All 18 Internal Controls Evaluation questions
More in Internal Controls Evaluation
What is the difference between a deficiency, a significant deficiency, and a material weakness? What are IT general controls (ITGCs) and why do they matter? How does management override of controls create risk, and how do auditors address it? How do you evaluate controls in a system that uses a service organization (SOC reports)?
Advertisement
Auditing & Assurance › Internal Controls Evaluation

What is the auditor's responsibility for reporting internal control deficiencies?

Advanced

Answer

Under ISA 265, the auditor must communicate significant deficiencies in internal control in writing to those charged with governance on a timely basis, and communicate other deficiencies of sufficient importance to management. In ICFR/SOX audits, material weaknesses lead to an adverse opinion on internal control. The auditor doesn't design or fix the controls—that's management's role.
Real-world example The auditor issues a management letter detailing significant control deficiencies and, for a listed client, reports a material weakness.

Common follow-ups: What must be reported in writing? | Does the auditor fix the controls?

Audit Report & Opinions ISA Standards Internal Controls Evaluation
All 18 Internal Controls Evaluation questions