Document ID: chunk:federal_register_of_legislation:F2021C01264:body:0:p12
Version: federal_register_of_legislation:F2021C01264
Segment Type: other
Provision Reference: 
Character Range: 32608–35656

during the audit, in ways, at a level of detail and to parties not envisaged in this Auditing Standard.  For example, significant deficiencies may have to be communicated to the legislature or other governing body.  Law, regulation or other authority may also mandate that public sector auditors report deficiencies in internal control, irrespective of the significance of the potential effects of those deficiencies.  Further, legislation may require public sector auditors to report on broader internal control‑related matters than the deficiencies in internal control required to be communicated by this Auditing Standard, for example, controls related to compliance with legislative authorities, regulations, or provisions of contracts or grant agreements.

Content of Written Communication of Significant Deficiencies in Internal Control (Ref: Para. 11)

A28.         In explaining the potential effects of the significant deficiencies, the auditor need not quantify those effects.  The significant deficiencies may be grouped together for reporting purposes where it is appropriate to do so.  The auditor may also include in the written communication suggestions for remedial action on the deficiencies, management's actual or proposed responses, and a statement as to whether or not the auditor has undertaken any steps to verify whether management's responses have been implemented.

A29.         The auditor may consider it appropriate to include the following information as additional context for the communication:

           * An indication that if the auditor had performed more extensive procedures on internal control, the auditor might have identified more deficiencies to be reported, or concluded that some of the reported deficiencies need not, in fact, have been reported.

           * An indication that such communication has been provided for the purposes of those charged with governance, and that it may not be suitable for other purposes.

A30.         Law or regulation may require the auditor or management to furnish a copy of the auditor's written communication on significant deficiencies to appropriate regulatory authorities.  Where this is the case, the auditor's written communication may identify such regulatory authorities.
[*]  Early adoption, in conjunction with ASA 315 Identifying and Assessing the Risks of Material Misstatement, permitted.
[1]  See ASA 315 Identifying and Assessing the Risks of Material Misstatement, paragraphs 12 and 21.
[2]  See ASA 330 The Auditor's Responses to Assessed Risks.
[3]  See ASA 260 Communication with Those Charged with Governance.
[4]  See ASA 315, paragraph 21.  Appendix 5 provide guidance on controls relevant to the audit.
[5]  See ASA 315, paragraph A175.
[6] See ASA 260, paragraph 13.
[7]  See ASA 230 Audit Documentation, paragraph 14.
[8]  See ASA 230, paragraph A21.
[9] See ASA 250 Consideration of Laws and Regulations in an Audit of a Financial Report, paragraphs 22-28.
[10] See ASA 240 The Auditor's Responsibilities Relating to Fraud in an Audit of