Advanced Audit and Assurance (International) · Reports to those charged with governance and management

Management Letters and Reporting to Management in ACCA AAA

Updated 11 October 2026 · Fact-checked

A management letter is a written report from the auditor to management about deficiencies found during the audit. Each point should state the deficiency, its implication and a practical recommendation. In the exam, prioritise significant points, tie each to the scenario, and keep a professional, constructive tone.

Understand Management Letters and Reporting to Management

A management letter (also called a report to management) is how the auditor passes on what the audit found about weaknesses in internal control and other matters useful to the client. It adds value to the audit. It also protects the auditor, because it is a written record that the issues were raised.

Under ISA 265, the auditor must communicate significant deficiencies in internal control in writing to those charged with governance on a timely basis. Other deficiencies that matter to management are also communicated, orally or in writing. ISA 260 covers wider matters, such as audit scope, findings and independence. The report must say that the auditor only considered controls as far as needed to form the audit opinion. So it is not a full review of all controls and may not list every weakness.

A good point has three parts. The deficiency says what is wrong, using facts from the scenario. The implication says what could go wrong for the business, such as fraud, error, misstatement, loss or non-compliance. The recommendation says what management should do, in a way that is practical for that business. Examiners mark all three parts. Many students give only the first.

The usual layout is a heading with the date and addressee, an opening that explains the purpose and limits of the letter, then the points, often in a table with three columns. Many reports order points by importance, with significant ones first. A closing paragraph invites discussion and may ask for management's response.

Tone matters. The letter should be professional, constructive and clear. Do not blame individuals. Do not write that the controls are "useless". Explain the risk in business terms and offer realistic fixes, considering cost and the size of the entity. This is also where you earn professional skills marks: analysis, commercial awareness and clear communication.

Key rules to remember

Structure of each point: Deficiency + Implication + Recommendation; Use this for every point in the letter or table. Missing one part loses marks.
ISA 265 core requirement: Significant deficiencies → communicate in writing to those charged with governance, on a timely basis; Other deficiencies that merit management's attention are also communicated, orally or in writing.
Content of the written communication (ISA 265): Description of deficiencies + explanation of their potential effects + enough information for TCWG and management to understand the context; It should also state that the audit considered controls only to the extent needed to form an opinion, so not all deficiencies may be identified.
Prioritisation test: Rank by likelihood × potential impact on the financial statements and the business; This is a judgement guide, not a calculation. Put the most serious points first.

How to solve Management Letters and Reporting to Management questions

Use this method for any question that asks you to draft a management letter, or to identify and report control deficiencies from a scenario.

1Read the requirement. Note who the letter is addressed to, and whether it asks for deficiencies only or for implications and recommendations too.
2Go through the scenario and underline each control weakness. Look for missing authorisation, lack of segregation of duties, no reconciliations, poor access controls and unmonitored overrides.
3For each weakness, write one factual sentence that quotes the scenario. This is the deficiency.
4State the implication in business terms. Say what could go wrong, such as fraud, misstatement, loss of assets or breach of rules, and link it to the financial statements.
5Write a practical recommendation. It should say who does what, and it should suit the size and cost base of the entity.
6Order the points by importance. Put the most significant first, or group them under headings such as revenue, payroll and IT.
7Add a short opening and close. State the purpose and the limits of the letter, and keep the tone constructive. Check you have used a professional layout, such as a three-column table.

Quickest way: Three-column table method

When to use it: When time is short and the question asks for deficiencies, implications and recommendations for a list of scenario issues.

Draw three columns: Deficiency, Implication, Recommendation.
Spend one minute per point. Aim for one clear line in each column.
Make each implication specific to this client, not a generic statement about fraud.
Make each recommendation an action with an owner, for example the finance director reviews monthly.
Leave the strongest, most serious points at the top. Add a two-line opening and closing if marks are available for the format.

