Audit and Assurance · Systems of internal control

Evaluating Controls: Deficiencies and Reporting in ACCA Audit and Assurance

Updated 11 October 2026 · Fact-checked

A control deficiency is a weakness in a system that lets errors or fraud happen or go undetected. In the exam, state the deficiency, explain its consequence, and give a specific recommendation. Then report significant deficiencies in writing to management or those charged with governance, in a management letter.

Understand Evaluating Controls: Deficiencies and Reporting

A deficiency exists when a control is missing, badly designed or not working. An example is a payroll clerk who both adds new employees and prepares the payment run. Nothing stops a fake employee being paid.

The auditor looks at controls to decide how much to rely on them. If controls are weak, the auditor cannot reduce substantive testing and may need to do more. So deficiencies affect both the audit approach and the client.

A significant deficiency is one important enough to deserve the attention of those charged with governance. ISA 265 requires the auditor to communicate these in writing on a timely basis, to those charged with governance and to management at an appropriate level. Other deficiencies go to the appropriate level of management, orally or in writing, if they have not already been communicated by others. Communicate them as a by-product of the audit. The auditor is not required to design a full review of controls.

The report is usually a management letter. Each point has a deficiency, a consequence (what could go wrong) and a recommendation (what to change). The letter should also say that it covers only deficiencies noted during the audit and is not a full list of all weaknesses.

In the exam you must be specific. Write about the facts in the scenario, not generic control theory. Examiners award marks for each of the three parts of a point.

Key rules to remember

Three-part point: Deficiency + Consequence + Recommendation; Each point in a management letter or exam answer should contain all three parts. Missing one loses marks.
Deficiency test: Control missing, badly designed, or not operating effectively; Use this to check that what you have identified is truly a deficiency and not just a feature of the business.
Reporting rule (ISA 265): Significant deficiencies: communicate in writing, on a timely basis, to those charged with governance and to management at an appropriate level; Other deficiencies go to the appropriate level of management, orally or in writing, if not already communicated by others.
Content of a written communication: Description + potential effects + sufficient explanation + purpose and limits of the audit; Include a statement that the audit was not designed to identify all deficiencies.

How to solve Evaluating Controls: Deficiencies and Reporting questions

Use the same routine for any scenario asking you to identify deficiencies, explain them and recommend improvements.

1Read the requirement. Note whether it asks for deficiencies only, or deficiencies with consequences and recommendations, and how many marks are available.
2Read the scenario once, underlining every place where one person does several tasks, where no check is mentioned, or where a step is informal.
3List each deficiency in one sentence using the facts given. Say what is missing, not just what happens.
4For each, write the consequence: the specific error, fraud, loss or misstatement that could result.
5For each, write a recommendation that is practical and directly fixes that deficiency, for example segregation, authorisation, reconciliation or a sequence check.
6Lay the answer out as a table-like list or clear separate points, one deficiency per point, using headings if asked for a letter.
7If asked for a report, add a short introduction, state its limits, and ask for management responses.

Quickest way: Spot, Harm, Fix

When to use it: Use when time is short in Section B and the requirement asks for deficiencies, consequences and recommendations in a set layout.

Scan for people doing two incompatible jobs, missing approvals, missing checks and missing records.
Write each point in three short lines: Deficiency, Consequence, Recommendation.
Keep each recommendation to one clear action tied to the facts.
Marks are awarded for each of the deficiency, the consequence and the recommendation. The number of points you need depends on the mark allocation, typically 1 mark per element identified or explained, so check the marks before you plan how many points to write.
Finish with a one-line note on reporting to management only if the requirement asks.

Common mistakes in Evaluating Controls: Deficiencies and Reporting

Stating the deficiency without a consequence
Students spot the weakness quickly and move on to the next one.
Fix: After every deficiency write 'This could lead to...' and name a specific error or fraud.
Giving a recommendation that does not fix the stated deficiency
Students use a standard list of controls instead of reading the problem.
Fix: Check that the recommendation removes the exact cause, such as splitting two duties or adding an independent approval.
Writing 'the company should have better controls'
Students run short of time and write vaguely.
Fix: Name the control: who does what, how often and what evidence is kept.
Confusing the auditor's response with the client's recommendation
Both topics sit in the same chapter.
Fix: Management letter points tell the client what to change. Changes to audit procedures belong in a separate answer on audit approach.
Listing a feature as a deficiency when the scenario shows a control exists
Students skim and assume the usual weakness.
Fix: Check the text for any review or approval before calling it missing.
Ignoring the reporting requirement
Students focus on the table of points.
Fix: If asked, state that significant deficiencies go in writing to those charged with governance and that the letter does not cover every weakness.

