Advanced Audit and Assurance (International) · Completion and final review

Completion Review and Communication with Those Charged with Governance

Updated 11 October 2026 · Fact-checked

Completion review is the final quality check before the auditor's report is signed. It covers file completion, partner review and, where required, an engagement quality review. You then communicate to those charged with governance under ISA 260 (scope, findings, independence) and ISA 265 (significant control deficiencies), in writing where required.

Understand Completion Review and Communication with Those Charged with Governance

At the end of an audit, the firm must be sure the evidence supports the opinion before it signs. The engagement partner reviews the work, the key judgements and the draft report. An engagement quality reviewer who is independent of the team also reviews significant judgements and the report. This is needed for audits of listed entities, for engagements where law or regulation requires it, and for other engagements the firm determines need one because of its assessed quality risks. The firm's quality management system (ISQM 1 and ISQM 2) sets this out. The engagement partner must not date the report until the review is complete.

Audit file completion means the documentation is finished and organised. ISA 230 expects the file to let an experienced auditor with no prior link to the audit understand the work done, the evidence obtained and the conclusions reached. ISA 230 requires the final file to be assembled on a timely basis after the report date. It does not set a number of days. Many firms and local rules use 60 days as a benchmark, but that is not an ISA requirement. After assembly, you must not delete or discard audit documentation of any nature before the end of its retention period. ISQM 1 sets that period, and it is no shorter than five years from the date of the auditor's report (or the group auditor's report, if later).

The auditor must also talk to the people who oversee the entity. Those charged with governance (TCWG) are the people with responsibility for overseeing strategic direction and accountability, often the board or audit committee. ISA 260 (Revised) requires you to communicate your responsibilities, the planned scope and timing, and significant findings from the audit. It also requires you to communicate a statement on independence for listed entities. Communication must be timely, and you document it.

ISA 265 deals with control deficiencies. A deficiency exists when a control is missing or does not work as designed. A significant deficiency is one that, in your professional judgement, is important enough to merit TCWG's attention. You must communicate significant deficiencies in writing to TCWG on a timely basis. You also communicate other deficiencies to management at an appropriate level if they have not already been communicated and you judge them to merit management's attention.

In the exam, the skill is to apply this to the scenario. You are expected to name the issue, say who it goes to, when and in what form, and why it matters to the opinion. Keep an eye on professional scepticism: unresolved issues, weak management responses or pressure from management to delay all affect the report.

Key rules to remember

ISA 260 matters to communicate: Responsibilities + planned scope and timing + significant findings + independence (listed entities); Significant findings include views on accounting practices, difficulties during the audit, uncorrected misstatements, and matters affecting the report.
ISA 265 significant deficiency: Significant deficiency = a deficiency, or combination, important enough to merit TCWG's attention (auditor's judgement); Must be communicated in writing to TCWG on a timely basis. Judgement is not based on a fixed money threshold.
ISA 265 written communication content: Description of deficiency + its potential effects + enough information to understand the context + recommendation (where useful); Also state that the audit was not designed to identify all deficiencies, so others may exist.
Rules on form of communication (ISA 260): Significant findings: written only where oral communication is not adequate; independence for listed entities: ISA 260 requires it to be communicated but does not set its form, so a written statement is good practice; Oral communication must still be documented. Include clear timing so TCWG can act before sign-off.
Engagement quality review timing: EQR completed before the report is dated; ISQM 2 requires the reviewer to evaluate significant judgements and the conclusions reached. Under ISQM 2 and ISA 220 (Revised), the engagement partner must not date the auditor's report until the EQR is complete.

How to solve Completion Review and Communication with Those Charged with Governance questions

Use this method for any question on completion review or communication with governance.

1Read the requirement and note whether it asks for review procedures, matters to communicate, or deficiencies. Underline the verbs (explain, evaluate, recommend).
2Identify who the audience is: engagement partner, EQ reviewer, management or TCWG. Say who is responsible for what.
3List the issues in the scenario and tag each one: significant finding, control deficiency, independence matter, or a matter affecting the report.
4For each issue, state the standard's rule (ISA 260, ISA 265 or ISQM 2) briefly, then apply it to the facts using numbers and names from the scenario.
5State the form and timing: written or oral, before the report is signed, and to whom.
6Explain the effect on the audit: further procedures, a modified opinion, or a changed risk assessment. Say what you would do next.
7Close with a short recommendation or conclusion. Use a professional tone to earn skills marks.

Quickest way: Issue, Rule, Audience, Action

When to use it: Use this when time is short and you need a structured answer for a scenario with several issues.

Write one line per issue from the scenario.
Next to each, label it: ISA 260 finding, ISA 265 deficiency, or review matter.
Add who receives it: TCWG or management.
Add the form: written or oral.
Add the action: more work, adjust, modify, or report.
Check that every mark-bearing point has the issue, the rule and the application.

