ISA 265

Communicating Deficiencies in Internal Control to Those Charged with Governance and Management

1Objective and scope

ISA 265 deals with the auditor's responsibility to communicate appropriately to those charged with governance and management deficiencies in internal control identified in an audit of financial statements. It does not impose additional responsibilities to obtain an understanding of internal control or to test controls beyond ISA 315 and ISA 330: the auditor is not engaged to report on the effectiveness of internal control and expresses no opinion on it. The standard simply requires that what the auditor happens to find, at any stage of the audit, is reported to the people who can act on it. Nothing in ISA 265 precludes the auditor from communicating other control matters as well.

The objective is to communicate appropriately to those charged with governance and management deficiencies in internal control that the auditor has identified during the audit and that, in the auditor's professional judgement, are of sufficient importance to merit their respective attentions.

2Key definitions

3Requirements

Determining whether deficiencies are significant

The auditor determines, on the basis of the audit work performed, whether one or more deficiencies have been identified, and if so whether individually or in combination they constitute significant deficiencies. Matters that indicate significance include the likelihood of the deficiencies leading to material misstatement in the future; the susceptibility to loss or fraud of the related asset or liability; the subjectivity and complexity of determining estimated amounts; the amounts exposed; the volume of activity in the balance or class of transactions; the importance of the control to the financial reporting process; the cause and frequency of exceptions; and the interaction of the deficiency with others. Some indicators point to a significant deficiency on their own: evidence of ineffective control environment aspects (management fraud, a failure to act on previously communicated deficiencies), absence of a risk assessment process, an ineffective response to identified significant risks, misstatements detected by the auditor that the entity's controls did not catch, restatement of prior statements to correct a material misstatement, and management's inability to oversee financial reporting.

Communicating

• Communicate significant deficiencies identified during the audit to those charged with governance in writing on a timely basis. The written communication is normally issued before the auditor's report, though it may follow it where timing makes that appropriate; early oral communication of urgent matters is expected, followed by the written report.
• Communicate to management at an appropriate level of responsibility, on a timely basis, (a) in writing, the significant deficiencies that have been or will be communicated to those charged with governance (unless it would be inappropriate to communicate directly to management, for example where the deficiency implicates management's integrity), and (b) other deficiencies identified that have not been communicated by others and that merit management's attention; this second class may be communicated orally.
• Significance is judged by potential effect, so the auditor communicates a significant deficiency even where no misstatement was found and even where management has since fixed it, noting the remediation.
• The fact that a deficiency was communicated in a prior period and remains unremedied does not remove the need to repeat it; the repetition may itself indicate an ineffective control environment.

4Documentation and reporting

The written communication of significant deficiencies must include a description of each deficiency and an explanation of its potential effects (without needing to quantify them), and sufficient information to enable those charged with governance and management to understand the context: that the purpose of the audit was to express an opinion on the financial statements, that the audit included consideration of internal control only to design appropriate procedures and not to express an opinion on its effectiveness, and that the matters reported are limited to deficiencies identified during the audit that the auditor concluded were of sufficient importance to report. Law or regulation may require the communication to be made available to a regulator; otherwise the letter is confidential, and the auditor may include a statement that it is intended solely for those charged with governance and management. A copy is retained on the audit file, together with the documentation of the deficiencies and the judgement about their significance.

5Examinable focus