Audit and Assurance · Communication on internal control

Management Letter Format and Content for ACCA AA

Updated 11 October 2026 · Fact-checked

A management letter is a written report to management or those charged with governance on internal control deficiencies found during the audit. Each point has three parts: the deficiency, its consequence and a recommendation. The letter also states that it covers only deficiencies noted and is for the recipient's use only.

Understand Management Letter Format and Content

During the audit you test and evaluate internal controls. You will often find weaknesses. ISA 265 requires you to communicate significant deficiencies in writing to those charged with governance on a timely basis. Other deficiencies are usually reported to management. This written report is commonly called a management letter or report to management.

The letter exists to help the client. Weak controls raise the risk of fraud and error, so management needs to know what is wrong and how to fix it. It also protects you, because it is evidence that you told the client.

The exam expects a standard layout for each point. First, the deficiency: what is wrong, stated factually. Second, the consequence: what could go wrong for the business because of it, such as fraud, error, loss of assets or misstated financial statements. Third, the recommendation: a practical action that removes the weakness. Exam answers are often set out as a three-column table, but a clear list works.

The letter must also carry some wording on its limits. It should say that the matters reported are only those that came to your attention during the audit. The audit was not designed to find all control weaknesses, so the letter is not a full review of internal control. It should also say that it is for the use of the recipient only and that you accept no responsibility to third parties. Where the letter reports significant deficiencies, you may also note that the purpose of the audit was to express an opinion on the financial statements.

The key skill is precision. A good consequence relates to this business and this weakness. A good recommendation is specific and can be done.

Key rules to remember

Three-part structure of each point: Deficiency → Consequence → Recommendation; Every point in the letter and in your exam answer should have all three parts.
Deficiency: What is wrong in the control, stated as a fact; Describe the weakness, not the missing fix. Do not write 'no supervisor' as a recommendation.
Consequence: Risk to the business: fraud, error, loss of assets, misstated financial statements; Link it to this client's situation and say what could happen.
Recommendation: Specific action, who does it, and what it achieves; It must address the deficiency directly and be practical for the client.
Limits on use: Only deficiencies noted during the audit; for the recipient's use only; no duty to third parties; The audit is not designed to find all control weaknesses, so the letter is not a full control review.
Recipients (ISA 265): Significant deficiencies: in writing to those charged with governance; other deficiencies: to management; Communicate on a timely basis.

How to solve Management Letter Format and Content questions

Use this method for any question that asks you to identify control deficiencies and report them, or to draft part of a management letter.

1Read the scenario and underline each control weakness. Look for missing authorisation, lack of segregation of duties, no checks, and poor access controls.
2For each weakness, write the deficiency as a clear factual statement of what is happening now.
3Write the consequence. Ask: what could go wrong because of this? Name the risk, such as fraud, error, overpayment or misstatement.
4Write the recommendation. Ask: what one action would remove the weakness? Say who should do it.
5Check that the recommendation fixes the deficiency you described, not a different one.
6Use a table or three labelled parts for each point so the marker can find each mark.
7If asked about the letter itself, add the limits: only matters noted, not a full review, for the recipient's use only.
8Check the number of points against the marks available. Aim for one mark per well-formed part.

Quickest way: Three-line point method

When to use it: Use this in Section C when time is short and the scenario lists many weaknesses.

Scan once and mark each weakness with a short note in the margin.
For each one write three short lines: Deficiency, Consequence, Recommendation.
Start the recommendation with a verb such as 'Require', 'Introduce' or 'Review'.
Skip long introductions. Add one line on limits of use only if asked about the letter.
Spend any spare time making consequences specific to the client.

Common mistakes in Management Letter Format and Content

Writing the deficiency as the absence of a control, such as 'there is no supervisor review'.
It feels natural to describe what is missing, but it is really the recommendation in disguise.
Fix: Describe what happens now, for example 'the same clerk raises and approves payments'. Then recommend the review.
Giving a vague consequence such as 'this is a risk'.
Students rush and do not say what could actually go wrong.
Fix: Name the outcome: fraud, duplicate payment, misstated receivables or loss of inventory. Tie it to the scenario.
Writing recommendations that do not fix the stated deficiency.
Students write a general good-practice idea instead of answering the specific weakness.
Fix: Read the deficiency again and check that your action would stop it from happening.
Recommending impractical solutions, such as hiring many staff in a small company.
Students forget the size and cost limits of the client.
Fix: Suggest realistic controls, such as owner review or a monthly check by a director.
Leaving out the limits on the letter's use.
Students treat the letter as only a list of points.
Fix: State that it covers only matters noted during the audit, is not a full control review, and is for the recipient only.
Listing the consequences for the auditor, such as 'we cannot rely on controls', instead of for the client.
Students confuse audit impact with business impact.
Fix: Write the consequence from the client's view. Mention the audit impact only if the question asks for it.

Worked examples

Example 1

During the audit of Kiran Ltd you find that the same accounts clerk prepares supplier payment runs and also has authority to release them in the bank system. Draft a management letter point.

Show the solution

Deficiency: one person both prepares and releases supplier payments, so there is no segregation of duties.
Consequence: the clerk could create payments to a fictitious supplier or to themselves and release them without anyone noticing. Errors in payments would also go unchecked, which could misstate payables and cash.
Recommendation: require a second authorised person, such as the finance manager, to review the payment run and release it. Set bank system rights so that the preparer cannot release payments.
Check: the recommendation separates the two tasks, so it fixes the deficiency.

Answer: Deficiency: the same clerk prepares and releases supplier payments. Consequence: risk of fraudulent or erroneous payments going undetected, and misstated payables and cash. Recommendation: a second authorised person should review and release payments, and bank system access rights should prevent the preparer from releasing them.

Example 2

Your audit manager asks you to write the closing paragraph of a management letter for Norwood Co. What should it say about the limits on the letter and its use?

Show the solution

State that the letter covers only the deficiencies that came to our attention during the audit.
Explain that the audit was designed to give an opinion on the financial statements, not to review all internal controls, so other weaknesses may exist.
State that the letter is for the use of management (or those charged with governance) only.
State that we accept no responsibility to any third party who relies on it.
Check that the wording does not claim the controls are otherwise adequate.

Answer: This letter covers only the deficiencies that came to our attention during our audit. The audit was carried out to express an opinion on the financial statements and was not designed to identify all control weaknesses, so there may be other deficiencies. The letter is for the use of Norwood Co's management only. We accept no responsibility to any third party who relies on it.

Exam tips

Always use the three parts: deficiency, consequence, recommendation. Markers award separate marks for each.
Make each consequence specific to the scenario. Generic wording earns little.
Keep recommendations practical for the size of the business described.
If the question asks about the letter itself, mention the limits on its use and who it is for.
In objective questions, remember that significant deficiencies go in writing to those charged with governance.

Management Letter Format and Content in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Management Letter Format and Content: frequently asked questions

What is the format of a management letter in the ACCA AA exam?

Set out each point as deficiency, consequence and recommendation. Many answers use a three-column table. The letter also states the limits on its use.

Who receives a management letter?

Significant deficiencies are communicated in writing to those charged with governance. Other deficiencies are normally reported to management. Both should be communicated on a timely basis.

Does a management letter list all control weaknesses?

No. It covers only the deficiencies that came to the auditor's attention during the audit. The audit is not designed to find every weakness, and the letter should say so.

What is the difference between a deficiency and a recommendation?

The deficiency describes what is wrong with the control as it operates now. The recommendation is the action that would fix it. Keep them separate so you earn marks for both.