstatement, not on whether a misstatement occurred. Indicators such as fraud by senior management or a restatement point toward a material weakness.
When must the written communication be delivered?
No later than 60 days following the report release date. The worksheet computes the due date from the release date you enter and marks each communication On time, Pending or Late.
Can the letter say that no significant deficiencies were found?
No. AU-C 265 does not permit a written communication stating that no significant deficiencies were identified. A statement that no material weaknesses were identified is permitted if the communication meets the other requirements.
Related templates
- SOX Control Deficiency Evaluation Worksheet
- Management Letter — Internal Control Communication (AU-C 265)
- Management Letter Comment Tracker and Drafting Aid
- Communication With Those Charged With Governance (AU-C 260)
Last updated 11/05/2026. All free templates.