# SA 265: Communication of Deficiencies in Internal Control
## Objective of the Auditor
To communicate appropriately to TCWG and management, deficiencies in internal control that:
1. Were identified during the audit, AND
2. In the auditor's professional judgment, are of sufficient importance to merit their respective attention
---
## Key Definitions
### Deficiency in Internal Control
Exists when either:
- A control is designed, implemented, or operated such that it cannot prevent, or detect and correct, misstatements in the FS on a timely basis, OR
- A necessary control is missing to prevent, or detect and correct, such misstatements
### Significant Deficiency in Internal Control
A deficiency (or combination of deficiencies) in internal control that, in the auditor's professional judgment, is of sufficient importance to merit the attention of TCWG.
> Key distinction: All significant deficiencies are deficiencies, but not all deficiencies are significant.
---
## Factors for Determining Whether a Deficiency is Significant — Mnemonic: VISE AF
| Letter | Factor | Detail |
|---|---|---|
| V | Volume of activity | Volume in the account balance or transaction class exposed to the deficiency |
| I | Importance of controls | Monitoring controls, fraud prevention/detection, accounting policy selection, related-party transactions, unusual/non-routine transactions, period-end reporting controls |
| S | Susceptibility | Susceptibility of the related asset or liability to loss or fraud |
| E | Estimates | Subjectivity and complexity in determining estimated amounts (e.g., fair value) |
| A | Amounts | FS amounts exposed to the deficiency |
| F | Future likelihood | Likelihood the deficiency leads to material misstatements in future |
---
## Indicators of Significant Deficiencies — 9 Examples
1. Significant transactions where management is financially interested — not scrutinised by TCWG
2. Management fraud identified (material or not) that internal control failed to prevent
3. Management failed to implement remedial action on significant deficiencies previously communicated
4. Absence of a risk assessment process
5. Evidence of an ineffective entity risk assessment process
6. Evidence of an ineffective response to identified significant risks
7. Misstatements detected by the auditor that internal control failed to prevent, detect, or correct
8. Material misstatement (error or fraud) disclosed as prior period items in the current year's P&L
9. Evidence of management's inability to oversee preparation of the FS
---
## Communication Requirements
### To TCWG:
- Communicate in writing all significant deficiencies
- Must be on a timely basis
### To Management (at appropriate level of responsibility, timely):
| Type | Requirement |
|---|---|
| Significant deficiencies | In writing — those communicated (or intended to be communicated) to TCWG, unless inappropriate to communicate directly to management |
| Other (non-significant) deficiencies | Those not communicated by other parties, if in auditor's judgment they merit management's attention |
---
## Content of Written Communication of Significant Deficiencies
Must include:
- Description of the deficiency + explanation of potential effects
- Sufficient context for TCWG and management to understand the communication
Must clarify (to avoid misunderstanding):
1. The audit's purpose was to express an opinion on the FS — not to express an opinion on the effectiveness of internal control
2. The audit included consideration of internal control only to design appropriate audit procedures
3. Matters reported are limited to deficiencies identified during the audit that the auditor concluded merit reporting to TCWG