## Significant Deficiencies in Internal Control — SA 265

### What is a Deficiency in Internal Control?

A deficiency in internal control exists when:

A control is designed, implemented, or operated in a way that it is unable to prevent, or detect and correct, misstatements in the financial statements on a timely basis; OR
A necessary control is absent.

---

### What is a Significant Deficiency?

A significant deficiency is a deficiency, or combination of deficiencies, in internal control that — in the auditor's professional judgement — is of sufficient importance to merit the attention of those charged with governance (TCWG).

---

### Communication Requirements (SA 265)

When the auditor identifies significant deficiencies, communication to TCWG and management must:

1. Describe the significant deficiency clearly

2. Explain the potential effects — what misstatements or errors could result from this deficiency

3. Provide sufficient context so that TCWG and management understand the nature and significance of the communication

> A brief, one-line description alone is not sufficient communication under SA 265. Potential effects must be articulated explicitly.

---

### What Good Communication Looks Like

A proper communication of a significant deficiency should:

Identify the specific control area (e.g., segregation of duties in sales, authorisation of related-party transactions)
Describe the deficiency concretely
State the potential financial statement impact (e.g., risk of misstatement in revenue, trade receivables)
Indicate responsibility for remediation
Be addressed in writing to both TCWG and management, as appropriate

Worked example

### Example 1

A Ltd — Sales Control Deficiency (MTP 2): During the audit of A Ltd, the auditor identified deficiencies in segregation of duties, authorisation of sales orders, preparation of invoices, and debit/credit notes. The auditor communicated this to management as a single line: 'Instructions on internal control related to sales are not properly followed by the staff.'

Analysis: This communication is inadequate under SA 265. While the deficiency is mentioned, its potential effects are not explained. A proper communication should: describe the specific control failures; state that such deficiencies could lead to misstatement of revenue and trade receivables impacting reported profits; highlight the importance of the control; and recommend fixing accountability for adherence. A one-liner fails all of these requirements.

### Example 2

Pizza Limited — Related Party Transactions (MTP 3): CA Vasu identified that the company's specified procedures were bypassed in transactions with firms in which directors were interested. He communicated this as: 'Controls over significant transactions with related parties are weak.'

Analysis: This is not appropriate under SA 265. The communication describes the deficiency but does not explain: what specific potential misstatements could arise, what financial statement line items are at risk, or the significance of related-party transactions and management override risk. The communication must go beyond labelling the deficiency as 'weak' and must convey why it matters and what could go wrong.

⚠️ Common exam mistakes

Communicating the description of a significant deficiency to TCWG without explaining its potential effects — SA 265 requires both description AND explanation of potential effects.
Providing a vague one-liner such as 'controls are weak' without identifying the specific control failures or the financial statement areas at risk.
Not distinguishing between what must be communicated to management and what must be communicated to TCWG — the communication requirements and form may differ.
Assuming that verbal communication of a significant deficiency to management alone satisfies SA 265 — written communication is required.
Confusing a 'deficiency in internal control' with a 'significant deficiency' — not every deficiency rises to the level of a significant deficiency; professional judgement is required.

Reference: SA 265 (Communication of Significant Deficiencies) — SA 265 — Communicating Deficiencies in Internal Control to Those Charged with Governance and Management

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →

Communication of Significant Deficiencies in Internal Control (SA 265)

Worked example

⚠️ Common exam mistakes