Advanced Audit and Assurance (International) · Auditor's reports

Communication with Those Charged with Governance (ISA 260 and ISA 265)

Updated 11 October 2026 · Fact-checked

Communication with those charged with governance (TCWG) is the auditor's duty to tell the people overseeing the entity about audit scope, timing, findings, independence and internal control deficiencies. ISA 260 covers general communication. ISA 265 covers control deficiencies. In the exam, state the matter, why it matters, and the recommended action.

Understand Communication with Those Charged with Governance

Those charged with governance (TCWG) are the people with responsibility for overseeing the entity's strategic direction and accountability. This is usually the board, or the audit committee or non-executive directors. Management runs the entity day to day. TCWG oversee management. The auditor reports to both, but some matters must go to TCWG specifically.

The purpose of ISA 260 is two-way communication. The auditor explains their responsibilities, the planned scope and timing of the audit, and significant findings. TCWG give the auditor information that helps the audit, such as their views on risks, fraud concerns or changes in the business. Good communication also helps TCWG do their oversight job and supports the quality of the financial statements.

Under ISA 260 the auditor communicates three broad groups of matters. First, their responsibilities and the planned scope and timing, including significant risks. Second, significant findings from the audit, such as views on accounting practices, significant difficulties, uncorrected misstatements, and matters that affect the report. Third, for listed entities, a statement that the engagement team and the firm comply with relevant ethical requirements on independence, together with relationships that may reasonably bear on independence and the safeguards applied. ISA 260 requires this for listed entities. It does not stop the auditor communicating these matters for other entities too. The standard says to communicate. Firms usually do this in writing.

Separately, ISA 260 requires written communication of significant findings only where oral communication would not be adequate. Do not apply that test to the independence statement.

ISA 265 deals with deficiencies in internal control found during the audit. A deficiency exists when a control is designed, implemented or operated so that it cannot prevent, or detect and correct, misstatements on a timely basis, or when a control necessary to do so is missing. A significant deficiency is one important enough, in the auditor's judgement, to deserve the attention of TCWG. The auditor must communicate significant deficiencies in writing on a timely basis to TCWG. Other deficiencies are communicated to management on a timely basis if the auditor judges them of sufficient importance to merit management's attention and they have not already been communicated by other parties.

A management letter is the usual written vehicle for control points, addressed to management. A report to TCWG is the formal document for ISA 260 matters and significant deficiencies. In practice firms often combine them, but the audience and purpose differ. Communication must be timely, clear and documented. The auditor should not suggest that all deficiencies have been found, because the audit is not designed to identify every one.

Key rules to remember

Who to communicate with: TCWG = those overseeing strategy and accountability; management = those running operations; If all TCWG are involved in managing the entity and the matters have already been communicated to them in that management capacity, they need not be communicated again, provided the TCWG are adequately informed.
ISA 260 matters: Responsibilities + planned scope and timing + significant findings + independence (listed entities); Use this as a checklist for any question asking what to communicate.
Significant findings: Accounting practices + difficulties + uncorrected misstatements + matters affecting the report + other relevant matters; Include qualitative views on policies, estimates and disclosures, not only numbers.
ISA 265 significant deficiencies: Significant deficiencies → written to TCWG, on a timely basis; Include a description of the deficiency and an explanation of its potential effects.
Other deficiencies: Other deficiencies → management on a timely basis, if of sufficient importance to merit its attention and not already communicated by other parties; Do not repeat points already communicated by others. Communicate only those you judge of sufficient importance to merit management's attention.
Management letter point layout: Deficiency → implication → recommendation; This three-part layout earns most marks in exam answers.

How to solve Communication with Those Charged with Governance questions

Use this method for any question on communicating with TCWG, a management letter or a report on control deficiencies.

