# SA 265 — Communicating Deficiencies in Internal Control to TCWG and Management
## Two Core Definitions
### Deficiency in IC
Exists when:
- A control necessary to prevent, or detect and correct, misstatements in FS is missing, OR
- A control is designed, implemented or operated so that it is unable to prevent, or detect and correct, misstatements.
### Significant Deficiency in IC
A deficiency (or combination of deficiencies) of sufficient importance to merit attention of TCWG.
> Key insight: Significance depends not only on whether misstatement actually occurred but also on the likelihood of misstatement. Therefore, a significant deficiency may exist even though the auditor has not identified any actual misstatement.
## Communication Hierarchy
- Significant deficiencies → communicate in writing to TCWG.
- Significant deficiencies must also be communicated to management in writing — unless inappropriate to do so directly.
- Other (non-significant) deficiencies not communicated by other parties — communicate to management if of sufficient importance for management's attention.
## Factors to judge whether a deficiency is SIGNIFICANT
- Likelihood of the deficiency leading to MM in FS in the future.
- FS amounts exposed to the deficiency.
- Volume of activity in the Class of transaction, Account balance or Disclosure (CAD) exposed.
- Susceptibility to loss or fraud of the related asset or liability.
- Subjectivity and complexity of estimated amounts (e.g., fair value).
- Importance of the controls to the financial reporting process:
- General monitoring controls (e.g., management oversight).
- Controls over the period-end FR process.
- Controls over fraud prevention and detection.
- Controls over selection and application of accounting policies.
- Controls over significant transactions with Related Parties (RP).
- Controls over significant transactions outside the entity's normal course of business.
- Cause and frequency of exceptions detected.
- Interaction of the deficiency with other deficiencies in IC.
## Indicators of Significant Deficiencies (Red flags)
- Evidence of ineffective control environment, e.g.:
- Significant transactions in which management is financially interested are not appropriately scrutinised by TCWG.
- Identification of management fraud not prevented by the entity's IC.
- Management's failure to remediate previously communicated significant deficiencies.
- Evidence of management's inability to oversee preparation of FS.
- Absence of Risk Assessment Procedure (RAP) where it should exist.
- Evidence of an ineffective entity RAP.
- Misstatements detected that were not prevented or detected by IC.
- Disclosure of MM as prior period items in the current year's P&L.
- Evidence of ineffective response to identified significant risks.
## Contents of the Written Communication (Letter of Weakness)
The written communication of significant deficiencies must include:
1. A description of the deficiencies.
2. Their potential effects.
3. Sufficient information to enable TCWG and management to understand the context, including that:
- The purpose of the audit was to express an opinion on the FS.
- The audit included consideration of IC, but NOT for the purpose of expressing an opinion on the effectiveness of IC.
- The matters being reported are limited to deficiencies the auditor has identified during the audit (i.e., the auditor has not searched for ALL deficiencies).
## Practical name
This written communication is commonly called the "Letter of Weakness" or Management Letter.