When a significant deficiency is identified, it must be communicated to management, the audit committee, and the external auditors. It is typically documented in internal control reports and disclosed in the company's annual filings.