Reports to those charged with governance and management: formula sheet

Key formulas

Deficiency

Control cannot prevent, or detect and correct, misstatements on a timely basis, or a necessary control is missing

Applies to design, implementation or operation. Communicate to management at an appropriate level unless inappropriate in the circumstances.

Significant deficiency

Deficiency (or combination) important enough, in your judgement, to merit TCWG attention

It is a judgement. Do not assume it depends on whether an error has actually occurred.

Written communication of significant deficiencies

Significant deficiencies → written, to TCWG, on a timely basis

Also tell management in writing about significant deficiencies (unless inappropriate) and about other deficiencies that merit management's attention.

Content of the written report

Description + potential effects + context for the communication (limited scope) + enough explanation for TCWG to understand

Include that the audit was not designed to identify all deficiencies and that the report is for TCWG and management use only.

Structure of each point

Deficiency + Implication + Recommendation

Use this for every point in the letter or table. Missing one part loses marks.

ISA 265 core requirement

Significant deficiencies → communicate in writing to those charged with governance, on a timely basis

Other deficiencies that merit management's attention are also communicated, orally or in writing.

Content of the written communication (ISA 265)

Description of deficiencies + explanation of their potential effects + enough information for TCWG and management to understand the context

It should also state that the audit considered controls only to the extent needed to form an opinion, so not all deficiencies may be identified.

Prioritisation test

Rank by likelihood × potential impact on the financial statements and the business

This is a judgement guide, not a calculation. Put the most serious points first.

ISA 260: matters to communicate

Responsibilities + planned scope and timing + significant findings + independence

For listed entities, communicate independence in writing: a statement of compliance, all relationships and other matters that may reasonably bear on independence, and the safeguards. For other entities, communicate it where appropriate.

ISA 265: deficiencies

Significant deficiencies → TCWG in writing on a timely basis, and to management in writing on a timely basis unless inappropriate. Other deficiencies → management on a timely basis if they merit its attention, unless it has already been told

Only deficiencies you have identified during the audit. The audit is not designed to find all deficiencies. Other deficiencies may be communicated orally or in writing, and you document oral communication.

ISA 701: KAMs

KAMs = matters communicated with TCWG that required significant auditor attention and were most significant in the audit

Required for listed entities. Not a substitute for a modified opinion, and not a separate opinion on those matters. A matter giving rise to a modified opinion or a material uncertainty is not described as a KAM.

Independence communication

Threat + safeguard + conclusion on whether independence is maintained

Threats: self-interest, self-review, advocacy, familiarity, intimidation.

Fraud and non-compliance

All identified or suspected fraud → appropriate level of management on a timely basis. Fraud involving management, employees with significant roles in internal control, or others where it results in a material misstatement → also TCWG. Non-compliance with laws → discuss with management where appropriate; communicate to TCWG unless clearly inconsequential. Where management or TCWG are suspected of involvement → consider the next higher authority and legal advice

Check confidentiality duty and local law on whether to report to an outside authority.

Quick revision

• TCWG are those with responsibility for overseeing the entity's strategic direction and accountability, such as the board or audit committee.
• Where roles are unclear, the auditor decides who the appropriate TCWG are. Management may be involved in governance.
• ISA 260 communications cover auditor responsibilities, planned scope and timing, and significant findings.
• Significant findings include views on accounting practices, difficulties during the audit, and uncorrected misstatements.
• For audits of listed entities, ISA 260 (para 17) requires the auditor to communicate to TCWG a statement that the engagement team and firm comply with relevant ethical requirements on independence. The auditor also communicates all relationships and other matters that may reasonably bear on independence, and the related safeguards. For other entities, ISA 260 does not mandate this, though the IESBA Code and local rules may require it.
• ISA 265 requires you to communicate significant deficiencies in internal control in writing to TCWG on a timely basis.
• ISA 265 also requires the auditor to communicate to management, at an appropriate level of responsibility and on a timely basis: (a) in writing, significant deficiencies that have been or will be communicated to TCWG, unless it is inappropriate to communicate them directly to management; and (b) other deficiencies that merit management's attention, in writing or orally, if they have not already been communicated to management by others.
• A significant deficiency is a deficiency, or combination of deficiencies, in internal control that, in the auditor's professional judgement, is of sufficient importance to merit the attention of TCWG.
• A good management letter point states the deficiency, the consequence and a practical recommendation.
• Keep management's responses separate from the auditor's findings in the letter.
• Make the tone constructive and tie each point to the scenario facts.
• Keep the report from implying that all deficiencies have been found. The audit is not designed to identify them all.

Common mistakes

• Treating every deficiency as significant and sending everything to TCWG. Fix: Judge each point. Only significant deficiencies must go in writing to TCWG; others go to management.
• Listing the weakness without the effect or a recommendation. Fix: Always add what could go wrong and a practical fix.
• Listing deficiencies without implications or recommendations. Fix: Use a three-column table and fill every cell before moving to the next point.
• Writing generic implications such as 'this could lead to fraud'. Fix: Name the specific fraud or error, for example 'a clerk could create a fictitious supplier and divert payments', and link it to the client's facts.
• Confusing ISA 260 and ISA 265. Fix: ISA 260 is the general communication framework. ISA 265 is only control deficiencies. Say which one you are applying.
• Saying all deficiencies go to TCWG. Fix: Significant deficiencies go to TCWG in writing, and also to management in writing unless that is inappropriate. Other deficiencies go to management if they merit its attention and it has not already been told. These may be oral or written, and you document oral communication.

Exam tips

• Always give three parts for each point: deficiency, effect, recommendation. Marks are usually split across them.
• Link each weakness to a financial statement risk, such as overstatement of assets or unrecorded liabilities.
• Use the scenario's facts. Generic points earn little.
• When asked to draft, include recipient, clear headings, a professional tone and the limited scope sentence to collect professional skills marks.
• Where requirement asks whether a point is significant, give a reasoned judgement, not just a yes or no.
• Use a table or clear headings. Examiners reward a professional layout, and it helps your professional skills marks.
• Always tie each point to a fact in the scenario. A point with no scenario link scores poorly.
• Write implications in terms of financial statement risk and business risk, not only fraud.