1Read the requirement. Decide whether it asks what to communicate, how to communicate, or to draft the points.
2Identify the audience: TCWG, management, or both. Check who the TCWG are in the scenario.
3Pick out the facts in the scenario: risks, misstatements, control failures, disagreements, independence issues.
4Classify each fact. Is it an ISA 260 matter, an ISA 265 deficiency, or both? Decide if a deficiency is significant.
5For each point write the matter, the implication for the entity or the audit, and a specific recommendation.
6State the form and timing: written or oral, and before the audit report is signed where relevant.
7Add professional skills: clear structure, tactful tone and commercial reasoning. Do not blame individuals.
8Check the answer covers every scenario fact and does not just list the standard.

Quickest way: Matter, implication, recommendation

When to use it: Use this when time is short and the question asks you to draft or list communication points.

Underline each control or audit issue in the scenario.
Write one line per issue: what is wrong.
Add what could go wrong as a result.
Add one practical fix management can action.
Mark which items go to TCWG as significant and which go to management.
Close with one line on timing and written form.

Common mistakes in Communication with Those Charged with Governance

Treating TCWG and management as the same group.
Both appear in the scenario and the terms feel similar.
Fix: State who the TCWG are in the entity. Note that some matters, such as independence, go to TCWG even though management is also informed.
Listing control weaknesses without implications or recommendations.
Students copy the scenario facts and stop.
Fix: Always use deficiency, implication, recommendation. Marks sit in the implication and the fix.
Saying the auditor must report all deficiencies to TCWG.
Students mix up ISA 265 levels.
Fix: Only significant deficiencies must go to TCWG in writing. Other deficiencies of sufficient importance go to management.
Suggesting the auditor must find every control weakness.
Students confuse an audit with a controls review.
Fix: State that the auditor reports only deficiencies identified while auditing, and that the letter does not list all deficiencies that exist.
Ignoring independence communication for listed entities.
Students focus on findings and forget ISA 260 independence points.
Fix: Add a line on relationships, non-audit services, fees and safeguards when the entity is listed.
Communicating only at the end of the audit.
Students think of the report as the only output.
Fix: Explain that planning matters go to TCWG early and significant findings must be timely, before the opinion is finalised.

Worked examples

Example 1

Torres Ltd's audit team found during the year-end audit that purchase orders above $500,000 can be approved by one buyer with no second approval, and bank reconciliations were not prepared for two months. The finance director is on the board and the audit committee oversees the audit. Explain how you would communicate these matters and draft the points. (8 marks)

Show the solution

Audience: the audit committee are TCWG. The finance director is management and a board member, so the audit committee needs to receive the significant points directly.
Classify: both are control deficiencies under ISA 265. Now decide whether each is significant by applying the ISA 265 factors: the likelihood of a misstatement, its potential magnitude, susceptibility of the related balance to fraud, and any compensating controls. Purchasing: orders above $500,000 are large, a single buyer can act alone, and purchases and payables are open to fraud or unauthorised spending. No compensating control is given, though you would check for one, such as budget review. Treat it as significant. Bank reconciliations: cash is highly susceptible to fraud, two months is a long gap, and errors could build up undetected. Unless a compensating control such as daily bank monitoring is found, treat it as significant. State that this conclusion depends on checking for compensating controls and comparing the amounts with materiality, which the scenario does not give.
Point one: no second approval above $500,000. Implication: a single buyer could place unauthorised or fictitious orders and misstate purchases and payables. Recommendation: require dual approval above a threshold and review reports of large orders monthly.
Point two: bank reconciliations were not prepared for two months. Implication: errors and fraud in cash could go unnoticed and the financial statements may be misstated. Recommendation: prepare reconciliations monthly, have a senior person review and sign them, and clear old items promptly.
Form and timing: communicate the significant deficiencies in writing to the audit committee on a timely basis, with a description and potential effects. Discuss with management first to confirm facts. Record the communication in the audit file.
Professional skills: keep the tone constructive, avoid naming individuals, and note that the letter covers only deficiencies found during the audit.