Worked examples

Example 1

Section B style, part of a longer constructed response question (6 marks of the question): Hale Co's purchasing clerk raises purchase orders, receives goods into the warehouse and enters supplier invoices into the system. Invoices are paid on the clerk's entry without any other check. Identify two deficiencies, explain the consequence of each and recommend an improvement.

Show the solution

Deficiency 1: one person orders, receives goods and records invoices. Duties are not segregated.
Consequence 1: the clerk could order goods for personal use or create a fictitious supplier and no one would notice, so fraud or error goes undetected.
Recommendation 1: separate the three duties among different staff, with a supervisor approving orders above a set value.
Deficiency 2: invoices are paid without being matched to a purchase order and goods received note.
Consequence 2: Hale Co could pay for goods not ordered or not received, or pay duplicate invoices, overstating expenses and payables.
Recommendation 2: require a three-way match of order, goods received note and invoice by an independent person before payment is authorised.

Answer: Deficiency: no segregation of duties over purchasing. Consequence: undetected fraud or error. Recommendation: split ordering, receiving and recording with approval of larger orders. Deficiency: no matching before payment. Consequence: payment for goods not received or duplicate payments. Recommendation: independent three-way match before authorising payment.

Example 2

Section B style, one part-requirement within a 20-mark constructed response question (6 marks of the question): After an interim audit of Brix Co, you must write a short management letter paragraph on one significant deficiency: staff at depots change employee bank details on request by email with no verification. Write the point, and state to whom the deficiency should be communicated.

Show the solution

State the deficiency: bank details are changed on an unverified email request.
State the consequence: an impostor or dishonest employee could redirect salary payments to another account, causing financial loss and a payroll misstatement.
Recommend: change bank details only on a signed form, confirm the change with the employee by a known contact route, and have a second person approve and review a report of all changes monthly.
Note the purpose and limits: the letter covers only deficiencies noted during the audit, which was not designed to find all weaknesses.
State the recipients: because this is a significant deficiency, it is communicated in writing, on a timely basis, to those charged with governance and to management at an appropriate level, with a request for management's response. Any other, less serious deficiencies are communicated to management at the appropriate level, orally or in writing.

Answer: Deficiency: bank detail changes are accepted by unverified email. Consequence: salaries could be diverted by fraud, causing loss and misstatement. Recommendation: signed forms, call-back verification, independent approval and a monthly review of changes. The letter should say it only covers deficiencies noted during the audit. The significant deficiency is communicated in writing to those charged with governance and to management at an appropriate level. Other deficiencies go to management.

Exam tips

Use the three-part layout in every answer. Examiners mark each part separately.
Tie every consequence and recommendation to the scenario facts, not to a generic list.
Do not give two recommendations for one deficiency if the marks reward separate points. Use the time for another deficiency.
If the requirement says 'management letter', add a brief introduction and the statement that the letter is not a full list of weaknesses.
Keep objective test cases in mind: they often ask which communication is required or which deficiency is significant.

Evaluating Controls: Deficiencies and Reporting in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Evaluating Controls: Deficiencies and Reporting: frequently asked questions

How do I write a control deficiency recommendation in ACCA AA?

State the deficiency, explain the consequence, then give one specific recommendation that removes the cause. Link it to the facts in the scenario. Keep each point short and separate.

What is the difference between a deficiency and a significant deficiency?

A deficiency is any weakness in the design or operation of a control. A significant deficiency is serious enough to need the attention of those charged with governance. The auditor uses judgement to decide which is which.

Must the auditor report every deficiency in writing?

No. Significant deficiencies must be communicated in writing, on a timely basis, to those charged with governance and to management at an appropriate level. Other deficiencies go to the appropriate level of management, orally or in writing, if they have not already been communicated by others.

What goes in a management letter?

It lists each deficiency with its consequence and a recommendation. It should also explain that the audit was not designed to find all weaknesses, and it usually invites management to respond.