Management letters and reporting control deficiencies

An auditor finishes the interim visit and finds that the company's leaver notices are sent by e-mail, with no confirmation that payroll received them. Former employees could be paid for months. The auditor cannot keep this to herself. The company's directors and audit committee need to know about it so that they can fix it, and the auditor needs a record that she told them. The management letter is the document that does this.

This topic covers what a management letter is, the standards behind it (ISA 265 and ISA 260), the layout and contents of a letter, how the auditor decides what to include, to whom it is sent, and how it fits the audit committee's role under the Companies and Allied Matters Act 2020. The previous topics covered the systems and controls the auditor tests, and the next topic starts the substantive procedures.

Key terms in plain English

Syllabus check

This topic is in syllabus area B, the nature and use of internal control (20% of marks). It covers:

• the contents of a management letter
• the evaluation of internal controls
• the limitations of internal control

CAMA 2020 and the management letter

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

What a management letter is

It is common practice for the external auditor to prepare a management letter for the client. A management letter is a report, usually presented in columns, that lists weaknesses the auditor observed in the client's system of internal controls. Remember that identifying weaknesses is a by-product of doing the external audit, not the objective of the audit.

The auditor is not asked to find every weakness, and the absence of a weakness in the letter is not a statement that the controls are good. The letter covers only what the auditor noticed while carrying out the work needed to give an opinion.

The standards behind it

• ISA 265, Communicating Deficiencies in Internal Control to Those Charged with Governance and Management. It requires the auditor to decide whether, on the basis of the work done, one or more deficiencies in internal control have been identified; to decide whether, individually or together, they are significant; and to communicate significant deficiencies in writing, in a timely manner, to those charged with governance. Other deficiencies, which the auditor considers are of enough importance to merit management's attention, are communicated to management, in writing or orally.
• ISA 260 (Revised), Communication with Those Charged with Governance. It deals with the wider communication of audit matters, including the planned scope and timing, significant findings and the auditor's independence. Significant control deficiencies are among the matters to communicate.

The syllabus asks for the contents of a management letter and treats the detailed requirements of ISA 265 as outside its scope, so the exam expects you to know the content and purpose and to be able to write an entry, not to quote the standard.

A deficiency and a significant deficiency

A deficiency exists when a control is designed, implemented or operated so that it cannot prevent, or detect and correct, misstatements on a timely basis, or when a necessary control is missing. A significant deficiency is one, or a combination, that in the auditor's professional judgement is important enough to merit the attention of those charged with governance.

The judgement considers the likelihood and the possible size of a misstatement, the presence of compensating controls, the nature of the account affected, and the possibility of fraud. Examples of matters that point to significance are: evidence of management fraud, ineffective oversight, weak control environment, uncorrected misstatements found by the auditor, and failure by management to correct known deficiencies.

Contents of a management letter

The letter is a formal document, usually on the firm's letterhead and addressed to the board or the audit committee. A good letter has:

• An introduction that states the purpose, says that the matters arise from the audit, and states that the letter does not cover all weaknesses that may exist.
• The weakness described clearly: what was found, where and when.
• The possible consequences: what could go wrong. ISA 265 asks for a description of the deficiencies and an explanation of their potential effects.
• Recommendations: what management should do to correct the weakness.
• Management's response: whether management agrees, what it will do, who is responsible and by when.
• A statement of limitation: that the letter is for the use of management and those charged with governance and is not to be given to third parties without the auditor's consent.
• Follow-up of last year's points: matters raised before that have been corrected or not.

Layout and illustration

Another entry might read: Weakness: the stores supervisor receives goods, records them in the stock ledger and authorises issues. Consequence: stock could be taken or misrecorded without detection. Recommendation: separate receiving from recording, and have a second person approve issues. Response: agreed; a stores clerk will be appointed by the end of the quarter.

Timing and recipients

Significant deficiencies should be communicated in writing on a timely basis, which usually means after the interim audit, so that management can act before the year end, and again after the final audit. A summary letter at the end of the audit covers all the matters.

Letters go to those charged with governance, which in a company is the board and the audit committee, and to the management who can fix the problem. Because the auditor may find matters that involve senior management, the letter should reach the audit committee, which is independent of management.

The audit committee and CAMA 2020

Section 404 of the Companies and Allied Matters Act 2020 sets up an audit committee for a public company. Among its functions in s. 404(7) is to review the findings on management matters, together with the external auditor and the departmental responses, and to keep under review the effectiveness of the company's system of accounting and internal control. The management letter is the document that the committee uses for the first of these.

The committee should discuss each point with the auditor, agree the response and monitor completion.

Good practice for the letter

• Write in plain language and rank points by importance.
• Be factual and precise, with examples, and avoid accusations.
• Make recommendations practical and cost-effective, since controls must be worth their cost.
• Discuss draft points with management first, so that errors of fact are removed.
• Keep a copy on the audit file as evidence that the communication was made.
• Do not give an opinion on the controls as a whole, because the audit is not designed to give one.

Link to the rest of the audit

The letter comes from the evaluation of controls and the tests of controls, so every weakness in the earlier topics is a candidate for the letter. When a weakness is serious, the auditor also changes the audit approach and does more substantive testing. The letter does not replace that work.

If management ignores a serious weakness that could lead to material misstatement, the auditor considers whether the effect on the financial statements needs a modified opinion, as is explained in the topic on modified opinions.

Worked examples

1. Weakness: no restriction or approval of price changes.
2. Consequence: goods may be sold below price, or favoured customers charged less, so revenue is understated.
3. Recommendation: restrict price changes to an authorised person and review a report of changes each week.
4. Management response: to be agreed and dated.

1. This is a significant deficiency: it involves management override and a possible fraud and conflict of interest.
2. It goes in writing to the audit committee and not only to management, and the auditor considers further action.

1. It is not significant.
2. It may be raised orally with management, or in the letter under minor points.

1. The letter repeats the point and says that it has not been corrected.
2. The auditor considers whether the continuing weakness needs more substantive testing of cash.

How to score full marks

• Define the letter and say that weaknesses are a by-product of the audit.
• List its contents: weakness, consequence, recommendation, response.
• Name ISA 265 and the audit committee.
• Write a sample entry if asked for one, using the four columns.

Common mistakes in the exam

• Saying the letter gives an opinion on the controls.
• Leaving out the consequences or the recommendation.
• Sending it only to management when the matter is serious.
• Treating a management letter as the audit report.

Quick revision

• Columns: weakness, consequence, recommendation, response.
• Significant deficiencies in writing to those charged with governance.
• By-product of the audit; not complete.
• Audit committee reviews management findings (s. 404(7)(c)).

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.