
Paper P7: Advanced audit and assurance (International)
334 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
Communicating deficiencies in internal control: ISA 265
Introduction and requirements of ISA 265
The management letter
7 Communicating deficiencies in internal control: ISA
265
7.1 Introduction and requirements of ISA 265
ISA 315, covered largely in an earlier chapter, requires the auditor to communicate
material weaknesses in internal control identified during the audit to
management. This requirement is embodied in ISA 265 Communicating deficiencies in
internal control to those charged with governance and management.
A deficiency is defined by ISA 265 as where:
a control is designed, implemented or operated in such a way that it is unable to
prevent, or detect and correct, misstatements in the financial statements on a
timely basis, or
a control necessary to prevent, or detect and correct, misstatements in the
financial statements on a timely basis is missing.
A significant deficiency is one which merits the attention of those charged with
governance.
ISA 265 requires the auditor to:
Communicate significant deficiencies identified during the audit to those
charged with governance in writing on a timely basis.
Communicate any other deficiencies to an appropriate level of management
The communication of significant deficiencies must be in writing and is required to
cover:
A description of the deficiencies and an explanation of their potential effects.
Sufficient information to allow those charged with governance and management
to understand the context of the communication, including an explanation that:
- the purpose of the audit was to express an opinion on the financial
statements
- whilst the audit did include consideration of internal controls in order to
design appropriate audit procedures, this was not done for the purpose of
expressing an opinion on the effectiveness of internal control, and
- the matters being reported are limited to those deficiencies identified
during the audit and considered of sufficient importance to be reported.
The above should make it clear that the report covers only those weaknesses that
have been discovered as a result of the audit work that has been undertaken. It is a