Think of SA 265 as the auditor's "complaint letter" to management and the board after the audit. When an auditor examines a company's internal controls — the checks and balances a company uses to prevent errors or fraud — they sometimes spot weaknesses. SA 265 tells the auditor exactly what to report, to whom, and how.
The standard defines two levels of problems. First, a deficiency in internal control exists when a control is either missing, poorly designed, or not working as intended — so that errors or fraud could sneak through undetected. Think of Mr. Sharma's manufacturing company where any employee can approve a purchase AND raise a payment — no separation of duties. That's a deficiency. Second, and more serious, is a significant deficiency: a deficiency (or a combination of deficiencies) important enough that the Those Charged with Governance (TCWG) — typically the Board or Audit Committee — need to know about it. Auditors use professional judgment to decide which deficiencies cross this line.
Here's the communication rule that examiners love to test: Significant deficiencies must be communicated in writing to TCWG and to management, on a timely basis. Other deficiencies that are not significant deficiencies but which the auditor thinks management should know about can be communicated to management (written or oral, but written is best practice). One important nuance: if management is also TCWG (common in owner-managed companies like Rajesh & Co. Pvt. Ltd.), you still communicate — you can't just stay silent because "they already know." Also, the standard does not require the auditor to design a full system to find all deficiencies — only to communicate those noticed during the normal audit process. Finally, the auditor should include in the written communication: a description of each significant deficiency, an explanation of its potential effects, and enough context for TCWG to understand the seriousness.
Example 1 — Identifying and Classifying the Deficiency
Setup: You are auditing Meera Exports Pvt. Ltd. During your audit, you discover that the company's bank reconciliation is prepared by the same cashier who handles cash receipts. No one reviews or approves the reconciliation. Unreconciled differences up to ₹2,00,000 have gone unnoticed for 3 months.
Working:
- Step 1 — Is there a deficiency? Yes. The control (bank reconciliation review) is either missing or not operating effectively. A single person controls both cash and its reconciliation — a classic lack of segregation of duties.
- Step 2 — Is it a significant deficiency? Apply professional judgment: ₹2,00,000 undetected for 3 months is material to a mid-size exporter. The risk of misstatement or fraud is high. Yes, this is a significant deficiency.
- Step 3 — Communication: Auditor must issue a written communication to the Audit Committee (TCWG) AND to management, describing the deficiency, its potential effect (undetected cash misappropriation or misstatement), and doing so on a timely basis — ideally before the audit report is finalised.
Final Answer: This is a significant deficiency under SA 265 → mandatory written communication to TCWG and management.
---
Example 2 — Minor Deficiency, Different Route
Setup: At Rajesh & Co. Pvt. Ltd., you notice that petty cash vouchers below ₹500 are not signed by the recipient. Total petty cash float is ₹10,000. The business has revenues of ₹8 crore.
Working:
- Step 1 — Deficiency? Yes, a control (signature on vouchers) is not operating.
- Step 2 — Significant deficiency? The amount is trivial (₹500 limit on a ₹10,000 float, ₹8 crore revenue). Risk of material misstatement is negligible. Not a significant deficiency.
- Step 3 — Communication: Auditor has discretion to communicate this to management (not mandatory to TCWG). Can be done in a management letter.
Final Answer: Minor deficiency → communicate to management at auditor's discretion; no written TCWG communication required.