AU-C Section 265: Communicating Internal Control Related Matters Identified in an Audit

"Introduction

Scope of This Section

.01 This section addresses the auditor's responsibility to appropriately communicate to those charged with governance and management deficiencies in internal control that the auditor has identified in an audit of financial statements. This section does not impose additional responsibilities on the auditor regarding obtaining an understanding of internal control or designing and performing tests of controls over and above the requirements of section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, and section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained. Section 260, The Auditor's Communication With Those Charged With Governance, establishes further requirements and provides guidance regarding the auditor's responsibility to communicate with those charged with governance regarding the audit.

.02 The auditor is required to obtain an understanding of internal control relevant to the audit when identifying and assessing the risks of material misstatement. In making those risk assessments, the auditor considers internal control in order to design audit procedures that are appropriate in the circumstances but not for the purpose of expressing an opinion on the effectiveness of internal control. The auditor may identify deficiencies in internal control not only during this risk assessment process but also at any other stage of the audit. This section specifies which identified deficiencies the auditor is required to communicate to those charged with governance and management.

.03 Nothing in this section precludes the auditor from communicating to those charged with governance or management other internal control matters that the auditor has identified during the audit.

.04 This section is not applicable if the auditor is engaged to perform an audit of internal control over financial reporting that is integrated with an audit of financial statements. In such circumstances, section 940, An Audit of Internal Control Over Financial Reporting That Is Integrated With an Audit of Its Financial Statements, applies. [As amended, effective for audits for periods ending on or after December 15, 2016, by SAS No. 130. Revised, December 2016, to reflect conforming changes necessary to reflect the issuance of SAS No. 130.]

Effective Date

.05 This section is effective for audits of financial statements for periods ending on or after December 15, 2012.

Objective

.06 The objective of the auditor is to appropriately communicate to those charged with governance and management deficiencies in internal control that the auditor has identified during the audit and that, in the auditor's professional judgment, are of sufficient importance to merit their respective attentions."

".08 The auditor should determine whether, on the basis of the audit work performed, the auditor has identified one or more deficiencies in internal control. (Ref: par. .A1–.A4)"

".09 If the auditor has identified one or more deficiencies in internal control, the auditor should evaluate each deficiency to determine, on the basis of the audit work performed, whether, individually or in combination, they constitute significant deficiencies or material weaknesses.

.10 If the auditor initially determines that a deficiency, or a combination of deficiencies, in internal control is not a material weakness, the auditor should consider whether prudent officials, having knowledge of the same facts and circumstances, would likely reach the same conclusion. [As amended, effective for audits for periods ending on or after December 15, 2016, by SAS No. 130.]"

".11 The auditor should communicate in writing to those charged with governance on a timely basis significant deficiencies and material weaknesses identified during the audit, including those that were remediated during the audit. (Ref: par. .A15–.A20 and .A28)

.12 The auditor also should communicate to management at an appropriate level of responsibility, on a timely basis (Ref: par. .A21 and .A28)

a. in writing, significant deficiencies and material weaknesses that the auditor has communicated or intends to communicate to those charged with governance, unless it would be inappropriate to communicate directly to management in the circumstances. (Ref: par. .A16 and .A22–.A23)

b. in writing or orally, other deficiencies in internal control identified during the audit that have not been communicated to management by other parties and that, in the auditor's professional judgment, are of sufficient importance to merit management's attention.

If other deficiencies in internal control are communicated orally, the auditor should document the communication. (Ref: par. .A24–.A27)

.13 The communications referred to in paragraphs .11–.12 should be made no later than 60 days following the report release date. (Ref: par. .A16–.A17)

.14 The auditor should include in the auditor's written communication of significant deficiencies and material weaknesses (Ref: par. .A29–.A33)

a. the definition of the term material weakness and, when relevant, the definition of the term significant deficiency.

b. a description of the significant deficiencies and material weaknesses and an explanation of their potential effects. (Ref: par. .A29) c. sufficient information to enable those charged with governance and management to understand the context of the communication. In particular, the auditor should include in the communication the following elements that explain that (Ref: par. .A30–.A31)

i. the purpose of the audit was for the auditor to express an opinion on the financial statements.

ii. the audit included consideration of internal control over financial reporting in order to design audit procedures that are appropriate in the circumstances but not for the purpose of expressing an opinion on the effectiveness of internal control.

iii. the auditor is not expressing an opinion on the effectiveness of internal control.

iv. the auditor's consideration of internal control was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies, and therefore,material weaknesses or significant deficiencies may exist that were not identified.

d. an appropriate alert, in accordance with section 905, Alert That Restricts the Use of the Auditor's Written Communication. (Ref: par. .A32)

[As amended, effective for the auditor's written communications related to audits of financial statements for periods ending on or after December 15, 2012, by SAS No. 125.]

.15 When the auditor issues a written communication stating that no material weaknesses were identified during the audit, the communication should include the matters in paragraph .14a and c–d. (Ref: par. .A34–.A36)

.16 The auditor should not issue a written communication stating that no significant deficiencies were identified during the audit. (Ref: par. .A34)"