Communication with Management and Those Charged with Governance
Effective communication between the auditor and the entity's management and those charged with governance is essential to a successful audit engagement. These communications ensure that all parties understand the planned scope and timing of the audit, share relevant information, and address findings that arise during the engagement—particularly those related to internal control deficiencies. Poor communication can lead to misunderstandings, delayed resolution of issues, and, ultimately, a less effective audit.
This section covers the communication of planned scope and timing, the preparation of presentation materials, the identification and reporting of internal control deficiencies (including significant deficiencies and material weaknesses), and the timing and form of required communications.
Communication requirements are established by AU-C 260 (Overall Objectives — Communication with Those Charged with Governance), AU-C 265 (Communicating Internal Control Related Matters), and PCAOB AS 1301 (Communications with Audit Committees). Both frameworks require timely, clear, and two-way communication between the auditor and those responsible for governance and management of the entity.
Communication of Planned Scope and Timing
At the outset of the audit, the auditor communicates with those charged with governance about the planned scope and timing of the engagement. This communication serves multiple purposes: it sets expectations, facilitates coordination, and provides an opportunity for governance to share information relevant to the audit.
Matters to Communicate
The auditor should communicate the following matters to those charged with governance:
| Matter | Description |
|---|---|
| Overall audit strategy | The general approach to the audit, including areas of focus and emphasis |
| Planned scope | The nature of procedures to be performed, including any planned use of specialists, internal auditors, or other auditors |
| Timing of the audit | The expected timeline for fieldwork, interim and year-end procedures, and report issuance |
| Significant risks identified | Key risks of material misstatement that the auditor has identified during planning |
| Materiality | The concept of materiality as it applies to the audit (though specific materiality amounts are generally not communicated) |
| Areas of higher risk | Accounts, transactions, or disclosures that require special audit attention |
| Use of specialists | Whether the auditor intends to involve specialists (e.g., valuators, actuaries, IT specialists) |
| Group audit considerations | If the entity is part of a group, the planned involvement of component auditors |
The auditor is not required to communicate specific materiality dollar amounts to those charged with governance. Communicating the general concept and how materiality affects the audit approach is sufficient. However, the auditor may choose to share specific amounts at their discretion.
Communication with Management
In addition to governance, the auditor also communicates with management about planning matters. Management communications typically include:
- Scheduling of fieldwork and interim testing
- Information requests — Prepared-by-client (PBC) lists detailing the documents and schedules the auditor will need
- Access requirements — Access to personnel, facilities, records, and IT systems
- Expected timeline for management review of draft financial statements and disclosures
- Coordination with internal audit, if applicable
Example: Before beginning the audit of Gies Co., the engagement partner meets with the audit committee to discuss the planned scope, including the intention to use a valuation specialist for testing goodwill impairment and the timing of inventory observations at three warehouse locations. Separately, the audit senior provides management with a PBC list and schedules interim fieldwork for October.
Preparation of Presentation Materials and Supporting Schedules
Auditors frequently prepare presentation materials for formal communications with those charged with governance—particularly audit committees. These materials typically include:
| Material | Content |
|---|---|
| Engagement letter summary | Overview of the engagement terms, responsibilities, and fees |
| Audit plan presentation | Visual summary of the audit approach, key risks, and timeline |
| Required communications packet | A structured document addressing all matters required by professional standards |
| Supporting schedules | Detailed schedules of adjustments, unadjusted differences, and other findings |
| Management letter | Written communication of recommendations for improvements (often issued separately) |
Example: Kingfisher Industries' audit committee requires a formal presentation at each quarterly meeting. The engagement team prepares a slide deck summarizing the status of the audit, significant findings to date, and any issues requiring the committee's attention. A supporting schedule lists all proposed audit adjustments, including their individual and aggregate impact on the financial statements.
The form of communication (oral vs. written) depends on the nature and significance of the matter. Significant matters should generally be communicated in writing to provide a clear record. Oral communications of significant matters should be documented in the audit workpapers.