Common mistakes in Completion Review and Communication with Those Charged with Governance

Treating all control deficiencies as needing a letter to TCWG.
Students remember that deficiencies must be reported and ignore the word significant.
Fix: Separate significant deficiencies (written to TCWG) from other deficiencies (to management). Show your judgement using size, likelihood and effect.
Saying communication goes only to management.
Students mix up the management letter with the ISA 260 report.
Fix: Say that significant findings and independence go to TCWG, while less important points go to management. Name the audit committee where one exists.
Listing the ISA 260 headings without applying them.
Memorised lists feel safe.
Fix: Tie each heading to a scenario fact, for example an aggressive estimate, an uncorrected misstatement or a delay in getting information.
Forgetting that the engagement quality review must finish before the report date.
Students think of review as an after-the-event check.
Fix: State that the report is not dated until the reviewer has completed the review and any issues are resolved.
Confusing the file completion timing with the report date.
Both dates appear in the same part of the syllabus.
Fix: The report is dated when evidence is sufficient. ISA 230 requires the file to be assembled on a timely basis after that date. Many firms use 60 days as a benchmark, but that is not an ISA requirement. No documentation is deleted or discarded after assembly before the end of the retention period, which ISQM 1 sets at no shorter than five years from the report date.
Ignoring independence communication for listed entities.
Students focus on findings and forget the ethics element.
Fix: For listed entities, state that the firm and network firms comply with independence requirements, and describe relationships and safeguards that may bear on independence.

Worked examples

Example 1

During the audit of Zenith Ltd, a listed company, you find that the inventory count controls were not followed at two warehouses, and you had to perform extra procedures. Management also used an optimistic estimate for a warranty provision. The audit committee will meet next week. Explain what you would communicate and how.

Show the solution

Identify the issues: the count control failure is a control deficiency (ISA 265). The warranty estimate is a significant finding on accounting practice (ISA 260).
Judge the count issue: it affected two sites and needed extra procedures, so it likely merits TCWG's attention and is a significant deficiency.
Communicate the deficiency in writing to the audit committee, describing the problem, its potential effect on inventory and a recommendation such as supervised counts.
Communicate the estimate to the audit committee as a significant finding, including your view that management's assumption is optimistic and its effect on profit.
Because Zenith is listed, ISA 260 requires you to communicate your independence position. ISA 260 does not set the form, but a written statement is good practice, covering any non-audit services and safeguards.
Do this before signing the report so TCWG can respond. Document the communications, including oral discussions at the meeting.

Answer: Report the count control failure in writing to the audit committee as a significant deficiency under ISA 265, and communicate the optimistic warranty estimate as a significant finding under ISA 260. Because Zenith is listed, also communicate your independence position, ideally as a written statement (good practice rather than a stated ISA 260 requirement). All of this should happen before the report is signed.

Example 2

You are the engagement partner on the audit of Arrow Co. The audit is nearly complete. A senior suggests dating the report now and finishing the engagement quality review and file tidying later. Evaluate this suggestion.

Show the solution

State the rule: where an engagement quality review is required, the report must not be dated until the review is complete.
Explain why: the reviewer evaluates significant judgements and the draft report, and may raise matters that change the opinion or the evidence needed.
Apply: dating the report early would mean you sign without independent challenge and might need to reissue it, which creates risk and reputation damage.
Treat file assembly differently: it happens after the report date and is completed within the period set by firm policy and local rules, with no deletion afterwards.
Conclude: reject the suggestion on the report date, but accept that file tidying can follow the report.

Answer: Reject the suggestion. The report must wait until the engagement quality review is complete and its issues are cleared. Final file assembly can follow the report date, within the firm's required period.

Exam tips

Always say who receives the communication and in what form. Many marks are lost on this alone.
Tie each ISA 260 or ISA 265 point to a scenario fact. A generic list scores poorly.
Use professional skills: be concise, give a clear recommendation and write in a tone suited to a board or audit committee.
Show scepticism when management resists or delays. Link it to the opinion and to the timing of the report.
If the scenario involves a listed entity, check for independence communication and an engagement quality review.

Practice questions from Completion and final review

Completion Review and Communication with Those Charged with Governance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Completion Review and Communication with Those Charged with Governance: frequently asked questions

What is the difference between ISA 260 and ISA 265?

ISA 260 covers the auditor's general communication with those charged with governance, including scope, timing and significant findings. ISA 265 covers one specific part: communicating control deficiencies. A significant deficiency would appear under both, but ISA 265 sets the detailed rules.

Must control deficiencies always be in writing?

Significant deficiencies must be communicated in writing to TCWG on a timely basis. Other deficiencies go to management at an appropriate level, and these may be oral if the auditor judges that suitable, though the communication should be documented.

Who are those charged with governance?

They are the people or organisation with responsibility for overseeing the strategic direction of the entity and its accountability. This is usually the board and its audit committee. If management and TCWG overlap, you may need to consider whether communicating with management alone is enough.

When is an engagement quality review needed?

It is needed for audits of listed entities, for engagements where law or regulation requires it, and for engagements the firm determines need one because of its assessed quality risks. ISQM 1 sets these requirements and ISQM 2 sets how the reviewer performs the review. The engagement partner must not date the report until the review is complete.