The evaluation may be made without quantifying an amount. Factors that may increase the possibility of misstatement include the nature of the item involved, the cause and frequency of noted exceptions, the susceptibility of the related item to loss or fraud, the extent of judgment required to determine the amount involved, the interaction with other deficiencies, possible future consequences, and the importance of the control to the financial reporting process. (AU-C 265.A8)
Magnitude of the misstatement. The magnitude of a misstatement also is a continuous spectrum with two key thresholds, “inconsequential” to “material,” as illustrated in the following diagram.
The combination of possibility and magnitude. The evaluation of control deficiencies requires the auditor to consider both the possibility and the magnitude of the misstatement. Combining the previous two diagrams illustrates this concept.
When a control deficiency exists, there is a chance that the internal control system will fail to either prevent or detect a misstatement. This diagram illustrates that if the possibility of the misstatement being included in the financial statements is greater than remote and the magnitude of the misstatement is greater than inconsequential, then the deficiency is at least a significant deficiency. If the magnitude of the potential misstatement is greater than material, then a material weakness exists.
Indicators of Material Weakness
The following are indicators of material weaknesses in internal controls:
● Fraud by senior management, even if immaterial
● Restatement of previously issued financial statements
● Correction of a material misstatement due to error or fraud
● Identification of a material misstatement that would not have been detected by the entity's internal controls
● Ineffective oversight of financial reporting and internal controls
(AU-C 265.A11)
Communication of Internal Control Related Matters
Significant deficiencies and material weaknesses must be communicated in writing to management and those charged with governance as a part of each audit. [AU-C 265.11-12(a)] In this context, senior management includes the principal extent and financial access and any other members of senior management who play a significant role on the entity's financial reporting process.
The auditor may communicate matters in writing or orally that he or she does not consider to be reportable conditions but which nonetheless may be of benefit to the entity. If the communication is oral, it should be documented. [AU-C 265.12(b)] The auditor is not required to communicate such matters if they have been communicated by the auditor in a prior period or by others, such as internal auditors. (AU-C 265.A26)
If significant deficiencies and material weaknesses were not remediated following previous audits, this communication should repeat the description or reference the prior communications. While management may have made a conscious decision to accept the risk of a control deficiency, the auditor must still communicate the issue regardless of management's decision. (AU-C 265.A20)
To avoid potential misunderstanding or misuse, the auditor should not issue a written communication that no significant deficiencies were identified during the audit. (AU-C 265.16)
Timing
Communication of internal control related matters should be made no later than 60 days following the report release date. (AU-C 265.13) For significant issues in need of immediate correction, the auditor may choose to communicate those issues during the audit and can do so other than in writing; however, even if remediated, these issues should still be included in a written communication at the end of the audit.
Content
The written communication should include the following items:
● Definitions of material weakness and significant deficiency
● Description of significant deficiencies and material weaknesses and their potential effects
● Information that enables those charged with governance and management to understand the context of the communications, particularly statements that:
● The auditor is expressing an opinion on the financial statements.
● The audit included consideration of internal control to design audit procedures, not for the purpose of expressing an opinion on internal control.
● The auditor is not expressing an opinion on the effectiveness of internal control.
● The auditor's consideration of internal control may not identify all significant deficiencies or material control weaknesses.
● An appropriate alert in accordance with AU-C 905, Alert That Restricts the Use of the Auditor's Written Communication
(AU-C 265.14)
The content of the communication can contain additional topics, such as recommendations for improvement in such areas as administrative or operational efficiency, as well as less than significant deficiencies or immaterial weaknesses. Any verbal communications should be documented. The auditor may also note the general inherent limitations of internal control, including the possibility of management override of those controls. It may also be acceptable to specifically describe the extent of the auditor's consideration of internal control.
The auditor may be asked to issue a communication indicating that no material weaknesses were identified, which then would be submitted to governmental authorities. The “AU-C 265 Illustrations” section contains a sample communication that may be used.
Management Response
Management may prepare a written response to the auditor's communication. Such responses typically describe corrective actions taken, plans to issue new controls, or management's belief that the cost of new controls exceeds their benefit. If this response is included in a document that also contains the auditor's controls communication, the auditor may include a disclaimer paragraph, such as:
ABC Company's written response to the significant deficiencies [and material weaknesses] identified in our audit was not subjected to the auditing procedures applied in the audit of the financial statements and, accordingly, we express no opinion on it.
(AU-C 265.A33)
Interpretations
Communication of Significant Deficiencies and Material Weaknesses Prior to the Completion of the Compliance Audit for Participants in Office of Management and Budget Single-Audit Pilot Project (Issued November 1994; Revised March 2010; January 2012, Effective for Audits of Financial Statements for Periods Ending on or after December 15, 2012)
Section 265 permits an auditor to communicate deficiencies and material weaknesses in writing to management before completing a financial statement audit, and this also applies to a compliance audit.
Communication of Significant Deficiencies and Material Weaknesses Prior to the Completion of the Compliance Audit for Auditors That Are Not Participants in Office of Management and Budget Pilot Project (Issued November 2009; Revised March 2010; January 2012, Effective for Audits of Financial