Internal Control Related Matters
During the course of the audit, the auditor may identify deficiencies in the entity's internal control over financial reporting. Professional standards establish a hierarchy of deficiency severity and specific requirements for communicating these findings.
Understanding the Hierarchy: Deficiency, Significant Deficiency, and Material Weakness
| Classification | Definition | Severity |
|---|---|---|
| Deficiency in internal control | A deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect and correct misstatements on a timely basis | Lowest |
| Significant deficiency | A deficiency, or combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance | Middle |
| Material weakness | A deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented or detected and corrected on a timely basis | Highest |
The key distinction between a significant deficiency and a material weakness is the likelihood and magnitude of potential misstatement. A material weakness involves a reasonable possibility of a material misstatement going undetected. A significant deficiency is serious enough to warrant governance attention but does not rise to the level of a material weakness.
Evaluating Deficiencies
When the auditor identifies a control deficiency, they must evaluate its severity by considering:
- The magnitude of the potential misstatement — Could the deficiency result in a material misstatement?
- The likelihood of occurrence — Is there a reasonable possibility that the deficiency will lead to a misstatement?
- Whether compensating controls exist — Are there other controls that mitigate the risk posed by the deficiency?
- The nature of the financial statement accounts and assertions involved — Some accounts are inherently more susceptible to misstatement
Example: During the audit of Bear Co., the engagement team discovers that the accounts payable clerk can both enter invoices and approve payments without a secondary review. This lack of segregation of duties creates a deficiency in internal control. The auditor evaluates the magnitude of potential misstatements and the volume of transactions processed and determines that this represents a significant deficiency because compensating controls (monthly management review of disbursements) partially mitigate the risk—but not to a level below "important enough to merit governance attention."
Another Example — Material Weakness
Example: While auditing MAS Inc., the auditor discovers that the company has no controls over the financial statement close process. Journal entries are posted without review, account reconciliations are not performed, and the trial balance is not reviewed by a supervisor before the financial statements are prepared. The auditor concludes that this represents a material weakness because there is a reasonable possibility that a material misstatement could occur and not be detected or corrected on a timely basis.
Required Communications of Internal Control Deficiencies
Written Communication Requirement
Both AICPA and PCAOB standards require that significant deficiencies and material weaknesses identified during the audit be communicated to those charged with governance in writing.
| Communication | Recipient | Form | Standard |
|---|---|---|---|
| Material weaknesses | Those charged with governance | Written (required) | AU-C 265 / AS 1305 |
| Significant deficiencies | Those charged with governance | Written (required) | AU-C 265 / AS 1305 |
| Other deficiencies | Management | Oral or written (auditor's discretion) | AU-C 265 |
The written communication of significant deficiencies and material weaknesses must be made even if these matters were previously communicated orally. The oral communication does not substitute for the written requirement. The written communication provides a formal record and ensures governance has clear documentation of the findings.
Content of the Written Communication
The written communication to those charged with governance must include:
- Description of the deficiencies and an explanation of their potential effects
- The definition of the applicable terms (significant deficiency and/or material weakness) so the recipients understand the severity classification
- A statement that the communication is intended solely for those charged with governance and management (and, when applicable, other specified parties) and is not intended for anyone else
- A statement that the auditor's purpose was not to identify all deficiencies in internal control — the audit was designed to express an opinion on the financial statements, not to provide assurance on internal control (unless an integrated audit is being performed)
Example: Following the audit of Illini Entertainment, the engagement partner sends a written communication to the audit committee identifying two significant deficiencies: (1) inadequate review of complex revenue arrangements and (2) insufficient IT access controls over the general ledger. The letter includes definitions of the terms "significant deficiency" and "material weakness," describes the potential effects of each finding, and notes that the purpose of the audit was not to identify all internal control deficiencies.
