What does an auditor do about deficiencies in internal control identified during the audit?

 Deficiency in internal control exists when:

·        Control is in place, but it is unable to prevent or detect and correct misstatements in the financial statements.

·        A control is missing.

Significant deficiency in internal control is a deficiency or several deficiencies that in auditor professional judgment, is of sufficient importance to attract attention of those charged with governance or management.

If the auditor has identified deficiencies in internal control, the auditor determines whether they constitute significant deficiencies. Significant deficiencies in internal control should be communicated in writing to those charged with governance on a timely basis.  Besides of significant deficiencies in internal control the auditor also is required to communicates other deficiencies in internal control identified during the audit that, in the auditor’s professional judgment, are of sufficient importance for management attention.

 Indicators of significant deficiencies in internal control include, for example:

·        Absence of a risk assessment process within the entity where such a process would ordinarily be expected to have been established.

·        Evidence of an ineffective entity risk assessment process, such as management’s failure to identify a risk of material misstatement.

·        Misstatements detected by the auditor’s procedures that were not prevented, or detected and corrected, by the entity’s internal control.

·        Restatement of previously issued financial statements to reflect the correction of a material misstatement due to error or fraud.

 Identified deficiencies in internal control are usually included by an auditor in the special report (sometimes called Management letter), which is separate from the audit report.

Such report may contain following matters:

•  The lists of the deficiencies,  their description, and an explanation of their potential effects.
• Suggestions for remedial action on the deficiencies, management’s actual or proposed responses.
• Explanation by the auditor that:

(i)               The purpose of the audit was for the auditor to express an opinion on the financial statements.

(ii)             The audit included consideration of internal control relevant to the preparation of the financial statements but not for the purpose of expressing an opinion on the effectiveness of internal control; and

(iii)            The matters being reported are limited to those deficiencies that the auditor has identified during the audit.

ISA 265