Communicating Deficiencies in Internal Control

Objective

Objective

The objective of this project is to develop a clear definition of the threshold at which deficiencies in internal control that the auditor has identifed during the audit should be communicated to those charged with governance and management, and to provide enhanced guidance to assist the auditor in fulfilling the auditor's communication responsibilities.

The IAASB approved ISA 265,Communicating Deficiencies in Internal Control to Those Charged with Governance and Management in December 2008. The ISA is effective for audits of financial statements for periods beginning on or after December 15, 2009. A Basis for Conclusions will provide background to the project, main comments received on the exposure draft, and the IAASB's conclusions regarding these comments in developing the final standard.

Background

The definition of "material weakness" within the ISAs is rather general, and the original aim of the project was to provide more guidance on the meaning of the term to improve the consistency with which auditors treat identified weaknesses as material (with consequent reporting implications). The project proposal emphasized that the project would not seek to extend the auditor's responsibilities beyond those set out in ISAs. It would also avoid unnecessary complexity that might not be justified given that ISAs address audits of both listed and non-listed entities.

Task Force progress / Board discussions to date

At the April 2007 meeting, the IAASB discussed the following issues:

  • Whether the objectives and supporting requirements proposed for the ISA implied a level of work effort that was excessive, especially in the evaluation of the significance of identified deficiencies in internal control.
  • Whether the definition of "material weakness" should be limited to a consideration of potential material misstatements affecting the current year financial statements only.
  • Possible approaches to defining the term "material weakness," including whether the definition should be harmonized with that which the U.S. Public Company Accounting Oversight Board is currently developing as part of its proposed new internal control auditing standard.
  • The effect a definition of "material weakness" in the proposed ISA might have in the European Union (EU) context, given the possible adoption of ISAs in the EU and the fact that the EU's Statutory Audit Directive requires the auditor to communicate material weaknesses to the audit committee.



At the September 2007 meeting, the task force presented a first-read draft of the proposed ISA to the IAASB. Issues the IAASB discussed included:

  • Approach to defining the threshold at which deficiencies in internal control should be communicated.
  • The nature of the auditor's work effort in evaluating deficiencies in internal control identified based on the audit work performed.
  • To whom and to what extent to communicate deficiencies in internal control that have come to the auditor's attention.
  • The auditor's responsibility to evaluate the operating effectiveness of compensating controls.



At the December 2007 meeting, the IAASB considered a revised draft of the proposed ISA. Issues the IAASB discussed included:

  • The objective of the auditor and the definition of the term 'significant deficiency.'
  • The auditor's responsibilities regarding compensating controls.
  • The nature of the communication where the deficiencies involve management.
  • Whether deficiencies in internal control should be communicated in writing to management.



The IAASB unanimously approved the proposed ISA for exposure with a 120-day comment period ended April 30, 2008. The IAASB agreed that the proposed ISA should be placed in the communications series and be numbered 265.

At the September 2008 meeting, the IAASB considered the significant comments received on exposure and a revised draft of the proposed ISA, as well as significant comments received from the IAASB CAG and the IFAC SMP Committee. Issues the IAASB discussed included:

  • Whether the terms and definitions proposed in the exposure draft should be retained.
  • Whether the identification requirement should be retained in the proposed ISA or moved by to ISAs 315 (Redrafted) and 330 (Redrafted).
  • Whether there should be a further category of deficiencies, namely deficiencies that are not clearly inconsequential and that are not reportable.
  • How the ISA should address a legal or regulatory requirement to communicate material weaknesses in internal control to those charged with governance.



At the December 2008 meeting, the IAASB approved ISA 265,Communicating Deficiencies in Internal Control to Those Charged with Governance and Management. The ISA will be published after the Public Interest Oversight Board has confirmed that due process was followed in its development.