## Communicating Deficiencies in Internal Control (SA-265)

### Definitions

Deficiency in Internal Control exists when:

1. A control is missing (ICS does not exist); OR

2. A control exists but is not sufficiently competent to Prevent, Detect, or Correct misstatements

Significant Deficiency:

A deficiency (or combination of deficiencies) of sufficient importance to merit the attention of TCWG.

---

### Determining Whether a Deficiency is Significant

Memory Aid: I-EVA-CF-MF ("EVA TOLD ME TO BE CAREFUL WHILE INVESTING IN MUTUAL FUNDS")

Letter	Factor
I	Interaction of deficiency with other deficiencies
E	Estimate (accounting) — e.g., fair value estimates
V	Volume of activity exposed
A	Amount exposed due to the deficiency
C	Control over Financial Reporting
F	Frequency and cause of the deficiency
M	Material misstatement — likelihood
F	Fraud / Loss to Assets

---

### Indicators of Significant Deficiency

Memory Aid: AIM-IIM-DELHI

#	Indicator
A	Absence of Risk Assessment Process within the entity
I	Ineffective Risk Assessment Process
M	Material Misstatement detected by audit but NOT by entity's own controls
I	Ineffective response to identified risk
I	Ineffective control environment
M	Management's inability to oversee financial reporting
D	Disclosure of Material Misstatement as prior period item in current year P&L

Additional indicators:

Management is financially interested but not scrutinised by TCWG
Fraud not detected by entity's own ICS
Management's failure to rectify a Significant Deficiency previously communicated

---

### Communication Requirements

To Whom	What	How
Management	ALL deficiencies	Significant: Written; Non-significant: Oral
TCWG	Significant deficiencies ONLY	Always in writing

Content of the communication:

1. Description of the deficiency and explanation of potential effects

2. Sufficient information for TCWG/management to understand the context

The auditor must also clarify:

1. The objective is to express an opinion on FS — not on ICS

2. The auditor examined ICS to design NTE of audit procedures — not to opine on it

3. Deficiencies communicated are only those identified during the course of audit

Worked example

### Example 1

During an audit, the auditor discovers goods worth ₹40 lakhs were dispatched but not invoiced in the current year (revenue missed). The entity's own controls failed to detect this. This is a 'Significant Deficiency' (MM detected by audit but not by entity's controls — AIM indicator 'M'). The auditor must communicate this in writing to BOTH management AND TCWG.

### Example 2

An auditor finds that the petty cash approval process has a poorly designed threshold — no second authorization required below ₹5,000. Total exposure is ₹30,000 — clearly immaterial. This is a non-significant deficiency. The auditor communicates it orally to management only; no written report to TCWG is required. However, if the auditor previously communicated this same deficiency and management did not rectify it, it now becomes an indicator of significant deficiency.

⚠️ Common exam mistakes

Thinking all deficiencies must be reported in writing to TCWG — only SIGNIFICANT deficiencies go to TCWG in writing; non-significant ones are communicated orally to management only.
Assuming SA-265 requires the auditor to express an opinion on ICS — it explicitly does NOT; the auditor only communicates deficiencies found while designing audit procedures.
Forgetting that management's failure to rectify a PREVIOUSLY communicated significant deficiency is itself a new indicator of significant deficiency.
Confusing a missing control (deficiency by absence) with an ineffective control (deficiency by competence) — both constitute deficiencies under SA-265.

Reference: — SA 265 — Communicating Deficiencies in Internal Control to Those Charged with Governance and Management (ICAI)

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →