# SA 265 – Communicating Deficiencies in Internal Control to TCWG and Management
## Key Definitions
### Deficiency in Internal Control
A deficiency exists when:
- A control is designed, implemented or operated in a way that it is unable to prevent, detect and correct misstatements in FS on a timely basis, OR
- A control necessary to prevent/detect and correct misstatements on a timely basis is missing
### Significant Deficiency in Internal Control
A deficiency, or combination of deficiencies, in internal control that is of sufficient importance to merit the attention of TCWG.
---
## Auditor's Determination Process
```
Step 1: Identify whether any deficiency in IC exists
↓
Step 2: Determine whether — individually or in combination —
those deficiencies constitute significant deficiencies
```
---
## Communication Requirements
### To TCWG
- In writing, on a timely basis
- For all significant deficiencies identified during the audit
### To Management
- In writing, on a timely basis:
- Significant deficiencies communicated (or intended to be communicated) to TCWG — unless it is inappropriate to communicate with management
- Other deficiencies not yet communicated to management but of sufficient importance to merit management's attention
---
## Factors: Is a Deficiency Significant?
| Factor | Why It Matters |
|---|---|
| Likelihood of future material misstatements | Higher probability = more likely significant |
| Susceptibility to loss or fraud | High-risk assets/liabilities involved |
| Complexity of accounting estimates | Fair value, subjective judgements |
| FS amounts exposed | Size of balances at risk |
| Volume of activity in affected accounts | High transaction volume amplifies impact |
| Cause and frequency of exceptions | Recurring errors signal systemic weakness |
| Interaction with other deficiencies | Combined effect may exceed individual impact |
| Importance to financial reporting process | General monitoring; fraud prevention; related party controls; period-end controls (e.g., non-recurring journal entries) |
---
## Indicators of Significant Deficiencies
Control Environment
- Significant transactions where management has a financial interest — not scrutinised by TCWG
- Management fraud (material or not) not prevented by IC
- Management's failure to remediate deficiencies previously communicated
Risk Assessment Process
- Absence of a risk assessment process where one would ordinarily be expected
- Failure to identify risks that the auditor would expect to have been identified
- Ineffective response to identified significant risks (e.g., absent controls)
Detection Failures
- Misstatements detected by the auditor that were not prevented or detected by IC
- Material misstatement disclosed as a prior period item in the current year's P&L
- Evidence of management's inability to oversee preparation of FS
---
## Content of the Written Communication
The written communication to TCWG and management must include:
1. Description of deficiencies and explanation of their potential effects
2. Sufficient context for TCWG and management to understand the communication