An auditor is required to communicate significant deficiencies in internal control to

Nội dung chính Show

You might also be interested in... What are the three types of control deficiencies?
How do you communicate with internal control deficiencies?
What is significant deficiency in internal controls?
How auditors identify significant deficiencies in internal control systems?
Do you need to disclose significant deficiencies?

For an issuer (public company), is required to communicate the deficiency to management and internal audit. If the deficiency is a significant deficiency or a material weakness, then the audit team must also communicate the deficiency to the audit committee in writing.

Back To All Questions

You might also be interested in... What are the three types of control deficiencies?

There are three levels of deficiencies that the auditor will report on in regard to the assessment of an organization’s internal controls. The three types include: Control deficiencies – A deficiency in internal control over financial reporting exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions,...

Project Status

Project Completed.

Objective

The objective of this project is to develop a clear definition of the threshold at which deficiencies in internal control that the auditor has identifed during the audit should be communicated to those charged with governance and management, and to provide enhanced guidance to assist the auditor in fulfilling the auditor's communication responsibilities.

The IAASB approved ISA 265,Communicating Deficiencies in Internal Control to Those Charged with Governance and Management in December 2008. The ISA is effective for audits of financial statements for periods beginning on or after December 15, 2009. A Basis for Conclusions will provide background to the project, main comments received on the exposure draft, and the IAASB's conclusions regarding these comments in developing the final standard.

Background

The definition of "material weakness" within the ISAs is rather general, and the original aim of the project was to provide more guidance on the meaning of the term to improve the consistency with which auditors treat identified weaknesses as material (with consequent reporting implications). The project proposal emphasized that the project would not seek to extend the auditor's responsibilities beyond those set out in ISAs. It would also avoid unnecessary complexity that might not be justified given that ISAs address audits of both listed and non-listed entities.

Task Force progress / Board discussions to date

At the April 2007 meeting, the IAASB discussed the following issues:

Whether the objectives and supporting requirements proposed for the ISA implied a level of work effort that was excessive, especially in the evaluation of the significance of identified deficiencies in internal control.
Whether the definition of "material weakness" should be limited to a consideration of potential material misstatements affecting the current year financial statements only.
Possible approaches to defining the term "material weakness," including whether the definition should be harmonized with that which the U.S. Public Company Accounting Oversight Board is currently developing as part of its proposed new internal control auditing standard.
The effect a definition of "material weakness" in the proposed ISA might have in the European Union (EU) context, given the possible adoption of ISAs in the EU and the fact that the EU's Statutory Audit Directive requires the auditor to communicate material weaknesses to the audit committee.

At the September 2007 meeting, the task force presented a first-read draft of the proposed ISA to the IAASB. Issues the IAASB discussed included:

Approach to defining the threshold at which deficiencies in internal control should be communicated.
The nature of the auditor's work effort in evaluating deficiencies in internal control identified based on the audit work performed.
To whom and to what extent to communicate deficiencies in internal control that have come to the auditor's attention.
The auditor's responsibility to evaluate the operating effectiveness of compensating controls.

At the December 2007 meeting, the IAASB considered a revised draft of the proposed ISA. Issues the IAASB discussed included:

The objective of the auditor and the definition of the term 'significant deficiency.'
The auditor's responsibilities regarding compensating controls.
The nature of the communication where the deficiencies involve management.
Whether deficiencies in internal control should be communicated in writing to management.

The IAASB unanimously approved the proposed ISA for exposure with a 120-day comment period ended April 30, 2008. The IAASB agreed that the proposed ISA should be placed in the communications series and be numbered 265.

At the September 2008 meeting, the IAASB considered the significant comments received on exposure and a revised draft of the proposed ISA, as well as significant comments received from the IAASB CAG and the IFAC SMP Committee. Issues the IAASB discussed included:

Whether the terms and definitions proposed in the exposure draft should be retained.
Whether the identification requirement should be retained in the proposed ISA or moved by to ISAs 315 (Redrafted) and 330 (Redrafted).
Whether there should be a further category of deficiencies, namely deficiencies that are not clearly inconsequential and that are not reportable.
How the ISA should address a legal or regulatory requirement to communicate material weaknesses in internal control to those charged with governance.

At the December 2008 meeting, the IAASB approved ISA 265,Communicating Deficiencies in Internal Control to Those Charged with Governance and Management. The ISA will be published after the Public Interest Oversight Board has confirmed that due process was followed in its development.

How do you communicate with internal control deficiencies?

The objective of the auditor is to communicate appropriately to those charged with governance and management deficiencies in internal control that the auditor has identified during the audit and that, in the auditor's professional judgment, are of sufficient importance to merit their respective attentions.

What is significant deficiency in internal controls?

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting.

How auditors identify significant deficiencies in internal control systems?

Internal control deficiencies are often identified after the fact — companies will detect a misstatement in the financial statement and discover the existence of a control deficiency. But failing to properly account for transactions is not the deficiency itself.