Audit and Assurance · Communication on internal control

Reporting Deficiencies to Those Charged with Governance

Updated 11 October 2026 · Fact-checked

Under ISA 265, the auditor must communicate significant deficiencies in internal control in writing, on a timely basis, to those charged with governance. Other deficiencies that merit management's attention are reported to management. The communication describes each deficiency and explains its potential effects. ISA 265 does not require recommendations, though exam questions usually ask for them.

Understand Reporting Deficiencies to Those Charged with Governance

An audit involves looking at a client's internal controls. You do this to assess risk and plan your work. While doing so, you often find weaknesses. ISA 265 tells you what to do with them. You do not keep them to yourself. You report them.

A deficiency in internal control exists when a control is designed, implemented or operated in a way that cannot prevent, or detect and correct, misstatements in the financial statements on a timely basis. It also exists when a needed control is missing. A significant deficiency is one deficiency, or a combination of deficiencies, that in your professional judgement is of sufficient importance to merit the attention of those charged with governance.

Those charged with governance (TCWG) are the people with responsibility for overseeing the strategic direction of the entity and its accountability. This usually means the board of directors, or the audit committee, or the non-executive directors. In a small owner-managed company, TCWG and management may be the same people. If all of those charged with governance are also involved in managing the entity, you do not need to communicate separately to management. You must still communicate significant deficiencies in writing.

You must report significant deficiencies in writing. Oral points alone are not enough for these. You must do it on a timely basis, so management can take action. You should also communicate to management, on a timely basis, any deficiencies you communicate to TCWG, unless that would be inappropriate in the circumstances. You should also tell management about other deficiencies that are important enough to merit its attention. This can be done orally or in writing. If you do it orally, document when and to whom in your audit file.

The written report, often a management letter or letter of weakness, must describe the deficiencies and explain their potential effects. It must also explain three things:

The purpose of the audit was to express an opinion on the financial statements.
The audit included consideration of internal control only to design appropriate audit procedures, not to express an opinion on how effective the controls are.
The matters reported are limited to deficiencies you identified during the audit and concluded were of sufficient importance to merit reporting, so it does not list all control weaknesses.

ISA 265 permits, but does not require, a statement that the communication is for use only by TCWG, management and others within the organisation.

For each deficiency, describe it and explain its potential effects. Add a recommendation, as this is what exam questions usually ask for.

Key rules to remember

Definition of a deficiency: Deficiency = control cannot prevent, or detect and correct, misstatements in the financial statements on a timely basis, OR a needed control is missing; Learn both limbs: poor design or operation, and absence of a control.
Reporting rule for significant deficiencies: Significant deficiency → written communication → TCWG → timely; Oral communication alone does not meet the requirement.
Reporting rule for other deficiencies: Other deficiency of sufficient importance → management (oral or written) → timely; If you report orally, document when and to whom in the audit file.
Content of the written report: Description of deficiencies + potential effects + (recommendation) + explanation of purpose of audit and limits of the report; The report must describe the deficiencies and explain their potential effects. It must explain that the audit was to express an opinion on the financial statements, that internal control was considered only to design audit procedures and not to opine on its effectiveness, and that only identified deficiencies of sufficient importance are reported. ISA 265 permits, but does not require, a statement restricting use to TCWG, management and others within the organisation.

How to solve Reporting Deficiencies to Those Charged with Governance questions

Use this method for any question that gives you control weaknesses and asks what you report and how.

1Read the scenario and list each control weakness you find. Look for missing, badly designed or badly operated controls.
2For each one, decide if it is a deficiency. Ask: could a misstatement get through without being prevented, or detected and corrected?
3Decide which are significant. Consider how likely misstatement is, how large it could be, and whether it involves fraud or key areas like cash or revenue.
4Identify the audience: significant deficiencies go to TCWG in writing. Others go to management.
5For each deficiency, state the potential effect on the business or the financial statements.
6Write a practical recommendation that fixes the cause, not just the symptom.
7Add the standard points: timely, in writing, audit not designed to find all weaknesses, and, if you wish, that the letter is for internal use only.

Quickest way: Weakness, effect, recommendation

When to use it: Use this for constructed-response questions asking for a management letter or for deficiencies and recommendations. It also helps with OT cases.

Draw three columns in your head or on the answer: deficiency, potential effect, recommendation.
For each weakness, write one short line in each column. Do not write long essays.
Check that every recommendation is specific and could be done by the client.
Finish with one line on who receives the letter and when. State that significant deficiencies go to TCWG in writing, promptly.

