## SA 265 – Communicating Deficiencies in Internal Control

### Who Gets Communicated What?

Finding	Communicate to	Basis	Form
Significant Deficiency	TCWG	Timely	Written
Significant Deficiency	Management	Timely	Written
Other Deficiency (not significant)	Management only	Timely	Written (good practice)
Other deficiency	NOT communicated to TCWG	—	Unless inappropriate to communicate only to mgmt

> Note: If an internal auditor has already communicated a deficiency to the auditor, it does not substitute for the statutory auditor's own communication obligation.

---

### What Must the Communication Include?

When communicating a significant deficiency, the auditor shall include:

Point	Detail
(a) Description	Description of the deficiency
(b) Explanation	Explanation of potential effects of the deficiency
(c) Context	Sufficient information for TCWG/Management to understand the context of the communication

Important Disclaimers the Auditor Must Include:

The purpose of the audit is to express an opinion on Financial Statements, NOT to give an opinion on the effectiveness of Internal Control.
The matter reported is limited to deficiencies identified during the audit — the auditor is not claiming all deficiencies have been found.

---

### Indicators / Examples of Significant Deficiency in Internal Control

A. Control Environment Issues:

TCWG fail to scrutinise transactions in which management is financially interested
Identification of management fraud
Failure by management to implement remedial action on previously communicated significant deficiency

B. Risk Assessment Issues:

Absence of a risk assessment process
Ineffective aspects of the risk assessment process
Ineffective response to identified significant risks

C. Other Indicators:

Auditor detected a misstatement that the entity's IC failed to detect
Evidence of management's inability to oversee preparation of Financial Statements
Disclosure of a prior period material misstatement

Worked example

### Example 1

Example 1: During the audit of XYZ Ltd., the auditor discovered that the company's management had been entering into related-party transactions without TCWG oversight, and TCWG had no mechanism to scrutinise these.

Conclusion: This is an indicator of a significant deficiency — specifically, an ineffective aspect of the control environment. The auditor must communicate this in writing to TCWG on a timely basis, including description, potential effects, and context, while clarifying the communication is not an opinion on IC effectiveness.

### Example 2

Example 2: The auditor of ABC Ltd. found a ₹12 lakh error in trade receivables that the company's controls had completely failed to catch. Management had no independent review process for receivables reconciliation.

Conclusion: The auditor detected a misstatement the IC failed to detect — a classic indicator of significant deficiency. The auditor must communicate to both TCWG (in writing) and management, describing the deficiency and its potential effects on FS.

⚠️ Common exam mistakes

Thinking significant deficiencies only need to be communicated to management — they must be communicated to TCWG as well, in writing.
Failing to include all three required elements in communication: (a) description of deficiency, (b) explanation of potential effects, and (c) contextual information.
Not including the disclaimer that the audit purpose is to opine on FS, not on IC effectiveness — this is a required part of the communication.
Assuming that once an internal auditor reports a deficiency to the external auditor, the external auditor's communication obligation is discharged — it is not.
Treating other (non-significant) deficiencies the same as significant deficiencies — only significant deficiencies must go to TCWG.

Reference:

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →