Advanced Auditing, Assurance and Professional Ethics · Materiality, Risk Assessment and Internal Control

Communicating Deficiencies in Internal Control (SA 265)

Updated 5 October 2026 · Fact-checked

SA 265 tells you what to do when your audit shows internal control is weak. You decide if each identified deficiency exists, decide if it is significant, then communicate significant ones in writing to those charged with governance on time, and tell management about other deficiencies that merit its attention. Document everything and state the limits of your work.

Understand Communicating Deficiencies in Internal Control (SA 265)

An auditor studies internal control to assess risks of misstatement. In doing so, you often find that a control is missing, badly designed or not working. SA 265 deals with what you do next. It does not ask you to search for deficiencies. It deals only with those you have identified during the audit.

A deficiency in internal control exists when a control is designed, implemented or operated so that it cannot prevent, or detect and correct, misstatements on time. It also exists when a control needed for that purpose is missing.

A significant deficiency is one that, in your professional judgment, is important enough to deserve the attention of those charged with governance (TCWG). Note the test: it is about importance and attention, not about a fixed amount. Factors include the likelihood that it leads to a material misstatement, the susceptibility of the related asset or liability to loss or fraud, the subjectivity and complexity of the amounts involved, the volume of activity exposed, the importance of the control to the process, and whether other controls compensate for it.

Your duties follow a clear order. First, decide whether you have identified one or more deficiencies. Second, decide whether, individually or in combination, they are significant. Third, communicate significant deficiencies in writing to TCWG on a timely basis, ordinarily before the audit report is issued. Fourth, communicate to management on a timely basis, at an appropriate level of responsibility: (a) significant deficiencies, in writing or orally, unless it is inappropriate to do so; and (b) other deficiencies that merit management's attention and have not been communicated to management by others, in writing or orally.

The absence of deficiencies does not prove controls are effective. Your work was only for the audit, so the letter must say that your communication is limited to deficiencies noted and that the audit was not designed to identify all weaknesses. The letter is meant for use by TCWG and management, not for third parties.

Key rules to remember

Deficiency: Control cannot prevent, or detect and correct, misstatements on a timely basis, or a needed control is missing; Covers design, implementation and operation failures, and absent controls.
Significant deficiency: Deficiency, or combination of deficiencies, important enough in the auditor's judgment to merit TCWG attention; Judgment-based. Combinations of deficiencies can together be significant.
Written communication to TCWG: Significant deficiencies: in writing, on a timely basis, ordinarily before the audit report is issued; Oral communication alone is not enough for significant deficiencies.
Communication to management: (a) Significant deficiencies: in writing or orally, at an appropriate level, unless it is inappropriate to do so. (b) Other deficiencies that merit management's attention and have not been communicated to management by others: in writing or orally, at an appropriate level.; If a communication to management is oral, document it in the working papers. The 'not communicated by others' condition applies only to the other deficiencies in (b), not to significant deficiencies.
Content of the written communication: Description + explanation of potential effects + information for corrective action + limitation statements; Explain the potential effects in suitable terms; they need not be quantified. Say the audit purpose was to express an opinion on the financial statements, not on internal control, and that only deficiencies identified are reported. State that the communication is solely for use by TCWG (and management, or others in the organisation) and is not to be used by third parties.
Management response: Management's written responses may be included in the communication; Do not let management's response replace your own communication. If the responses were not subjected to audit procedures, you may add a comment saying so.

How to solve Communicating Deficiencies in Internal Control (SA 265) questions

Use this order for any SA 265 question, whether it asks for a definition, a classification or a draft communication.

1Read the facts and list each control failure: poor design, not implemented, not operating, or missing.
2Confirm it is a deficiency by asking whether it stops timely prevention, or detection and correction, of misstatements.
3Assess significance using the factors: likelihood, susceptibility to loss or fraud, subjectivity, volume of activity, importance of the control, and compensating controls. Consider deficiencies together if they affect the same account or assertion.
4Conclude clearly: deficiency only, or significant deficiency.
5Decide the recipient and form: significant deficiencies in writing to TCWG, timely and ordinarily before the audit report is issued, and also to management at an appropriate level, in writing or orally, unless inappropriate to do so; other deficiencies that merit management's attention and have not been communicated by others go to management, in writing or orally.
6State the content of the communication: description, potential effects, suggestions, the limitation wording, and that it is for use by TCWG and management only.
7Mention documentation: keep the communication, or record oral communication, in working papers, and link to the effect on audit procedures and risk assessment.

Quickest way: Three-question filter

When to use it: Use when time is short in a case-scenario MCQ or a short note.

Is a control failing or missing so errors will not be caught on time? If no, there is no deficiency.
Would TCWG need to know, given likelihood, fraud or loss exposure and lack of compensating controls? If yes, it is significant.
Significant means written to TCWG, timely, ordinarily before the audit report. Otherwise tell management in writing or orally. Add the limitation statement.

