Audit and Assurance · The use and evaluation of systems of internal control by auditors

Evaluating Deficiencies and Reporting to Management in ACCA Audit and Assurance

Updated 11 October 2026 · Fact-checked

A control deficiency exists when a control is missing, badly designed or not working, so a misstatement may not be prevented or detected. You identify it, explain its consequence, recommend a fix and report it to management, and report significant deficiencies in writing to those charged with governance (ISA 265).

Understand Evaluating Deficiencies and Reporting to Management

A deficiency in internal control exists when a control is designed, implemented or operated so that it cannot prevent, or detect and correct, misstatements on time. It also exists when a control that is needed is missing.

A significant deficiency is one that, in the auditor's professional judgement, is important enough to deserve the attention of those charged with governance. Judgement is needed. Look at the likelihood of misstatement, the possible size, the risk of fraud, and whether other controls compensate.

Auditors find deficiencies while understanding the system, during tests of controls and during substantive work. Under ISA 265, the auditor must decide whether deficiencies found, alone or together, are significant. The auditor then communicates significant deficiencies in writing, on a timely basis, to those charged with governance. Other deficiencies are reported to management, unless it would be inappropriate to do so.

In the exam you are usually asked for a table or report with set columns: deficiency, consequence, recommendation. The deficiency is what is wrong. The consequence is the risk to the business or financial statements. The recommendation is a practical control that fixes that specific weakness.

The written communication should say that the audit was not designed to find all deficiencies, so the points are only those noted during the audit. It should describe the deficiencies and explain their potential effects. Management's responses are usually invited.

Key rules to remember

Three-column test for each point: Deficiency → Consequence → Recommendation; Each row must link: the recommendation fixes the stated deficiency, and the consequence follows from it.
Significant deficiency (ISA 265): Significant deficiency = important enough, in the auditor's judgement, to merit the attention of those charged with governance; Consider likelihood, potential size of misstatement, fraud risk and compensating controls.
Who is told: Significant deficiencies: in writing to those charged with governance. Other deficiencies: to management.; Communicate on a timely basis. Management are also told of significant ones.
Content of written report: Description + potential effects + statement that the audit was not designed to find all deficiencies; Management responses can be included.

How to solve Evaluating Deficiencies and Reporting to Management questions

Use this method for any question asking you to identify deficiencies and report on them.

1Read the scenario and underline each described procedure. Ask for each: who does it, who checks it, what could go wrong?
2Spot the deficiency: a missing check, no segregation of duties, no authorisation, no reconciliation, no restriction on access, or a control not followed.
3State the deficiency as a fact from the scenario, not as a general weakness.
4Write the consequence: say what error, fraud, loss or misstatement could result and which account or business area is affected.
5Write a recommendation that fixes that deficiency directly. Say who does what and how often.
6Keep one row per point and match the number of rows to the marks available.
7If asked about significance, judge likelihood, size of the possible misstatement and fraud risk, then say who must be told and how.

Quickest way: Fact, risk, fix in one line each

When to use it: Use when time is short in a Section C answer or a table question with many marks.

Scan the scenario once and mark each weakness with a number.
For each, write a short fact from the scenario in column one.
Start the consequence with 'There is a risk that...' and name the loss or misstatement.
Start the recommendation with a verb, such as 'Require', 'Introduce' or 'Reconcile', and include who and how often.
Check that you have not used generic text such as 'improve controls'.

Common mistakes in Evaluating Deficiencies and Reporting to Management

Writing a recommendation that does not match the deficiency.
Students write general good practice instead of fixing the stated weakness.
Fix: Reread the deficiency and write the specific control that would have stopped it.
Giving the consequence as 'fraud or error may occur' with no detail.
It feels safe and takes little time.
Fix: State what could be misstated or lost, for example overstated receivables or payment of fictitious wages.
Listing a deficiency that is not in the scenario.
Students recall a textbook list and apply it without checking.
Fix: Only use facts given. Every row should point to a sentence in the question.
Confusing the consequence with the recommendation.
Both columns are written quickly and blur together.
Fix: Consequence is what goes wrong. Recommendation is what management should do.
Saying the auditor must fix the control or that the auditor is responsible for the system.
Students mix the auditor's role with management's role.
Fix: Management designs and maintains internal control. The auditor reports weaknesses and recommends.
Reporting significant deficiencies only orally.
Students forget the ISA 265 requirement.
Fix: Significant deficiencies must be communicated in writing to those charged with governance.

Worked examples

Example 1

Gamma Ltd's purchasing clerk raises purchase orders and also approves supplier invoices for payment. No one reviews the clerk's work. Identify the deficiency, its consequence and a recommendation.

Show the solution

Deficiency: one person both orders goods and approves payment, and nothing is reviewed. This is a lack of segregation of duties.
Consequence: there is a risk that the clerk raises orders for personal goods or fictitious suppliers and approves payment, causing fraud and overstated purchases or payables.
Recommendation: separate the ordering and invoice approval duties between different staff, and have a manager review and authorise payments above a set limit.

Answer: Deficiency: no segregation between ordering and invoice approval. Consequence: risk of fraud or unauthorised purchases and misstated purchases. Recommendation: split the duties and add manager authorisation of payments.

Example 2

During the audit of Delta Co, you find that bank reconciliations have not been prepared for four months, and the finance director is the only person with access to the payroll master file. Explain which is more likely to be a significant deficiency and how you would report it.

Show the solution

Assess the bank reconciliation point: no reconciliation for four months means errors and fraud in cash may go undetected, and cash is a high-risk asset. This is likely significant.
Assess payroll access: only one person can change the master file, and the finance director is senior. This is a risk of unauthorised changes, but it could be a lesser point if other review controls exist. Consider compensating controls before deciding.
Conclude that the missing reconciliations are the stronger candidate for significance because the control is not operating at all and the consequences could be material.
Reporting: communicate significant deficiencies in writing to those charged with governance on a timely basis, describing each one and its potential effects. Tell management of the other deficiencies.
Recommend that reconciliations be prepared monthly by someone independent of cash handling and reviewed by a senior person.

Answer: The unperformed bank reconciliations are the more likely significant deficiency. Report it in writing to those charged with governance, with its potential effects, and report the payroll access point to management with a recommendation.

Exam tips

Use a three-column table with the exact headings the question gives. Mark allocation usually rewards each complete row.
Tie every point to a fact in the scenario. Generic points earn little.
Make recommendations practical and specific, naming who does what and how often.
If the question asks about significance or reporting, state that significant deficiencies go in writing to those charged with governance.
In objective test questions, check whether the question asks for the deficiency, the consequence or the recommendation, as options often mix them.

Evaluating Deficiencies and Reporting to Management: frequently asked questions

What is the difference between a deficiency and a significant deficiency?

A deficiency is any weakness in the design, implementation or operation of a control, or a missing control. A significant deficiency is one the auditor judges important enough to deserve the attention of those charged with governance.

Who does the auditor report control deficiencies to?

Significant deficiencies are communicated in writing to those charged with governance, on a timely basis. Other deficiencies are reported to management unless that would be inappropriate.

How do I write a control deficiency table in ACCA AA?

Use three columns: deficiency, consequence and recommendation. Each row takes one weakness from the scenario, says what could go wrong, and gives a specific fix.

Does the auditor have to find all control deficiencies?

No. The audit is not designed to find all deficiencies. The report should say that it covers only those noted during the audit.