Communicating Internal Control Related Matters …

1 Communicating Internal Control Related Matters247AU-C Section 265 Communicating Internal Control RelatedMatters Identified in an AuditSource: SAS No. 122; SAS No. 125; SAS No. 128; SAS No. 130; SASNo. section 9265 for interpretations of this for audits of financial statements for periods ending on orafter December 15, 2012, unless otherwise of This section addresses the auditor's responsibility to appropriatelycommunicate to those charged with governance and management deficienciesin Internal Control that the auditor has identified in an audit of financial state-ments. This section does not impose additional responsibilities on the auditorregarding obtaining an understanding of Internal Control or designing and per-forming tests of controls over and above the requirements of section 315,Un-derstanding the Entity and Its Environment and Assessing the Risks of Mate-rial Misstatement, and section 330,Performing Audit Procedures in Response toAssessed Risks and Evaluating the Audit Evidence Obtained.

2 Section 260,TheAuditor's Communication With Those Charged With Governance, establishesfurther requirements and provides guidance regarding the auditor's responsi-bility to communicate with those charged with governance regarding the auditor is required to obtain an understanding of Internal con-trol relevant to the audit when identifying and assessing the risks of mate-rial making those risk assessments, the auditor considersinternal Control in order to design audit procedures that are appropriate in thecircumstances but not for the purpose of expressing an opinion on the effec-tiveness of Internal Control . The auditor may identify deficiencies in internalcontrol not only during this risk assessment process but also at any other stageof the audit. This section specifies which identified deficiencies the auditor isrequired to communicate to those charged with governance and in this section precludes the auditor from Communicating tothose charged with governance or management other Internal Control mattersthat the auditor has identified during the section is not applicable if the auditor is engaged to perform anaudit of Internal Control over financial reporting that is integrated with an au-dit of financial statements.

3 In such circumstances, section 940,An Audit of In-ternal Control Over Financial Reporting That Is Integrated With an Audit ofIts Financial Statements, applies. [As amended, effective for audits for periods1 Paragraph .13 of section 315,Understanding the Entity and Its Environment and Assessing theRisks of Material Misstatement. Paragraphs .A61 .A67 of section 315 provide guidance on obtainingan understanding of Internal Control relevant to the audit. 2021, AICPAAU-C Principles and Responsibilitiesending on or after December 15, 2016, by SAS No. 130. Revised, December 2016,to reflect conforming changes necessary to reflect the issuance of SAS No. 130.]Effective section is effective for audits of financial statements for periodsending on or after December 15, objective of the auditor is to appropriately communicate to thosecharged with governance and management deficiencies in Internal Control thatthe auditor has identified during the audit and that,in the auditor's professionaljudgment, are of sufficient importance to merit their respective purposes of generally accepted auditing standards, the followingterms have the meanings attributed as follows.

4 Deficiency in Internal deficiency in Internal controlover financial reporting exists when the design or operation ofa Control does not allow management or employees, in the nor-mal course of performing their assigned functions, to prevent, ordetect and correct, misstatements on a timely basis. A deficiencyindesignexists when (a) a Control necessary to meet the controlobjective is missing, or (b) an existing Control is not properly de-signed so that, even if the Control operates as designed, the controlobjective would not be met. A deficiency inoperationexists whena properly designed Control does not operate as designed or whenthe person performing the Control does not possess the necessaryauthority or competence to perform the Control deficiency, or a combination of deficiencies, ininternal Control over financial reporting, such that there is a rea-sonable possibility that a material misstatement of the entity'sfinancial statements will not be prevented, or detected and cor-rected, on a timely basis.

5 A reasonable possibility exists when thelikelihood of an event occurring is either reasonably possible orprobable as defined as follows:Reasonably chance of the future event orevents occurring is more than remote but less than future event or events are likely to deficiency, or a combination of deficien-cies, in Internal Control over financial reporting that is less severethan a material weakness yet important enough to merit atten-tion by those charged with governance.[As amended, effective for audits for periods ending on or after December 15,2016, by SAS No. 130.]RequirementsDetermination of Whether Deficiencies in Internal Control HaveBeen auditor should determine whether, on the basis of the audit workperformed, the auditor has identified one or more deficiencies in Internal con-trol.