Common mistakes in Communicating Deficiencies in Internal Control (SA 265)

Treating every deficiency as significant and sending all of them to TCWG in writing.
Students fear losing marks for under-reporting.
Fix: Apply judgment. Only significant deficiencies must go in writing to TCWG. Others that merit attention go to management.
Defining significant deficiency by a rupee threshold or a fixed percentage.
Confusion with materiality under SA 320.
Fix: The test is the auditor's judgment about whether it merits TCWG attention. Use the listed factors.
Saying the auditor must design procedures to find all deficiencies.
Mixing the audit objective with an internal control review.
Fix: SA 265 covers only deficiencies identified during the audit. The audit is not designed to express an opinion on internal control.
Communicating a significant deficiency only orally.
Students assume a meeting with the CFO is enough.
Fix: Significant deficiencies need written communication to TCWG. Oral communication is not a substitute.
Leaving out the limitation wording and the potential effects in a draft letter.
Focus is on listing the weaknesses only.
Fix: Always include the description, potential effects, suggestions for correction, the statements about the purpose and limits of the audit, and the restriction on use by third parties.
Ignoring compensating controls or ignoring combinations of deficiencies.
Each issue is judged in isolation.
Fix: Check whether other controls address the risk, and whether several deficiencies together are significant.

Worked examples

Example 1

During the audit of Orion Traders Ltd, you find that the same employee raises purchase orders, receives goods and approves supplier payments. Inventory is a large and easily saleable item, and no compensating review exists. Management says it will fix this next year. Classify the matter and state how you would communicate it.

Show the solution

Identify the failure: no segregation of duties over purchasing, receipt and payment. The control needed to prevent or detect misstatement and misappropriation is missing or poorly designed, so it is a deficiency.
Assess significance: inventory and payments are susceptible to loss or fraud, volume of activity is high, the control is important to the purchase process, and there is no compensating control. Together these make it significant.
Recipient and form: communicate in writing to TCWG on a timely basis, ordinarily before the audit report is issued. Also communicate it to management at an appropriate level, in writing or orally, unless it is inappropriate to do so. The fact that others may have told management does not remove your own duty for a significant deficiency.
Content: describe the deficiency, explain the potential effect (misappropriation and misstatement of inventory and payables), and suggest corrective action such as separating duties and independent review. Include the statement that the audit was not designed to express an opinion on internal control, that only identified deficiencies are reported, and that the letter is for use by TCWG and management only.
Management's intention to fix it later does not remove the duty to communicate. Document the communication, including any oral communication to management, and consider the effect on your audit procedures.

Answer: It is a significant deficiency. Communicate it in writing to TCWG on a timely basis, ordinarily before the audit report, and to management at an appropriate level in writing or orally, unless inappropriate. Include description, potential effects, corrective suggestions and the limitation statements.

Example 2

In an audit, you note that petty cash vouchers at one branch are occasionally not signed by the approver. Cash handled is very small, the branch manager reviews the cash book monthly, and there is no indication of loss. Decide how to treat it.

Show the solution

Identify: missing approver signatures show a control not operating as designed, so it is a deficiency.
Assess significance: amounts are small, susceptibility to loss is low, the monthly review by the branch manager compensates, and no loss has occurred. In your judgment, it does not merit TCWG attention.
Conclude: a deficiency, but not a significant one, unless combined with other issues in the same area.
Communication: tell management at an appropriate level, in writing or orally, if it merits management's attention and has not been communicated to management by others. If given orally, record it in the working papers.
Check whether other petty cash deficiencies exist across branches that, in combination, may change the conclusion.

Answer: It is a deficiency that is not significant. Communicate it to management, in writing or orally with documentation, if it merits their attention and others have not already told them. Re-evaluate if it combines with other deficiencies.

Exam tips

In case scenarios, always give the three-part answer: is it a deficiency, is it significant, and who gets what form of communication.
Name the significance factors and apply two or three to the facts instead of repeating the whole list.
Do not use a rupee threshold. If a question mentions materiality figures, use them only as one input to judgment.
In a draft-letter question, include the description, potential effects, suggested actions, the purpose-of-audit statement, the limitation statement and the restriction on use by third parties.
Link the topic to SA 315 and SA 330: deficiencies found may change your risk assessment and further audit procedures.

Practice questions from Materiality, Risk Assessment and Internal Control

Communicating Deficiencies in Internal Control (SA 265) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Communicating Deficiencies in Internal Control (SA 265): frequently asked questions

What is the difference between a deficiency and a significant deficiency under SA 265?

A deficiency is any control that fails to prevent, or detect and correct, misstatements on time, or a missing needed control. A significant deficiency is one that, in your judgment, is important enough to merit the attention of TCWG. Significant deficiencies must be communicated in writing to TCWG.

Must the auditor search for control deficiencies under SA 265?

No. SA 265 covers deficiencies you have identified while obtaining an understanding of internal control and performing the audit. The audit is not designed to express an opinion on internal control or to identify all deficiencies.

Can I communicate a significant deficiency orally?

Significant deficiencies must be communicated in writing to TCWG on a timely basis, ordinarily before the audit report is issued. You may discuss them orally as well, but that does not replace the written communication.

What should the written communication to TCWG contain?

It should describe the deficiencies and explain their potential effects. It should give enough information for corrective action and state that the audit was done to express an opinion on the financial statements, not on internal control. It should also say that only deficiencies identified are reported, and that the communication is for use by TCWG and management, not third parties. Management's written responses may be included, with a comment from you if they were not subjected to audit procedures.

Do I need to tell management about deficiencies that are not significant?

Yes, if they merit management's attention and have not been communicated to management by others. This can be in writing or oral, and oral communication should be documented.