ISA 265 communicating deficiencies in internal control to those charged with governance and management, and places the responsibility to the auditors to communicate in writing deficiencies in internal control, particularly significant deficiencies, to those charged with governance.
Deficiency in internal control occurs when the designated internal control which has been implemented by those charged with governance to prevent, detect or correct, misstatement in the financial statement is either not working or is missing
A significant deficiency in internal control is those deficiencies in the internal control which the auditor thinks to merit the attention of those charged with governance.
The following are matters which auditor will consider when deciding on whether the deficiency is significant or not:
- The likelihood of the deficiencies leading to material misstatement;
- The subjectivity and complexity of determining estimated amounts;
- The financial statement amount exposed to deficiencies;
- The interaction of the deficiencies with other deficiencies in the internal control;
- The cause and frequency of the exceptions detected as the result of the deficiencies in the controls;
- The importance of the controls to the financial reporting process;
- The volume of activity that has occurred or could occur in the account balance or class of transactions exposed to deficiencies or deficiencies;
- The susceptibility to loss or fraud of the related asset or liability.