Audit and Assurance · Communication on internal control

Management Responses and Follow-up Actions on Control Deficiencies

Updated 11 October 2026 · Fact-checked

After the auditor reports control deficiencies, management may accept and fix them, accept them in part, or reject them. The auditor records the response, follows up at the next audit, and adjusts the audit approach. If controls stay weak, the auditor does more substantive testing and may report further.

Understand Responses from Management and Follow-up Actions

The auditor finds control deficiencies while understanding and testing the entity's systems. The auditor reports significant deficiencies in writing to those charged with governance, and usually sends a management letter to management too. That is only the start. What matters next is how management reacts.

Management has three broad choices. It can accept the point and promise a fix, with a named owner and a date. It can accept in part, for example by fixing a cheaper version of the control. Or it can reject the point, often because it thinks the cost outweighs the benefit. A rejection is allowed. Management is responsible for internal control, not the auditor. But the auditor should record the response and the reason.

The auditor then follows up. At the next audit, the auditor checks whether promised changes were made and whether they work. Do not assume a fix works because management says so. You test it, as you would any other control. Where a deficiency was not fixed, the auditor reconsiders the risk of material misstatement.

This changes the audit approach. If the control is still weak, you cannot rely on it. You do fewer or no tests of control in that area and do more substantive procedures, often with larger samples or year-end testing. If the fix is new, you may test it only for the period it operated. Earlier periods still carry the old weakness.

Keep fraud separate from deficiencies. A deficiency is a weakness in design or operation of a control. A fraud is an intentional act. Finding a deficiency does not mean fraud occurred. If you suspect or find fraud, you communicate on a different basis, to the right level of management or those charged with governance, and consider any legal or ethical duty to report externally. Management's response may also affect your view of its integrity and attitude to control.

Key rules to remember

Follow-up chain: Deficiency found → report to management / those charged with governance → management response → follow-up at next audit → adjust audit approach; Use this order for any written answer. Each link can earn a mark.
Effect of an unremedied deficiency: Control not reliable → no reliance → more substantive procedures; Reduced control risk assessment is only justified where controls are effective.
Management response options: Accept and fix | Accept in part | Reject (with reasons); The auditor records the response. Rejection by management does not remove the auditor's duty to report.
Deficiency vs fraud: Deficiency = control weakness; fraud = intentional act; A deficiency may allow fraud, but is not itself fraud. Fraud is communicated and judged on a separate basis.

How to solve Responses from Management and Follow-up Actions questions

Use this method for any question about management's reaction to reported deficiencies or the auditor's next steps.

1Identify the deficiency in the scenario and say what could go wrong, such as error or fraud, and which assertion is affected.
2State the management response: accepted, partly accepted or rejected. Note any promised date or owner.
3Assess whether the response is adequate. Ask if it addresses the root cause, is timely, and is realistic.
4Describe the follow-up: what the auditor will test at this or the next audit, such as inspecting the new control and testing it operating.
5Explain the effect on audit approach: reliance on controls or not, and the change in nature, timing and extent of substantive procedures.
6Consider reporting: repeat the point in the next management letter if unfixed, and escalate to those charged with governance if significant.
7Link to wider issues if the scenario hints at them, such as management integrity, fraud risk or an engagement risk reassessment.
8Finish with a clear recommendation or conclusion that answers the exact requirement.

Quickest way: Response, follow-up, approach in three lines

When to use it: Use this for short Section A or Section B objective questions, or to plan a Section C answer in two minutes.

Ask: did management fix it? If yes, the auditor must test the fix. If no, assume no reliance.
If no reliance, the answer is almost always more substantive testing.
If the item is significant and unresolved, the auditor reports it again in writing to those charged with governance.
Check the word fraud. If it appears, switch to the fraud communication logic rather than the deficiency logic.

