Communicating Deficiencies in Internal Control to Those Charged with Governance and Management

CAS 265

Communicating Deficiencies in Internal Control to Those Charged with Governance and Management

CAS 265

Objective
  • The objective of the auditor is to communicate to those charged with governance and management deficiencies in internal control identified during the audit and that are of sufficient importance
  • Deficiency in internal control can happen in two ways
    • When a control is not designed, implemented, or operated in a way to prevent, detect, or correct misstatements in the f/s
    • When a controls are missing
Requirements
  • If the auditor identified deficiencies in internal control, determine if the deficiencies are significant deficiencies
    • Significant deficiencies may exist even though the auditor has not identified misstatements during the audit (i.e. If the control is not designed properly)
  • Factors to consider when deciding if deficiency is significant:
    • Likelihood of the deficiencies leading to material misstatements in the f/s
    • Susceptibility to fraud
    • Subjectivity (bias) and complexity of determining estimated amounts (i.e. Accounting estimates)
    • The importance of the controls to the financial reporting process
  • Indicators of a significant deficiency in internal controls:
    • Significant transactions not being scrutinized by those charged with governance
    • Management fraud (material or immaterial) not caught by internal controls
    • Absence of or ineffective risk assessment process within the entity
    • Evidence of an ineffective response to identified significant risks
  • Significant deficiencies in internal control identified during the audit should be communicated to those charged with governance in writing on a timely manner
  • Communicate to management at an appropriate level of responsibility on a timely basis:
    • In writing, significant deficiencies in internal control that the auditor has or will communicate to those charged with governance, unless it would be inappropriate to communicate directly to management
    • Other deficiencies in internal control identified during the audit that have not been communicated to management by other parties and that are of sufficient importance (this could be in writing or done verbally)
  • Written communication of significant deficiencies in internal control should include:
    • A description of the deficiencies and an explanation of their potential effects
    • Sufficient information to help understand the context of the communication:
      • The purpose of the audit was for the auditor to express an opinion on the F/S
      • The audit considered internal control relevant to the preparation of the F/S in order to design audit procedures, but not for the purpose of expressing an opinion on the effectiveness of internal control
      • The matters being reported are limited to deficiencies that the auditor has identified during the audit and that the auditor has concluded are of sufficient importance

Spread the Word!

Scroll to Top
Scroll to Top