Communication to Management
In addition to communicating with governance, the auditor should communicate to management:
- All significant deficiencies and material weaknesses identified (management should be aware of all matters communicated to governance)
- Other deficiencies in internal control that, in the auditor's professional judgment, are of sufficient importance to merit management's attention
Example: In addition to the written communication to Illini Entertainment's audit committee, the engagement partner discusses with management several other control deficiencies that were not severe enough to be classified as significant deficiencies, including inconsistent documentation of inventory count procedures and a lack of formal policies for approving vendor additions.
Timing of Communications
The timing of communications depends on the nature and urgency of the matter:
| Matter | Timing |
|---|---|
| Planned scope and timing | Before or at the beginning of the audit |
| Significant difficulties encountered | As soon as practicable during the audit |
| Significant deficiencies and material weaknesses | In writing, no later than 60 days after the report release date (AICPA); on a timely basis (PCAOB) |
| Disagreements with management | As they arise, or as part of the final communication |
| Other audit findings | At the conclusion of the audit, or during the audit if timely communication is important |
| Fraud or illegal acts | As soon as practicable — significant matters must be reported directly to those charged with governance |
The 60-day deadline for written communication of significant deficiencies and material weaknesses (AU-C 265) coincides with the documentation completion date for nonissuer engagements. This is a useful memory aid for the CPA exam.
Early Communication of Significant Matters
The auditor should not wait until the end of the audit to communicate matters that require immediate attention. If the auditor identifies a material weakness during interim fieldwork, it should be communicated to governance as soon as practicable — not deferred to the final communication.
Example: During October interim testing at BIF Partners, the audit team identifies a material weakness in the company's controls over cash disbursements—specifically, the absence of dual authorization for wire transfers over $50,000. Given the severity of this finding and the risk of loss, the engagement partner communicates this matter to the audit committee immediately rather than waiting for the year-end audit to conclude.
Differences Between AICPA and PCAOB Communication Requirements
| Requirement | AICPA (AU-C 260, 265) | PCAOB (AS 1301, AS 1305) |
|---|---|---|
| Scope | Nonissuers | Issuers |
| Primary governance body | Those charged with governance (may be the full board, audit committee, or owner-manager) | Audit committee of the board of directors |
| Communication of scope and timing | Required | Required |
| Written communication of significant deficiencies and material weaknesses | Required; no later than 60 days after report release | Required; on a timely basis |
| Two-way communication | Emphasized — the auditor should obtain information from governance, not just provide it | Emphasized — must include discussion of significant audit and accounting matters |
| Critical accounting policies | Not specifically required (though significant accounting policies are discussed) | Required — the auditor must discuss critical accounting policies and practices with the audit committee |
| Integrated audit (ICFR) | Not applicable for most nonissuers | Required for issuers — material weaknesses must be identified in the auditor's report on internal control |
For issuers subject to an integrated audit under PCAOB standards, material weaknesses in internal control over financial reporting (ICFR) are not only communicated to the audit committee—they are reported in the auditor's public report on internal control. This is a much higher level of public accountability than the private written communication required for nonissuers.
Summary
| Topic | Key Takeaway |
|---|---|
| Planned scope and timing | Communicated to those charged with governance before or at the start of the audit; includes overall strategy, risks, timing, and use of specialists |
| Communication with management | Includes scheduling, PBC lists, access requirements, and coordination with internal audit |
| Presentation materials | Formal presentations to governance may include audit plan summaries, required communications, supporting schedules, and management letters |
| Deficiency | A control weakness that could allow misstatements to go undetected; the lowest severity level |
| Significant deficiency | More severe than a deficiency but less severe than a material weakness; merits governance attention |
| Material weakness | Reasonable possibility that a material misstatement will not be prevented or detected and corrected on a timely basis |
| Written communication | Significant deficiencies and material weaknesses must be communicated in writing to those charged with governance |
| Timing | Written communication no later than 60 days after report release (AICPA) or on a timely basis (PCAOB); urgent matters communicated immediately |
| PCAOB differences | Communications directed to the audit committee; critical accounting policies discussed; material weaknesses reported publicly in integrated audits |