Communicating with those charged with governance

What ISA 260 requires an auditor to tell those charged with governance, how it works in an owner-managed company, and how to keep a record of it.

By Achekam · 11 October 2026 · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya

In a listed company, communicating with those charged with governance means a formal report to an audit committee, presented in a meeting with minutes. In the owner-managed companies that make up much of a small firm's audit list, it often means a conversation across the director's desk at the end of fieldwork. Both can satisfy ISA 260 (Revised). The difference is that the audit committee meeting leaves a record by default, and the conversation leaves nothing unless someone writes it down.

The standard is less about ceremony than about two-way communication: telling governance what it needs to know about the audit, and hearing what it knows that the auditor should. This article covers who you are talking to, what must be said and when, and how to keep evidence that it was.

Who governance is in a small company

Those charged with governance are the people with responsibility for overseeing the strategic direction of the entity and its accountability, including overseeing financial reporting. In a company with a board and an audit committee, the auditor communicates with the committee for most matters and with the full board where appropriate.

In a small company, those charged with governance may all be involved in managing it: a husband and wife who are the only directors, for example. ISA 260 recognises this. Where everyone charged with governance is also involved in management, matters already communicated to them in their management role need not be communicated again, as long as the auditor is satisfied that communication to the people in management adequately informs everyone with whom the auditor would otherwise communicate. Be careful with family companies where one director runs the business and another is a passive shareholder-director: the passive one is still charged with governance.

Identify the right people at planning, and write down who they are.

What to communicate, and when

ISA 260 requires the auditor to communicate:

the auditor's responsibilities in relation to the audit, usually covered in the engagement letter;
an overview of the planned scope and timing, including significant risks identified, without detail that would make procedures predictable;
significant findings from the audit, including the auditor's views on significant qualitative aspects of the entity's accounting practices (policies, estimates and disclosures), significant difficulties encountered, significant matters discussed with management, the written representations requested, circumstances that affect the form and content of the auditor's report, and other significant matters;
for listed entities, a statement on independence.

Other ISAs add their own matters for governance: fraud and suspected fraud under ISA 240, non-compliance with laws under ISA 250, significant deficiencies in internal control under ISA 265, uncorrected misstatements under ISA 450, significant related-party matters under ISA 550, going concern under ISA 570, and key audit matters under ISA 701 where they apply. Timing matters: planning matters early enough to be useful, findings before the report is signed.

Significant findings at the end of the audit

The end-of-audit communication is the one most often done badly, because it is done in a hurry. A good one is short and specific:

The opinion the auditor expects to give, and any modification, emphasis of matter or material uncertainty section.
Corrected misstatements that were significant, and every uncorrected misstatement above the clearly trivial threshold, with a request to correct them.
Significant deficiencies in internal control, in writing.
The judgements behind significant estimates, and the auditor's view of them.
Any difficulty with access to people or information, and any disagreement with management.
The representations the auditor is asking for.

The format of findings on controls, and the letter to management that often accompanies this communication, are covered in reporting control deficiencies in a management letter. Where key audit matters apply, governance should see them before the report is final; see choosing and writing key audit matters.

Preparing the governance pack in Achekam

Achekam's TCWG & Governance Pack Centre saves its work on the server for the chosen engagement, so the pack is prepared against that engagement rather than in a document on someone's desktop. The ISA numbers on its badge are labels, not evidence of compliance: what satisfies ISA 260 is what the pack actually says and who received it.

Two other features help the pack do its job:

A preview of the report. The partner can send the client a read-and-comment preview link to the audit report. The client opens it without signing in, and the link expires and can be revoked. Sending it to the directors alongside the governance pack lets them see the circumstances that affect the form and content of the report, which ISA 260 requires the auditor to communicate.
Acknowledgement by signature. Staff can prepare a document for e-signature and add signers, approvers and copied recipients in order; each signer signs from an e-mailed link without an Achekam account. When everyone has signed, Achekam produces the signed PDF with a completion certificate listing each signer's e-mail, times, IP address and browser and the document's fingerprint, and files it in the client's 'Signed documents' folder.

Keeping evidence of what was said and sent

ISA 260 requires oral communications to be documented, including when and to whom they were made, and written communications to be kept. In practice:

File every written communication in the client's vault. The Document Centre keeps a folder per client, with versions, tags and search, and archived documents are restored with a reason.
Record oral communications as a step on the completion work item. A step is marked done only with a written response and its documents, or set aside with a reason; steps are never deleted. "Discussed significant findings with both directors at the closing meeting; directors agreed to correct the inventory cut-off error; minute attached" is the kind of response that will survive an inspection.
Note any matter governance raised with you, such as fraud concerns or planned transactions, and what the team did about it.

The IAASB's page on ISA 260 (Revised) describes what the auditor must communicate to those charged with governance during an audit.

Before the closing meeting

Write the end-of-audit communication as a one-page agenda before you walk into the closing meeting, and have the directors sign it at the end. It turns an informal conversation into evidence without changing the conversation.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.