Answer: Send a written report to the audit committee on both deficiencies, which you judge significant after applying the ISA 265 factors (likelihood, magnitude, fraud susceptibility and compensating controls). Lay out each as deficiency, implication and recommendation, after checking facts with management. Record it on file and send it on a timely basis. State that it does not list all possible weaknesses.

Example 2

Kestrel plc is a listed company. During the audit you identified an uncorrected misstatement of $120,000 that management declined to adjust, a difficult estimate for warranty provisions where management's method is aggressive but within an acceptable range, and your firm provided tax advice to Kestrel during the year. Explain what you must communicate to those charged with governance. (6 marks)

Show the solution

Identify the framework: ISA 260 significant findings and, because Kestrel is listed, the independence communication.
Uncorrected misstatement: communicate the item to TCWG, request that it is corrected, and explain its effect on the financial statements if left unadjusted. If management declines, you must evaluate the effect yourself. The scenario gives no materiality level, so you cannot conclude that $120,000 is immaterial. Compare it with materiality, and add it to any other uncorrected misstatements, considering qualitative factors too. If it is material, or the aggregate is material, consider a modified opinion. Also obtain a written representation that the effects of uncorrected misstatements are immaterial, individually and in aggregate. The representation does not replace your own evaluation.
Warranty estimate: communicate your view on the quality of accounting practices. Explain the method is at the optimistic end of an acceptable range, and the risk of bias and the effect on profit. Encourage a more prudent basis or enhanced disclosure of estimation uncertainty.
Independence: the tax advice is a non-audit service. Communicate the service, related fees, the threats identified such as self-review or advocacy, and the safeguards applied. Include a statement that the firm and engagement team comply with relevant ethical requirements on independence, together with relationships that may reasonably bear on independence and the safeguards applied.
Timing and form: communicate before the audit report is signed. In practice the independence statement is made in writing. Significant findings must be in writing only if oral communication would not be adequate. Discuss the points with the audit committee.

Answer: Communicate the uncorrected misstatement and request correction, then assess it against materiality, alone and with other misstatements, and consider a modified opinion if it is material. Communicate your view on the aggressive warranty estimate and the independence position on the tax advice, including threats, safeguards and the compliance statement. Do this in good time before signing the audit report, with the independence statement in writing.

Exam tips

Always state who the TCWG are in the scenario before you answer. It shows scenario application.
Use deficiency, implication, recommendation for every control point. Do not just list weaknesses.
Separate what goes to TCWG from what goes to management, and say why.
For listed entities, add the independence communication. It is a common missed mark.
Keep a tactful tone in drafted letters. Professional skills marks reward clear structure and constructive wording.

Practice questions from Auditor's reports

Communication with Those Charged with Governance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Communication with Those Charged with Governance: frequently asked questions

What is the difference between a management letter and a report to those charged with governance?

A management letter is addressed to management and usually covers control points and recommendations. A report to TCWG covers ISA 260 matters such as scope, significant findings and independence, plus significant deficiencies. Firms often combine content, but the audience and purpose differ.

What is a significant deficiency under ISA 265?

It is a deficiency, or combination of deficiencies, that in the auditor's judgement is important enough to merit the attention of TCWG. The auditor decides this using professional judgement, considering likelihood and magnitude of possible misstatement. Significant deficiencies must be communicated in writing to TCWG on a timely basis. Other deficiencies go to management if the auditor judges them of sufficient importance and they have not already been communicated by others.

Must communication with TCWG be in writing?

Not always. ISA 260 requires written communication of significant findings only where oral communication would not be adequate. For listed entities, the auditor communicates a statement on compliance with independence requirements, and in practice this is made in writing. Do not attach the 'only where oral is inadequate' test to that statement. Significant deficiencies under ISA 265 must always be in writing. Record any oral communication on the audit file.

How do I score well on a TCWG communication question in AAA?

Apply the standard to the scenario. For each issue give the matter, its implication and a clear recommendation. Name the audience, state the timing and form, and write in a professional tone.