Advanced Audit and Assurance (International) · Reports to those charged with governance and management

Communicating Deficiencies in Internal Control (ISA 265)

Updated 11 October 2026 · Fact-checked

ISA 265 requires the auditor to decide whether identified control weaknesses are deficiencies, and whether any are significant deficiencies. Significant deficiencies must be communicated in writing to those charged with governance on a timely basis. Other deficiencies go to management, with a written or oral message at the right level.

Understand Communicating Deficiencies in Internal Control (ISA 265)

Internal control is the system management sets up to prevent and detect errors and fraud. During the audit you test and assess it. You will often find weaknesses. ISA 265 tells you what to do with them.

A deficiency in internal control exists when a control is designed, implemented or operated so that it cannot prevent, or detect and correct, misstatements on a timely basis. It also exists when a needed control is missing.

A significant deficiency is one, or a combination, that in your professional judgement is important enough to merit the attention of those charged with governance (TCWG). You do not need a formula. You judge by the likelihood of misstatement, the possible size, and the nature of the area. Fraud risk, weak control environment, and missing controls over key balances all push a deficiency towards significant.

The auditor is not required to design procedures to find deficiencies. You report only those you identify while performing the audit. Your audit is not a full review of controls, so say that in your letter.

In the exam, a good letter does more than list problems. For each point it gives the deficiency, the potential effect, and a practical recommendation. It also states that the matters are limited to those noted during the audit. Professional skills marks reward a clear, tactful, well-organised letter written to the right audience.

Key rules to remember

Deficiency: Control cannot prevent, or detect and correct, misstatements on a timely basis, or a necessary control is missing; Applies to design, implementation or operation. Communicate to management at an appropriate level unless inappropriate in the circumstances.
Significant deficiency: Deficiency (or combination) important enough, in your judgement, to merit TCWG attention; It is a judgement. Do not assume it depends on whether an error has actually occurred.
Written communication of significant deficiencies: Significant deficiencies → written, to TCWG, on a timely basis; Also tell management in writing about significant deficiencies (unless inappropriate) and about other deficiencies that merit management's attention.
Content of the written report: Description + potential effects + context for the communication (limited scope) + enough explanation for TCWG to understand; Include that the audit was not designed to identify all deficiencies and that the report is for TCWG and management use only.

How to solve Communicating Deficiencies in Internal Control (ISA 265) questions

Use this method for any scenario asking you to identify and report control weaknesses.

1Read the requirement. Note who the letter is for and whether you must identify, evaluate, or draft.
2Scan the scenario for each control weakness. Look for missing controls, controls not operating, and one person holding incompatible duties.
3For each one, state the deficiency clearly in one sentence.
4Evaluate whether it is significant. Consider likelihood of misstatement, possible magnitude, the account affected, fraud risk, and whether other controls compensate.
5State the potential effect on the financial statements or the business, such as error, fraud or loss of assets.
6Give a practical recommendation that management could implement.
7Decide the recipient: significant deficiencies in writing to TCWG and management; other deficiencies to management.
8Add the required wording on limited scope, and keep a professional, constructive tone.

Quickest way: Deficiency, effect, recommendation table in your head

When to use it: When time is short and the scenario lists several control weaknesses.

Underline each weakness in the scenario as you read.
Write three short headings per point: Deficiency, Implication, Recommendation.
Mark the most serious ones as significant and give a one-line reason.
Close with the limited scope sentence and the recipient.

Common mistakes in Communicating Deficiencies in Internal Control (ISA 265)

Treating every deficiency as significant and sending everything to TCWG.
Students feel safer reporting all points at the top level.
Fix: Judge each point. Only significant deficiencies must go in writing to TCWG; others go to management.
Listing the weakness without the effect or a recommendation.
Students stop once they spot the problem.
Fix: Always add what could go wrong and a practical fix.
Claiming the auditor has tested or reported on all controls.
Mixing up the audit with a controls review.
Fix: State that only deficiencies identified during the audit are reported and that the audit was not designed to find all of them.
Vague recommendations such as 'improve controls'.
Lack of time or practice.
Fix: Name the control: for example, independent review of bank reconciliations monthly by a senior finance person.
Confusing ISA 265 with ISA 260 and sending the letter only to management.
Both standards deal with communication.
Fix: Remember ISA 265 requires significant deficiencies in writing to TCWG, while ISA 260 covers wider matters such as the audit approach and findings.
Using an aggressive or accusatory tone.
Focus on technical content only.
Fix: Write constructively and factually. Professional skills marks reward communication.

