ACCA Applied Skills · Audit and Assurance

Communication on internal control: formula sheet

Full chapter guide

Key formulas

Deficiency (ISA 265): Deficiency = control cannot prevent, or detect and correct, misstatements on a timely basis OR a necessary control is missing; Covers design, implementation, operation and absence of controls.
Significant deficiency (ISA 265): Significant deficiency = deficiency (or combination) important enough, in the auditor's judgement, to merit attention of those charged with governance; Judgement-based. No fixed monetary threshold.
Factors in judging significance: Likelihood of misstatement + potential magnitude + presence of compensating controls + combined effect; A misstatement does not have to have occurred already.
Reporting requirement: Significant deficiencies: communicate in writing to those charged with governance on a timely basis. Other deficiencies: communicate to management at an appropriate level, unless inappropriate.; Written communication is required for significant deficiencies. Include a description and an explanation of the potential effects.
Definition of a deficiency: Deficiency = control cannot prevent, or detect and correct, misstatements in the financial statements on a timely basis, OR a needed control is missing; Learn both limbs: poor design or operation, and absence of a control.
Reporting rule for significant deficiencies: Significant deficiency → written communication → TCWG → timely; Oral communication alone does not meet the requirement.
Reporting rule for other deficiencies: Other deficiency of sufficient importance → management (oral or written) → timely; If you report orally, document when and to whom in the audit file.
Content of the written report: Description of deficiencies + potential effects + (recommendation) + explanation of purpose of audit and limits of the report; The report must describe the deficiencies and explain their potential effects. It must explain that the audit was to express an opinion on the financial statements, that internal control was considered only to design audit procedures and not to opine on its effectiveness, and that only identified deficiencies of sufficient importance are reported. ISA 265 permits, but does not require, a statement restricting use to TCWG, management and others within the organisation.
Three-part structure of each point: Deficiency → Consequence → Recommendation; Every point in the letter and in your exam answer should have all three parts.
Deficiency: What is wrong in the control, stated as a fact; Describe the weakness, not the missing fix. Do not write 'no supervisor' as a recommendation.
Consequence: Risk to the business: fraud, error, loss of assets, misstated financial statements; Link it to this client's situation and say what could happen.
Recommendation: Specific action, who does it, and what it achieves; It must address the deficiency directly and be practical for the client.
Limits on use: Only deficiencies noted during the audit; for the recipient's use only; no duty to third parties; The audit is not designed to find all control weaknesses, so the letter is not a full control review.
Recipients (ISA 265): Significant deficiencies: in writing to those charged with governance; other deficiencies: to management; Communicate on a timely basis.
Follow-up chain: Deficiency found → report to management / those charged with governance → management response → follow-up at next audit → adjust audit approach; Use this order for any written answer. Each link can earn a mark.
Effect of an unremedied deficiency: Control not reliable → no reliance → more substantive procedures; Reduced control risk assessment is only justified where controls are effective.
Management response options: Accept and fix | Accept in part | Reject (with reasons); The auditor records the response. Rejection by management does not remove the auditor's duty to report.
Deficiency vs fraud: Deficiency = control weakness; fraud = intentional act; A deficiency may allow fraud, but is not itself fraud. Fraud is communicated and judged on a separate basis.

Quick revision

A deficiency exists when a control is designed, implemented or operated so it cannot prevent, or detect and correct, misstatements on time, or when a needed control is missing.
A significant deficiency is one that, in your professional judgement, is important enough to merit the attention of those charged with governance.
Significant deficiencies must be communicated in writing to those charged with governance on a timely basis.
Other deficiencies of sufficient importance are communicated to management at an appropriate level.
You only report deficiencies you identify during the audit; the audit is not designed to find all control weaknesses.
Each point in a management letter should state the deficiency, its potential effect and a recommendation.
The written communication should state that it is only of deficiencies identified during the audit and is not a full control review.
The letter should also note that it is for governance and management use only and not for third parties.
Recommendations must be practical and fit the size and resources of the entity.
Management's response to each point is usually invited and recorded, but it does not remove your duty to report.
Follow up the response at the next audit by checking whether controls were actually changed.
Link each deficiency to its effect on the audit approach, such as more substantive testing.

Common mistakes

Treating every deficiency as significant. Fix: Judge likelihood and magnitude of misstatement. Minor items go to management, significant ones to those charged with governance.
Forgetting that a missing control is a deficiency. Fix: Ask what control should exist but does not, such as no authorisation of payments or no bank reconciliation.
Saying significant deficiencies can be reported orally to TCWG. Fix: Remember: significant deficiencies to TCWG must be in writing. Other deficiencies to management may be oral or written.
Listing the deficiency without the potential effect. Fix: Always write what could go wrong, such as fraud, error or misstated figures, before the recommendation.
Writing the deficiency as the absence of a control, such as 'there is no supervisor review'. Fix: Describe what happens now, for example 'the same clerk raises and approves payments'. Then recommend the review.
Giving a vague consequence such as 'this is a risk'. Fix: Name the outcome: fraud, duplicate payment, misstated receivables or loss of inventory. Tie it to the scenario.
Saying the auditor must force management to fix the deficiency. Fix: Say management is responsible for internal control. The auditor reports, records the response and adjusts the audit work.
Accepting management's promise as evidence the control now works. Fix: State that the auditor inspects the change and tests it operating before relying on it.

Exam tips

Use ISA 265 wording: 'deficiency', 'significant deficiency' and 'those charged with governance'. Do not use older terms such as 'weakness' alone.
Always link a weakness to a consequence and a recommendation. Marks are usually split across these three parts.
In objective questions, read carefully for 'in writing' and 'timely basis' since these often decide the answer.
Do not give a monetary rule for significance. Say it is a matter of professional judgement.
Where a scenario lists many small weaknesses, mention that they may be significant in combination.
Whenever a question asks for a report on weaknesses, use three headings: deficiency, potential effect, recommendation. Examiners mark each part.
Learn the split: significant deficiencies go to TCWG in writing; other deficiencies go to management. OT questions often test this.
Make recommendations practical and specific. 'Introduce a second authoriser' scores; 'improve controls' does not.