Communicating with those charged with governance and about control deficiencies: ISA 260 and ISA 265

The auditor’s report goes to the shareholders once a year. But the people who run and oversee the company need to hear from the auditor long before that, and about more than the opinion. They need to know what the auditor plans to do, what was found, what went wrong in the controls and whether the auditor is independent.

In a public company, one body is set up by law to receive this: the audit committee.

This topic covers International Standard on Auditing (ISA) 260, which governs communication with those charged with governance, and ISA 265, which governs communication of control deficiencies, including the management letter. It also covers what the Companies and Allied Matters Act 2020 (CAMA 2020) says about the audit committee and the auditor, because the exam links the two.

November 2025 Question 3 gave a case in which an audit committee ignored warnings from the external auditors and asked what its roles were and what should be reformed. The answer used both the standards and CAMA 2020.

CAMA 2020: the audit committee and the auditor

Start with the law, because it sets the structure that the standards operate in. CAMA 2020 puts the audit provisions in Chapter 15 (Audit), within the part of the Act on financial statements, audit and accounting records. Section 404 is headed Auditors’ report and audit committee.

Notice how the two systems fit. Section 404(7)(b), (c) and (d) give the committee the same subjects that ISA 260 and ISA 265 tell the auditor to communicate: scope and planning, findings on management matters and the effectiveness of internal control. In effect the standards say what the auditor must bring to the committee, and the Act says what the committee must do with it.

ISA 260: communication with those charged with governance

In most countries the auditor communicates with the owners through the report. ISA 260 requires formal communication with those charged with governance as well, to give useful feedback about the audit. In a company these are the board of directors or the audit committee, which is a committee of the board. In your exam it usually means the directors, and in a public company in Nigeria, the audit committee under section 404.

Objectives

1. to communicate the auditor’s responsibilities and give an overview of the planned scope and timing of the audit;
2. to obtain information relevant to the audit;
3. to give timely observations from the audit that are significant to management’s responsibility to oversee the financial reporting process; and
4. to promote effective communication between the auditor and those charged with governance.

As a result the auditor should be satisfied that there is enough documentation of all significant matters in the audit and that they have been brought to the attention of the people in the client who are accountable to its owners.

Matters to be communicated

• The auditor’s responsibilities. That the auditor is responsible for forming and giving an opinion on the statements prepared by management, and that the audit does not relieve management or those charged with governance of their responsibilities.
• The planned scope and timing. An overview.
• Significant findings. These are often called the management letter points. They include the auditor’s views on the entity’s accounting policies, estimates and disclosures, significant difficulties met during the audit, significant matters already discussed with management and written representations requested, and other matters significant to the oversight of financial reporting.
• For listed entities, a written statement that the audit team and firm have complied with relevant ethical requirements on independence, and of all matters relevant to independence, such as relationships and non-audit fees, with the safeguards applied.

The independence statement does not apply if those charged with governance are also involved in managing the entity, because they already know. Material weaknesses in internal control are not among the significant findings of ISA 260, because they are covered by ISA 265.

The process

Communication can be written or oral. It may be a discussion with an appropriate level of management, perhaps with the audit committee in a larger company. Where oral communication would not be adequate, it must be in writing, as a letter or report. If it is oral, the auditor documents what was communicated, to whom and when.

Communication must be timely, and the timing depends on the matter. Planning matters are communicated early. Significant difficulties are communicated as soon as practicable, especially if they are likely to lead to a modified opinion.

When the report is to be modified

ISA 705 and ISA 706 require the auditor to tell those charged with governance of a planned modification, so they understand the reason and can give further information before the report is issued. Other actions to consider are consulting legal counsel, reconsidering management’s integrity and the audit strategy (especially if management limited the scope). Withdrawing if the matter is serious enough and the law allows, after legal advice.

ISA 210 requires an auditor to decline an engagement if management has limited the scope before the audit starts and a disclaimer is expected, unless law requires the auditor to accept it.

ISA 265: communicating deficiencies in internal control

ISA 315 requires the auditor to communicate material weaknesses in internal control found during the audit to management. ISA 265 sets this out.

A deficiency exists where:

1. a control is designed, implemented or operated so that it cannot prevent, or detect and correct, misstatements in the financial statements on a timely basis; or
2. a control that is needed to do so is missing.

A significant deficiency is one that merits the attention of those charged with governance.

The requirements

• Communicate significant deficiencies to those charged with governance in writing on a timely basis.
• Communicate other deficiencies to an appropriate level of management.

The written communication of significant deficiencies includes:

• a description of the deficiencies and an explanation of their potential effects; and
• enough information for those charged with governance and management to understand the context, including that the purpose of the audit was to express an opinion on the statements; that the audit considered internal control to design appropriate procedures and not to express an opinion on its effectiveness; and that the matters reported are limited to deficiencies identified during the audit and considered of sufficient importance to be reported.

The report therefore covers only weaknesses found as a result of the audit work. It is a by-product of a statutory audit and not a full review of systems, so other weaknesses may exist. The auditor will usually state that the communication is for those charged with governance and may not suit other purposes.

