Document ID: chunk:federal_register_of_legislation:F2021C01264:body:0:p10
Version: federal_register_of_legislation:F2021C01264
Segment Type: other
Provision Reference: 
Character Range: 26879–30076

those charged with governance and management in a previous audit does not eliminate the need for the auditor to repeat the communication if remedial action has not yet been taken.  If a previously communicated significant deficiency remains, the current year's communication may repeat the description from the previous communication, or simply reference the previous communication.  The auditor may ask management or, where appropriate, those charged with governance, why the significant deficiency has not yet been remedied.  A failure to act, in the absence of a rational explanation, may in itself represent a significant deficiency.

Considerations Specific to Smaller Entities

A18.         In the case of audits of smaller entities, the auditor may communicate in a less structured manner with those charged with governance than in the case of larger entities.

Communication of Deficiencies in Internal Control to Management (Ref: Para. 10)

A19.         Ordinarily, the appropriate level of management is the one that has responsibility and authority to evaluate the deficiencies in internal control and to take the necessary remedial action.  For significant deficiencies, the appropriate level is likely to be the chief executive officer or chief financial officer (or equivalent) as these matters are also required to be communicated to those charged with governance.  For other deficiencies in internal control, the appropriate level may be operational management with more direct involvement in the control areas affected and with the authority to take appropriate remedial action.

Communication of Significant Deficiencies in Internal Control to Management (Ref: Para. 10(a))

A20.         Certain identified significant deficiencies in internal control may call into question the integrity or competence of management.  For example, there may be evidence of fraud or intentional non‑compliance with laws and regulations by management, or management may exhibit an inability to oversee the preparation of an adequate financial report that may raise doubt about management's competence.  Accordingly, it may not be appropriate to communicate such deficiencies directly to management.

A21.         ASA 250 establishes requirements and provides guidance on the reporting of identified or suspected non‑compliance with laws and regulations, including when those charged with governance are themselves involved in such non‑compliance.[9]  ASA 240 establishes requirements and provides guidance regarding communication to those charged with governance when the auditor has identified fraud or suspected fraud involving management.[10]

Communication of Other Deficiencies in Internal Control to Management (Ref: Para. 10(b))

A22.         During the audit, the auditor may identify other deficiencies in internal control that are not significant deficiencies but that may be of sufficient importance to merit management's attention.  The determination as to which other deficiencies in internal control merit management's attention is a matter of professional judgement in the circumstances, taking into account the likelihood and potential magnitude of misstatements that may arise in