Reporting control deficiencies in a management letter
How to turn control findings into a management letter that gets acted on, and which deficiencies ISA 265 requires the auditor to report in writing.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Many management letters are written once and then copied every year: "segregation of duties should be improved", "bank reconciliations should be reviewed timeously", "a fixed asset register should be maintained". The client files the letter, nothing changes, and next year the same points come back with "repeat finding" added in brackets. The letter has become a formality for both sides.
A management letter can be more useful than that. ISA 265 sets the floor: significant deficiencies in internal control must be communicated in writing to those charged with governance. Above that floor, the letter is the auditor's chance to tell the client, specifically and usefully, where its controls let it down this year.
Deficiencies and significant deficiencies
ISA 265 defines a deficiency in internal control as existing when a control is designed, implemented or operated in a way that it cannot prevent, or detect and correct, misstatements on a timely basis, or when a control needed to do so is missing.
A significant deficiency is a deficiency, or combination of deficiencies, that in the auditor's professional judgement is important enough to merit the attention of those charged with governance. Indicators include:
- evidence of ineffective aspects of the control environment, such as management overriding controls;
- misstatements found by the auditor that the client's controls did not prevent or detect;
- fraud of any size involving senior management;
- management's failure to remedy significant deficiencies reported previously;
- the lack of a risk assessment process where one would be expected.
The communication requirements differ:
| What | To whom | Form |
|---|---|---|
| Significant deficiencies | Those charged with governance | In writing, on a timely basis |
| Significant deficiencies | Management, unless inappropriate in the circumstances | In writing |
| Other deficiencies that merit management's attention | Management | In writing or orally |
Raising findings from working papers
Good management letter points start where the deficiency was found. In Achekam, findings can be raised from a working paper and closed or withdrawn, with Findings and Exceptions tabs on each paper. Lead schedules are built from the trial balance with each figure traceable to its lines, and staff can record an audit adjustment on a line with a reason. When an adjustment exists because a control failed, raise the finding on the same paper, so the control point and its consequence sit together.
The Controls & Walkthrough Studio saves its work on the server for the chosen engagement, which is where walkthrough observations that become findings usually start. The ISA numbers on its badges are labels, not evidence of compliance. How walkthroughs feed control findings is covered in walkthroughs and controls.
Before a finding goes into the letter, someone senior should decide whether it is a significant deficiency. A reviewer can raise review notes on a working paper, the preparer answers and the reviewer clears them, and each note's history is kept. A note asking "why is this not significant, given the misstatement it caused?" is worth having on the file.
Getting management's responses
A letter with management's responses is far more useful than one without. Send each draft finding to the person who owns the process, and ask for a response, an owner and a target date.
The RFI console works for this: staff create, send and track requests for answers, and the request's timeline shows when the draft went out and when the responses came back. Where management disagrees with a finding, record the disagreement in the letter rather than deleting the point.
Writing a letter that gets acted on
ISA 265 requires the written communication to describe the deficiencies and explain their potential effects, and to give enough context: that the audit's purpose was to express an opinion on the statements; that the auditor considered internal control to design audit procedures, not to express an opinion on its effectiveness; and that the matters reported are limited to deficiencies identified during the audit and judged important enough to report.
For each point, a structure that works:
- What we found. The specific condition: "Supplier bank details were changed on several occasions during the year by the same clerk who processes payments, with no second person verifying the change."
- Why it matters. The risk in the client's terms: payments diverted to a fraudster's account.
- What we recommend. One practical change: "Require a second person to verify each change against the supplier's own confirmation before the next payment run."
- Management's response. With owner and date.
Rank points by importance, put significant deficiencies first and label them as such, and keep generic points out unless they matter this year. Many audit committees think about control in the components of COSO's framework; the COSO internal control guidance page sets out the Internal Control - Integrated Framework (2013) and its supporting guidance, and using its vocabulary can help a board place a finding.
Sending, signing and keeping the letter
The TCWG & Governance Pack Centre saves its work on the server for the chosen engagement, so the letter can be prepared as part of the governance pack described in communicating with those charged with governance.
Staff can prepare a document for e-signature and add signers, approvers and copied recipients in order, and each signer signs from an e-mailed link without an Achekam account. Asking the chair or a director to sign the letter as received gives a clear record that significant deficiencies were communicated in writing.
File the final letter in the client's folder in the Document Centre, where versions are kept and documents can be tagged and searched. Tag it by year, so next year's team can find it without searching through correspondence.
Following up next year
At next year's planning, read last year's letter first. For each point, ask management what was done, test whether it was, and close or carry forward the finding with a reason. Management's failure to fix a significant deficiency is itself an indicator of a significant deficiency.
One change for this year
Before drafting this year's letter, delete every point copied from last year and add back only those you tested again and found still true. The letter that remains will be shorter, and far more likely to be read.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