The management letter

The management letter, or letter of weakness, has long been seen as an extra service to the client. If management acts on it, controls improve, and future audits can use the more efficient systems-based approach, which may reduce the cost of the audit.

The letter is sent after the results of the tests of control are known, usually after the interim audit, and may be updated after the final audit if more weaknesses are found or earlier ones have not been dealt with.

For each weakness the letter usually gives:

1. The deficiency: the weakness in the present system, in design and in operation.
2. The implication: what could go wrong.
3. The recommendation: how to improve.

The auditor asks management to respond with an action plan for each weakness, and says that the contents will be followed up in future audits.

The rules in more depth

Why the committee needs the auditor’s letters

Section 404(7)(c) and (d) make the committee responsible for reviewing findings on management matters with the external auditor and for keeping the control system under review. It cannot do either without the auditor’s written findings. A committee that does not ask for the management letter, or does not read it, cannot say that it was unaware of the weakness.

Independence of the committee

The committee is meant to be an independent channel between the auditor and management. Members who are shareholders and non-executive directors, who are not paid and who are elected each year, are less dependent on management. Section 406 backs this up by making improper influence on the auditor an offence, and section 407(3) gives the auditor access to records without management’s permission.

The report to the audit committee

Section 404(2) requires a report by the auditor of a public company to the audit committee, but does not prescribe its content. The earlier topic on CAMA 2020 reporting noted that the communications under ISA 260 and ISA 265 can satisfy the requirement, with the form and content agreed in the engagement letter.

Worked example: a committee that did not act

Scenario. Northgate Foods Plc, a listed company, has an audit committee of five non-executive directors. In March the external auditors wrote to the committee chairman about weak documentation of inter-company sales of ₦180 million. Management said the issue was minor and the committee took no action. In July the tax authority challenged the transfer prices, and in September the company restated the previous year, adding a ₦30 million tax liability and penalties.

The committee first heard of the tax dispute from a newspaper.

Step 1: composition. Section 404(3) requires five members, of whom three are shareholders and two are non-executive directors. A committee of five non-executive directors does not comply. Section 404(5) also requires every member to be financially literate and at least one to belong to a professional accounting body in Nigeria. The committee should be checked against both.

Step 2: the failed functions, by subsection. Section 404(7)(c) required the committee to review the auditors’ findings on management matters with the auditors and obtain departmental responses. It took no action on the March letter. Section 404(7)(d) required it to keep the effectiveness of accounting and internal control under review, and the inter-company documentation gap was an internal control failure.

Section 404(7)(a) required it to ascertain whether accounting and reporting policies met legal requirements, and the restatement shows they did not for deferred tax. Section 404(4) required it to examine the auditors’ report and make recommendations to the annual general meeting (AGM).

Step 3: what ISA 260 and ISA 265 required of the auditor. The documentation gap is a deficiency. If significant, it had to be communicated in writing to those charged with governance on a timely basis, with a description and its potential effects. Management’s response should have been requested. The March letter did this. The failure was in what the committee did next.

Step 4: reforms. Restructure the committee to comply with section 404(3) and (5). Hold a private session with the auditors each year without management present. Set an escalation rule so that any regulator allegation of material non-compliance triggers an emergency meeting within 48 hours. Add tax oversight to the committee’s remit. Require a written management response and a tracked action plan for every management letter point. Commission an independent review of the inter-company transactions.

How to score full marks

• Cite the section. Write “s. 404(3) CAMA 2020” next to the point. It shows you know the source, and the Pathfinder solution does the same.
• Check composition first. Five members, three shareholders and two non-executive directors.
• Match each failure to a function. Use s. 404(7)(a) to (f) as your list of roles.
• Give the auditor’s side. ISA 260 matters and the ISA 265 written communication.
• Say what a management letter contains. Deficiency, implication, recommendation and management response.
• Suggest reforms that are specific. A private session, an escalation rule, a tracked action plan.

Common mistakes in the exam

• Giving the composition of the audit committee as all non-executive directors or all shareholders.
• Saying that the audit committee audits the accounts. It oversees and reviews.
• Confusing ISA 260 matters with ISA 265 matters. Control deficiencies belong to ISA 265.
• Forgetting that significant deficiencies must be in writing.
• Quoting a section of CAMA 2004 or the old Act. Use CAMA 2020 numbering.
• Forgetting that the auditor of a public company reports to the committee under s. 404(2).

Quick revision

• ISA 260: responsibilities, scope and timing, significant findings, and independence for listed entities. Written where oral is not adequate.
• ISA 265: deficiency and significant deficiency. Significant ones go in writing to those charged with governance, the rest to management.
• Management letter: deficiency, implication, recommendation, management response.
• CAMA 2020 s. 404(3): five members, three shareholders and two non-executive directors, unpaid, elected annually.
• s. 404(4): examine the auditors’ report and recommend to the AGM. s. 404(7): six functions.
• s. 405: Chief executive officer (CEO) and chief financial officer (CFO) certify internal controls. s. 406: improper influence is an offence. s. 407(3): right of access.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.