Common mistakes in Responses from Management and Follow-up Actions

Saying the auditor must force management to fix the deficiency.
Students mix up the auditor's role with management's role.
Fix: Say management is responsible for internal control. The auditor reports, records the response and adjusts the audit work.
Accepting management's promise as evidence the control now works.
A promised fix sounds like a solved problem.
Fix: State that the auditor inspects the change and tests it operating before relying on it.
Treating every deficiency as fraud or as a reportable matter outside the entity.
The words are used loosely in everyday talk.
Fix: Separate the two. A deficiency goes to management and those charged with governance. Fraud has its own communication route and possible external reporting duties.
Giving only a general answer such as 'do more testing'.
Students skip the link to nature, timing and extent.
Fix: Say what changes: more substantive tests, larger samples, testing nearer year end, or more senior staff.
Forgetting to record the management response in the answer.
Students stop at the report and ignore what comes after.
Fix: Always include the response, its adequacy and the follow-up plan. Those are the extra marks.

Worked examples

Example 1

During the audit of Kiran Ltd, you reported that the same employee raises purchase orders and approves supplier invoices for payment. Management replied that it will not change this because the finance team is small and extra staff are costly. Explain the implications for the audit.

Show the solution

Identify the deficiency: lack of segregation of duties in purchases. Risk: fictitious or inflated purchases, fraud and error. Assertions affected include occurrence and accuracy.
Management has rejected the recommendation, giving cost as the reason. This is its right, but you record the response and reasons in your working papers.
Because the control is not effective, you cannot rely on it. You will not plan tests of control in this area.
Increase substantive procedures: for example, test more purchase invoices to orders and goods received, review supplier statements, and perform a search for unrecorded liabilities.
Consider asking management for compensating controls, such as owner review of payments over a set limit. If introduced, test them.
Report the matter again in writing to those charged with governance as it is a significant deficiency, noting that it remains unresolved and the risk it brings.

Answer: The auditor records the rejection, treats purchases controls as unreliable, performs more substantive work on purchases and payables, considers compensating controls, and reports the unresolved significant deficiency to those charged with governance.

Example 2

Last year you reported that Mehra Co had no regular bank reconciliations. Management accepted and said reconciliations would start from month 4 of the new year. Explain what you do at this year's audit.

Show the solution

Review last year's management letter and the management response so you know the promise made.
Ask management for the reconciliations and inspect them. Check they were prepared monthly from month 4, were reviewed and signed, and that reconciling items were cleared.
Test the control operating: select a sample of months after month 4 and re-perform the reconciliation.
For months 1 to 3, the control did not operate. Do not rely on it for that period. Do additional substantive work on cash, such as testing the year-end bank confirmation and the unreconciled items for that period.
If the control works for the later months, you may rely on it for that period and reduce substantive testing there.
If it was not done, or was done poorly, report the deficiency again as unresolved and assess the impact on the risk of misstatement in cash.

Answer: Check that reconciliations were introduced from month 4, test them operating, rely on them only for the period they worked, perform extra substantive work for months 1 to 3, and report again if the fix failed.

Exam tips

Always include all three elements when asked about follow-up: the management response, the auditor's test of the fix, and the effect on the audit approach.
In scenario questions, quote the management response and judge whether it is adequate. Do not just repeat the deficiency.
Keep fraud and deficiency answers apart. Use the words 'those charged with governance' for significant matters and 'management' for routine ones.
Under all-or-nothing marking in objective questions, read for the word 'not' or 'only'. A correct idea in the wrong order scores zero.

Responses from Management and Follow-up Actions: frequently asked questions

What if management ignores the auditor's report on control deficiencies?

The auditor records the response and cannot force a fix. You treat the control as unreliable, increase substantive testing, and report the unresolved point again, particularly if it is significant. A pattern of ignoring controls may also raise concerns about management's attitude to control.

What does the auditor do after reporting weaknesses in internal control?

The auditor follows up at the next audit by checking whether changes were made and whether they operate effectively. The auditor then decides whether to rely on the controls. The results shape the nature, timing and extent of substantive procedures.

What is the difference between a control deficiency and fraud reporting?

A deficiency is a weakness in how a control is designed or works. Fraud is an intentional act to gain an unfair or illegal benefit. Deficiencies are reported to management and those charged with governance. Suspected or actual fraud is communicated on its own basis and may involve legal or ethical duties to report externally.

Does a fixed deficiency mean the auditor can rely on the control?

Not automatically. The auditor must test that the new or improved control is designed properly and operates. Reliance covers only the period the control worked.