Internal control communications: deficiencies, significant deficiencies and material weaknesses

• Distinguish a deficiency, a significant deficiency and a material weakness under AU-C 265.07
• Evaluate severity using magnitude, likelihood and the prudent official test
• Draft a written communication that contains the AU-C 265.14 elements
• Apply the AU-C 265.13 timing requirement

Three definitions

AU-C 265.07 sets the vocabulary:

• Deficiency in internal control: the design or operation of a control does not allow management or employees, in the normal course of their functions, to prevent, or detect and correct, misstatements on a timely basis. A design deficiency means a needed control is missing or would not meet its objective even if operated as designed. An operating deficiency means a properly designed control does not operate as designed, or the person performing it lacks the authority or competence to do it effectively.
• Material weakness: a deficiency, or combination, such that there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis. Reasonable possibility means reasonably possible (more than remote but less than likely) or probable (likely).
• Significant deficiency: a deficiency, or combination, less severe than a material weakness yet important enough to merit attention by those charged with governance.

Evaluating severity

AU-C 265.08 requires you to determine whether the audit work identified any deficiencies, and AU-C 265.09 requires you to evaluate each one, individually and in combination, to decide whether it is a significant deficiency or material weakness. You are not required to search for deficiencies beyond what the audit work surfaces, but you cannot ignore what it does surface.

AU-C 265.A5 frames severity around two questions: the magnitude of the potential misstatement and whether there is a reasonable possibility the controls will fail to prevent, or detect and correct, it. A material weakness can exist even when no misstatement actually occurred. Magnitude factors in AU-C 265.A6 include the amounts exposed to the deficiency and the volume of activity.

AU-C 265.A11 lists indicators of a material weakness:

• Fraud by senior management, whether or not material.
• Restatement of previously issued statements to correct a material misstatement.
• A material misstatement you identified that the entity's controls would not have caught.
• Ineffective oversight of financial reporting and internal control by those charged with governance.

The third indicator is the one that appears most often in small-client audits: when your proposed entries are material and the client's own close process did not catch them, the evaluation starts at material weakness.

AU-C 265.10 adds a check: if you initially conclude a deficiency is not a material weakness, consider whether prudent officials with knowledge of the same facts would likely reach the same conclusion. Document that consideration. The six worked examples show the reasoning on typical small-client facts.

What must be communicated, and when

AU-C 265.11 requires written communication to those charged with governance of significant deficiencies and material weaknesses, including those remediated during the audit. AU-C 265.12 requires communication to management of the same matters in writing, and of other deficiencies that merit management's attention in writing or orally, with oral communication documented.

AU-C 265.13 sets the deadline: no later than 60 days following the report release date. AU-C 265.A16 says the communication is best made by the report release date, and because the written communication is part of the final file, it is also subject to the file assembly deadline in AU-C 230.

Contents of the written communication

AU-C 265.14 requires:

1. The definition of material weakness and, when relevant, significant deficiency.
2. A description of each significant deficiency and material weakness and an explanation of its potential effects.
3. Context: the audit's purpose was to express an opinion on the financial statements; the audit considered internal control to design procedures, not to opine on control effectiveness; you express no opinion on control effectiveness; and your consideration was not designed to identify all deficiencies that might be significant deficiencies or material weaknesses.
4. A restricted-use alert under AU-C 905.

AU-C 265.15 allows a communication stating that no material weaknesses were identified, with the items in paragraph .14a, c and d. AU-C 265.16 prohibits a written statement that no significant deficiencies were identified.

Common findings

• Material audit adjustments with no AU-C 265 evaluation in the file.
• A "management letter" that labels everything a recommendation and never classifies severity.
• Missing context paragraphs or alert.
• A letter dated months after release.

The drafting guide and the evaluation worksheet cover each step.

Maple Ridge Veterinary Group, PLLC: classifying three findings