Common mistakes in Management Letters and Reporting to Management

Listing deficiencies without implications or recommendations.
Students spot the problem quickly and move on, treating identification as the whole task.
Fix: Use a three-column table and fill every cell before moving to the next point.
Writing generic implications such as 'this could lead to fraud'.
It is a quick phrase that fits any control weakness.
Fix: Name the specific fraud or error, for example 'a clerk could create a fictitious supplier and divert payments', and link it to the client's facts.
Recommendations that are impractical for the entity, such as hiring a new internal audit team for a small business.
Students recall textbook best practice and do not consider cost or size.
Fix: Suggest proportionate fixes, such as an owner review of exception reports, and note where cost is a constraint.
Treating every point as equally important and not prioritising.
Students write points in the order they appear in the scenario.
Fix: Rank points by likelihood and impact, and put significant deficiencies first. Say which ones are significant.
Using a harsh or accusatory tone, or naming individuals as the cause.
Students focus on the weakness and forget the reader is the client.
Fix: Describe the control gap, not the person. Use neutral wording and an offer to discuss the points.
Writing an essay on ISA 265 instead of drafting the letter requested.
Students recall theory and think it shows knowledge.
Fix: Answer the requirement. Use the standard only to support format, timing and addressee, then apply it to the scenario.

Worked examples

Example 1

During the audit of Kavya Retail, you find that one employee both raises purchase orders and approves supplier payments, and that bank reconciliations have not been prepared for three months. Draft the key points for a report to management.

Show the solution

Point 1 deficiency: the same employee raises purchase orders and approves supplier payments, so duties are not segregated.
Point 1 implication: that person could raise orders for goods not received or set up a fictitious supplier, and approve payment. This could lead to fraud and overstated expenses.
Point 1 recommendation: separate the two duties between different staff. If staffing is limited, have a director review and approve all payments above a set limit.
Point 2 deficiency: bank reconciliations have not been prepared for three months.
Point 2 implication: errors, unrecorded items and fraud may go undetected, and cash in the financial statements could be misstated.
Point 2 recommendation: prepare reconciliations monthly, have an independent person review them, and investigate unreconciled items promptly.
Prioritise: segregation of duties over payments is likely the more significant point because it directly allows fraud. Place it first and explain why.

Answer: Two points in a table: (1) segregation of duties over ordering and payment, with fraud implication and a separation or director-review recommendation; (2) missing bank reconciliations, with undetected error and fraud implication and a monthly independently reviewed reconciliation recommendation. Point 1 is ranked first.

Example 2

You are the audit senior on Meridian Logistics. The finance director has asked why you are sending a written report on internal control deficiencies to the audit committee. Explain the purpose and what the report should contain, and give one example point.

Show the solution

Purpose: ISA 265 requires the auditor to communicate significant deficiencies in writing to those charged with governance on a timely basis. This lets them oversee the fix and gives a record that the matter was raised.
Limits: the auditor considers controls only as far as needed to form the audit opinion, so the report does not list every deficiency. The letter should say this.
Content: a description of each deficiency, an explanation of its potential effects, and enough context for readers to understand it. Good practice adds a recommendation and invites management's response.
Example deficiency: sales staff can change customer credit limits in the system with no review.
Example implication: sales could be made to customers unlikely to pay, so receivables may be overstated and irrecoverable debts may increase.
Example recommendation: restrict credit limit changes to the credit control team, and have the finance manager review a monthly report of changes.

Answer: The report gives governance a timely written record of significant deficiencies, with their effects and recommendations, and states that it is not a full review of controls. Example: unreviewed credit-limit changes, risking overstated receivables, fixed by restricting access and reviewing a monthly change report.

Exam tips

Use a table or clear headings. Examiners reward a professional layout, and it helps your professional skills marks.
Always tie each point to a fact in the scenario. A point with no scenario link scores poorly.
Write implications in terms of financial statement risk and business risk, not only fraud.
If asked for a letter, include a brief opening on purpose and limits, and a close. Keep both short.
Check the addressee. Significant deficiencies go to those charged with governance, and management usually also receives the letter.

Practice questions from Reports to those charged with governance and management

Management Letters and Reporting to Management in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Management Letters and Reporting to Management: frequently asked questions

What is the format of a management letter in ACCA AAA?

There is no single mandatory format. Use a heading, date and addressee, a short opening on purpose and limits, then the points, usually in a three-column table of deficiency, implication and recommendation. End with a short close inviting discussion.

Who receives the report on internal control deficiencies?

Under ISA 265, significant deficiencies must be communicated in writing to those charged with governance. Other deficiencies that matter to management are communicated to management, orally or in writing. In practice, the same letter often goes to both.

Does the auditor have to report every control weakness?

No. The auditor considers controls only as far as needed to form the audit opinion. So the letter will not list every weakness, and it should say so. Significant deficiencies must be reported in writing.

How should I prioritise points in a management letter?

Rank them by how likely they are to cause a problem and how large the effect could be on the financial statements and business. Put the most serious points first and say why they are significant.