Worked examples

Example 1

During the audit of Delta Co, you find that the same employee raises purchase orders, records supplier invoices and releases payments. No one reviews supplier payment runs. Evaluate the deficiency and explain how you would report it.

Show the solution

Deficiency: incompatible duties are not segregated in the purchases cycle, and there is no independent review of payments.
Is it significant? Yes. One person can both initiate and conceal fraudulent or erroneous payments. Payments are a key area and the risk of misappropriation is high. No compensating control exists.
Potential effect: fictitious suppliers or duplicate payments could go undetected, causing loss of cash and misstated expenses and payables.
Recommendation: split ordering, invoice recording and payment release between different people, and have a director or senior manager review and approve each payment run.
Reporting: communicate in writing to TCWG on a timely basis, and also to management. Include the scope wording that only deficiencies noted during the audit are covered.

Answer: The lack of segregation of duties and payment review is a significant deficiency. Report it in writing to TCWG and management with its effect (undetected fraud or error in payments) and the recommended segregation and independent approval.

Example 2

Your audit team notes that the monthly bank reconciliation at Omega Co was completed late in three of twelve months, but each was reviewed and no errors resulted. Explain whether this is a significant deficiency and how you would communicate it.

Show the solution

Deficiency: the control is operating inconsistently because reconciliations are sometimes late.
Assess significance: the reconciliations were reviewed and no errors resulted, so the likelihood and size of misstatement are low. Other controls such as review reduce the risk.
Conclusion: it is likely a deficiency but not a significant one, though you must use judgement.
Recommendation: set a deadline for completing reconciliations, such as within five working days of month end, and monitor compliance.
Reporting: communicate to management at an appropriate level, in writing or orally. Written reporting to TCWG is not required for this point.

Answer: This is a deficiency but probably not a significant deficiency. Report it to management with the recommendation of a fixed completion deadline, rather than reporting it as a significant matter to TCWG.

Exam tips

Always give three parts for each point: deficiency, effect, recommendation. Marks are usually split across them.
Link each weakness to a financial statement risk, such as overstatement of assets or unrecorded liabilities.
Use the scenario's facts. Generic points earn little.
When asked to draft, include recipient, clear headings, a professional tone and the limited scope sentence to collect professional skills marks.
Where requirement asks whether a point is significant, give a reasoned judgement, not just a yes or no.

Practice questions from Reports to those charged with governance and management

Communicating Deficiencies in Internal Control (ISA 265) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Communicating Deficiencies in Internal Control (ISA 265): frequently asked questions

What is the difference between a deficiency and a significant deficiency in internal control?

A deficiency is any weakness where a control cannot prevent, or detect and correct, misstatements on a timely basis, or where a needed control is missing. A significant deficiency is one that in your judgement merits the attention of those charged with governance. The difference is a matter of importance, judged by factors such as likelihood and magnitude of misstatement.

Who must the auditor report significant deficiencies to?

Significant deficiencies must be communicated in writing to those charged with governance on a timely basis. They are also communicated to management, unless that would be inappropriate. Other deficiencies that merit management's attention go to management.

Does the auditor have to look for all control deficiencies?

No. The audit is not designed to find every deficiency. You report those you identify while doing the audit, and your letter should say so.

How do I write a management letter in the AAA exam?

Address it to the right person and use clear headings. For each point give the deficiency, its potential effect and a practical recommendation. Add a note on the limited scope of the audit and keep the tone constructive.