Common mistakes in Reporting Deficiencies to Those Charged with Governance

Saying significant deficiencies can be reported orally to TCWG.
Students mix up the rule for management with the rule for TCWG.
Fix: Remember: significant deficiencies to TCWG must be in writing. Other deficiencies to management may be oral or written.
Listing the deficiency without the potential effect.
Students rush to the recommendation, or think the problem is obvious.
Fix: Always write what could go wrong, such as fraud, error or misstated figures, before the recommendation.
Giving vague recommendations like 'improve controls'.
It is quick to write and sounds sensible.
Fix: Name the control: for example, a second person should approve supplier bank detail changes.
Recommending only a detective fix when the weakness needs a preventive control, or ignoring the root cause.
Students describe what happened instead of why it was possible.
Fix: Ask what allowed the problem to happen and fix that point.
Claiming the report lists all control weaknesses in the company.
Students think the auditor tests all controls.
Fix: State that only deficiencies noted during the audit are reported, and the audit was not designed to find all weaknesses.
Sending the letter to the wrong party or communicating it late.
Students forget who TCWG are and the timing requirement.
Fix: Address it to the board or audit committee, and communicate on a timely basis so management can take action.

Worked examples

Example 1

During the audit of Karan Ltd you find that the same employee raises purchase orders, receives goods and approves supplier invoices for payment. Explain how you would communicate this and what you would say.

Show the solution

Identify the deficiency: there is no segregation of duties over the purchasing cycle. One person controls the whole process.
Assess significance: this creates a risk of fraud and error, such as fictitious suppliers or inflated payments. It is likely to be a significant deficiency.
Decide the audience: a significant deficiency must be communicated in writing to those charged with governance, in a timely way. Management should also be informed.
State the potential effect: payments could be made for goods not received or ordered, and purchases and payables could be misstated.
Recommend: split the duties so that different people order, receive and approve invoices. Add a review of orders against goods received notes by an independent person.
Add the standard points: the letter states that the audit was to express an opinion on the financial statements, and so only reports the weaknesses noticed. It may state that it is for internal use only.

Answer: Report in writing, promptly, to the board or audit committee (TCWG), and to management. Describe the lack of segregation of duties, explain the fraud and error risk, and recommend that ordering, receiving and invoice approval are done by different people.

Example 2

You audit Meera Foods Ltd. You find (a) the finance director has not authorised a few small expense claims, with immaterial amounts, and (b) the bank reconciliation has not been prepared for four months. Decide how to report each.

Show the solution

Assess (a): small unauthorised claims are a minor deficiency. The amounts are immaterial, and the risk is low. It is likely not significant.
Report (a) to management. It could be done orally, but you must record this in your audit file.
Assess (b): no bank reconciliation for four months is a serious failure. Errors or fraud over cash could go undetected. This is likely a significant deficiency.
Report (b) in writing, promptly, to those charged with governance. Explain the effect: unrecorded or misstated cash and undetected fraud.
Recommend: prepare reconciliations monthly, and have an independent senior person review and sign them.

Answer: Report (a) to management, which can be oral if documented. Report (b) in writing and on a timely basis to TCWG, with the effect on cash and a recommendation for monthly reviewed reconciliations.

Exam tips

Whenever a question asks for a report on weaknesses, use three headings: deficiency, potential effect, recommendation. Examiners mark each part.
Learn the split: significant deficiencies go to TCWG in writing; other deficiencies go to management. OT questions often test this.
Make recommendations practical and specific. 'Introduce a second authoriser' scores; 'improve controls' does not.
In small companies, TCWG and management may be the same people. If the scenario says all TCWG are also involved in managing the entity, you need not communicate separately to management, but you must still communicate significant deficiencies in writing.

Reporting Deficiencies to Those Charged with Governance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Reporting Deficiencies to Those Charged with Governance: frequently asked questions

Who are those charged with governance in ACCA AA?

They are the people responsible for overseeing the entity's strategic direction and accountability. Usually this means the board of directors, the audit committee or the non-executive directors. In a small owner-managed company, they may also be the managers.

Does ISA 265 require written communication for every deficiency?

No. Significant deficiencies must be communicated in writing to those charged with governance. Other deficiencies that deserve management's attention are reported to management, which may be done orally if you document it.

What should a management letter contain?

It should describe each deficiency and its potential effect, usually with a recommendation. It should also state that the audit was done to give an opinion on the financial statements and so does not identify all weaknesses. It may also say it is for use only within the organisation, but ISA 265 does not require this.

When must the auditor communicate deficiencies?

On a timely basis. This means soon enough for the client to act, not only at the end of the audit. The exact timing depends on how serious the deficiency is.