Skip to content

ACCA Applied Skills · Audit and Assurance

Communication on Internal Control for ACCA Audit and Assurance

Communication on internal control is how the auditor reports control weaknesses found during the audit. You identify deficiencies, decide which are significant, report them in writing to those charged with governance and management, and follow up the responses. In the exam, you must explain each deficiency, its effect and a practical recommendation.

What this chapter covers

This chapter covers what happens after you test and evaluate internal controls. You find a weakness, judge how serious it is, and tell the right people in the right way. The ISA on communicating deficiencies in internal control sets out the core duty: report significant deficiencies in writing, on a timely basis, to those charged with governance. You also tell management about other deficiencies that are of sufficient importance to merit their attention.

The chapter has four parts. First, you learn to recognise a deficiency and decide whether it is significant. Second, you learn who receives the report and when. Third, you learn the layout and content of the management letter. Fourth, you learn how management responds and what you do next.

It links closely to other parts of the paper. Understanding the entity's systems and controls feeds the deficiencies you report. Tests of controls, and the audit procedures you change because controls are weak, connect to the risk assessment. Internal audit and the wider reporting and completion stages also draw on this chapter. A Section C question often asks you to identify deficiencies in a scenario and then write the management letter points.

Control weaknesses in a scenario are a favourite exam topic, and this chapter turns them into marks. A typical question asks for the deficiency, its potential effect and a recommendation, so one well-structured answer can score on each part. Objective test cases also test the definition of a significant deficiency, who must be told and what the report must contain. These are all-or-nothing questions, so precise knowledge matters. Practising this chapter also improves your written answer layout, which helps in every constructed response question.

Communication on internal control: topics in the order to study them

  1. 1Internal Control Deficiencies and Significant DeficienciesYou must first know what a deficiency is and how to judge its significance before you can report anything.
  2. 2Reporting Deficiencies to Those Charged with GovernanceOnce you can rank deficiencies, learn who must be told, in what form and how quickly.
  3. 3Management Letter Format and ContentThis applies the earlier reporting rules to the written document you will be asked to draft in the exam.
  4. 4Responses from Management and Follow-up ActionsThis closes the loop and is easiest to learn once you know what the letter contains.

How to prepare Communication on internal control

Treat this chapter as a skill, not just a list to memorise. The exam rewards clear, practical writing based on a scenario.

  1. Learn the definitions of a deficiency and a significant deficiency in your own words, then practise judging examples.
  2. Memorise who receives each communication and the requirement for written, timely reporting of significant deficiencies.
  3. Learn the standard layout of a management letter: deficiency, potential effect, recommendation, and sometimes management response.
  4. Take a scenario describing a business process, such as purchases or payroll, and list every control weakness you can spot.
  5. For each weakness, write the three parts in one or two sentences each: the deficiency, the consequence and the fix. Keep the recommendation practical and specific to the facts.
  6. Practise objective questions on the rules, then one timed written question, and mark yourself against the three-part layout.
  7. Revisit follow-up actions last, including how you consider management responses and what you do at the next audit.

Common mistakes in Communication on internal control

  • Stating the deficiency but not its potential effect.

    Fix: Always write a consequence sentence, such as possible fraud, error or loss, before the recommendation.

  • Giving vague recommendations like 'improve controls'.

    Fix: Name the specific control, who performs it and what evidence it leaves, for example independent review of supplier bank changes.

  • Treating every deficiency as significant.

    Fix: Judge each one on how likely a misstatement is and how large it could be, and whether compensating controls exist.

  • Confusing who gets the report.

    Fix: Remember that significant deficiencies go in writing to those charged with governance, and other matters go to management.

  • Writing a generic letter that ignores the scenario facts.

    Fix: Use the figures, staff roles and processes from the scenario in every point.

  • Forgetting the follow-up stage.

    Fix: Learn that you consider management's response and check progress at the next audit, and that the report is not a substitute for audit procedures.

Last-day revision: Communication on internal control

  • A deficiency exists when a control is designed, implemented or operated so it cannot prevent, or detect and correct, misstatements on time, or when a needed control is missing.
  • A significant deficiency is one that, in your professional judgement, is important enough to merit the attention of those charged with governance.
  • Significant deficiencies must be communicated in writing to those charged with governance on a timely basis.
  • Other deficiencies of sufficient importance are communicated to management at an appropriate level.
  • You only report deficiencies you identify during the audit; the audit is not designed to find all control weaknesses.
  • Each point in a management letter should state the deficiency, its potential effect and a recommendation.
  • The written communication should state that it is only of deficiencies identified during the audit and is not a full control review.
  • The letter should also note that it is for governance and management use only and not for third parties.
  • Recommendations must be practical and fit the size and resources of the entity.
  • Management's response to each point is usually invited and recorded, but it does not remove your duty to report.
  • Follow up the response at the next audit by checking whether controls were actually changed.
  • Link each deficiency to its effect on the audit approach, such as more substantive testing.

Communication on internal control in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Communication on internal control: frequently asked questions

What is the difference between a deficiency and a significant deficiency?

A deficiency is any weakness in the design, implementation or operation of a control, or a missing control. A significant deficiency is one that, in your judgement, is important enough to need the attention of those charged with governance.

Who must the auditor report significant deficiencies to?

You must report them in writing to those charged with governance on a timely basis. Other deficiencies that merit attention are reported to management.

What should each point in a management letter include?

Each point should describe the deficiency, explain its potential effect on the entity or the financial statements, and give a clear recommendation. Many letters also leave space for management's response.

How is this chapter examined?

It appears in objective test cases on the rules and definitions, and in constructed response questions where you identify deficiencies from a scenario and write management letter points. Written answers are marked on the deficiency, effect and recommendation.