ISAs – Summaries and Application Guide ISA 265

ISA 265
COMMUNICATING DEFICIENCIES IN
INTERNAL CONTROL
APPLICATION
LO # LEARNING OBJECTIVE REQUIREMENTS PARAGRAPHS

INTRODUCTION (SCOPE, OBJECTIVE, AND

LO 1 1–6 N/A
DEFINITION)
DETERMINE WHETHER DEFICIENCY HAS BEEN
LO 2 7 A1–A4
IDENTIFIED
SIGNIFICANT DEFICIENCIES IN INTERNAL
LO 3 8 A5–A11
CONTROL
COMMUNICATION OF DEFICIENCIES IN
LO 4 10 A19–A27
INTERNAL CONTROL TO MANAGEMENT
COMMUNICATION OF DEFICIENCIES IN
LO 5 9 A12–A18
INTERNAL CONTROL TO TCWG
CONTENT OF WRITTEN COMMUNICATION OF
LO 6 SIGNIFICANT DEFICIENCIES IN INTERNAL 11 A28–A30
CONTROL

1
ISAs – Summaries and Application Guide ISA 265

LO 1: INTRODUCTION (SCOPE, OBJECTIVE, AND DEFINITION):

This ISA specifies which identified deficiencies in internal control the auditor is required to
communicate to management and TCWG.

LO 2: DETERMINE WHETHER DEFICIENCY HAS BEEN IDENTIFIED:

The auditor shall determine whether, on the basis of the audit work performed, the auditor has
identified one or more deficiencies in internal control.

For this purpose, auditor may discuss the relevant facts and circumstances of the auditor’s findings
with the appropriate level of management.

LO 3: SIGNIFICANT DEFICIENCIES IN INTERNAL CONTROL:

If a deficiency is identified by auditor shall determine whether it constitutes significant deficiency.

Following are matters to consider whether deficiency is significant:

 Likelihood of misstatement.
 Magnitude of misstatement.
 Volume of activities exposed to deficiency.
 Importance of control.

LO 4: COMMUNICATION OF DEFICIENCIES IN INTERNAL CONTROL TO

MANAGEMENT:
The auditor shall communicate to appropriate level of management (on a timely basis):
1. In writing, significant deficiencies in internal control that the auditor intends to
communicate to TCWG.

2. Other deficiencies in internal control identified during the audit that have not been
communicated to management by other parties and that, in the auditor’s professional
judgment, are of sufficient importance.

Ordinarily, the appropriate level of management is the one that has responsibility and authority to
evaluate the deficiencies in internal control and to take the necessary remedial action

Deficiencies communicated in prior period:

Significant Deficiencies:
If such deficiencies are uncorrected, auditor is required to repeat the communication (or to refer to
previous communication).

Other Deficiencies:
Auditor need not communicate deficiencies (other than significant) in internal control to
management if:
 it has been previously communicated to management by auditor in prior periods
 it has been previously communicated to management by other parties, such as the internal
audit function or regulators

2
ISAs – Summaries and Application Guide ISA 265

However, if management fails to correct previously identified deficiencies, this may become a
significant deficiency requiring communication with TCWG.

LO 5: COMMUNICATION OF DEFICIENCIES IN INTERNAL CONTROL TO TCWG:

The auditor shall communicate in writing significant deficiencies in internal control identified
during the audit to those charged with governance on a timely basis

When to issue communication:

Auditor may communicate these orally in the first instance to management and, when appropriate,
to those charged with governance to assist them in taking timely remedial action.
 For listed entities in certain jurisdictions, TCWG may need to receive the auditor’s written
communication before the date of approval of the financial statements to discharge specific
responsibilities in relation to internal control for regulatory or other purposes.
 For other entities, the auditor may issue the written communication at a later date (subject
to ISA 230’s requirement to complete the assembly of the final audit file)

LO 6: CONTENT OF WRITTEN COMMUNICATION OF SIGNIFICANT DEFICIENCIES

IN INTERNAL CONTROL:
The auditor shall include following in the written communication of significant deficiencies:
 A description of the deficiencies (significant deficiencies may be grouped together for
reporting purposes where it is appropriate to do so)
 explanation of their potential effects
 explanation of context of information

The auditor may also include in the written communication suggestions for remedial action on the
deficiencies, management’s actual or proposed responses, and a statement as to whether or not the
auditor has undertaken any steps to verify whether management’s responses have been
implemented.