6 (Ref: par..A1 .A4)AU-C 2021, AICPAC ommunicating Internal Control Related Matters249 Evaluating Identified Deficiencies in Internal Control (Ref: par..A5 .A14).09If the auditor has identified one or more deficiencies in Internal Control ,the auditor should evaluate each deficiency to determine, on the basis of theaudit work performed, whether, individually or in combination, they constitutesignificant deficiencies or material the auditor initially determines that a deficiency, or a combina-tion of deficiencies, in Internal Control is not a material weakness, the audi-tor should consider whether prudent officials, having knowledge of the samefacts and circumstances, would likely reach the same conclusion. [As amended,effective for audits for periods ending on or after December 15, 2016, by SASNo.]

7 130.]Communication of Deficiencies in Internal auditor should communicate in writing to those charged with gov-ernance on a timely basis significant deficiencies and material weaknessesidentified during the audit, including those that were remediated during theaudit. (Ref: par..A15 .A20 and .A28).12 The auditor also should communicate to management at an appropri-ate level of responsibility, on a timely basis (Ref: par..A21 and .A28) writing, significant deficiencies and material weaknesses thatthe auditor has communicated or intends to communicate to thosecharged with governance, unless it would be inappropriate to com-municate directly to management in the circumstances. (Ref: and .A22 .A23) writing or orally, other deficiencies in Internal Control identi-fied during the audit that have not been communicated to man-agement by other parties and that, in the auditor's professionaljudgment, are of sufficient importance to merit management's at-tention.

8 If other deficiencies in Internal Control are communicatedorally, the auditor should document the communication. (Ref: .A27).13 The communications referred to in paragraphs .11 .12 should be madeno later than 60 days following the report release date. (Ref: par..A16 .A17).14 The auditor should include in the auditor's written communication ofsignificant deficiencies and material weaknesses (Ref: par..A29 .A33) definition of the termmaterial weaknessand, when relevant,the definition of the termsignificant description of the significant deficiencies and material weak-nesses and an explanation of their potential effects. (Ref: ) information to enable those charged with governanceand management to understand the context of the communica-tion. In particular, the auditor should include in the communica-tion the following elements that explain that (Ref: par.)

9 A30 .A31)i. the purpose of the audit was for the auditor to express anopinion on the financial the audit included consideration of Internal Control overfinancial reporting in order to design audit proceduresthat are appropriate in the circumstances but not for the 2021, AICPAAU-C Principles and Responsibilitiespurpose of expressing an opinion on the effectiveness ofinternal the auditor is not expressing an opinion on the effective-ness of Internal the auditor's consideration of Internal Control was not de-signed to identify all deficiencies in Internal Control thatmight be material weaknesses or significant deficiencies,and therefore, material weaknesses or significant deficien-cies may exist that were not appropriate alert, in accordance with section 905,Alert ThatRestricts the Use of the Auditor's Written (Ref:par.

10 A32)[As amended, effective for the auditor's written communications Related to au-dits of financial statements for periods ending on or after December 15, 2012,by SAS No. 125.].15 When the auditor issues a written communication stating that no ma-terial weaknesses were identified during the audit, the communication shouldinclude the Matters in paragraph .14aandc d. (Ref: par..A34 .A36).16 The auditor should not issue a written communication stating that nosignificant deficiencies were identified during the audit. (Ref: par..A34)Application and Other Explanatory MaterialDetermination of Whether Deficiencies in Internal Control HaveBeen Identified (Ref: par..08).A1In determining whether the auditor has identified one or more defi-ciencies in Internal Control , the auditor may discuss the relevant facts and cir-cumstances of the auditor's findings with the appropriate level of discussion provides an opportunity for the auditor to alert managementon a timely basis to the existence of deficiencies of which management may nothave been previously aware.