SA 265: Communicating Deficiencies in Internal Control to TCWG and Management

Objective: Communicate deficiencies in Internal Control (IC) to TCWG and Mngt that auditor has
identified during the audit and that are of sufficient importance to draw their attention.

Definitions:
1. Deficiency in IC: Deficiency in IC exists when
a. A control is designed, implemented or operated in such a way that it is unable to prevent,
detect or correct misstatement in FS
b. A control necessary to prevent, detect or correct misstatement in FS is missing.

2. Significant Deficiency in IC: When an individual or combination of deficiencies in IC, in auditor’s

professional judgment, is of sufficient importance to merit attention of TCWG.

Auditor’s Consideration:
On the basis of work performed, determine whether he has identified one or more deficiencies in IC

Whether the Deficiency is of importance that is individually or collectively constitute Significant

Deficiency

Communicate the Deficiency to TCWG on timely basis

Also communicate the same to Mngt

That he has communicated or intends to Other Significant Deficiencies

communicate deficiencies to TCWG not communicated to Mngt by other parties

The written communication shall include:

1. Description of deficiencies and explanation of potential effects
2. Sufficient info so that TCWG and Mngt can understand the context of communication,
particularly:
a. The audit was to express opinion on FS
b. The auditor has considered only those IC that are relevant for preparation of FS and not
for expressing opinion on effectiveness of IC.
c. The auditor has reported only those deficiencies that has been identified during audit
and that are of significant importance and not all IC

Factors affecting Significance of deficiencies in IC:

1. Likelihood of deficiencies leading to material misstatement in FS
2. Susceptibility to loss or fraud
3. Financial Statement amount exposed to such deficiencies
4. Importance of control to FR process
5. Interaction of deficiencies with other IC

Indicators of Significant Deficiencies in IC:

1. Ineffective control environment (Untrained staff, Mngt failure to take remedy against
deficiencies)
2. Absence of Risk Assessment process in entity
3. Evidence of ineffective response to identified risk
4. Misstatements detected by auditor not prevented, detected or corrected by entity’s IC
5. Evidence of management’s inability to oversee preparation of FS