International Auditing and Assurance Standards Board Communicating Deficiencies in Internal Control to Those Charged with Governance and Management ISA Implementation Support Module Prepared by IAASB Staff October 2009

Introduction New Terms and Definitions Communicating Significant Deficiencies Determining Significance of a Deficiency Communication of Deficiencies to Management Overview 2

The context for developing the standard All requirements and guidance relating to communication of material weaknesses in the old standards now in one place New standard provides enhanced guidance on –Judging when an identified deficiency in internal control is significant –Communicating significant deficiencies to TCWG Introduction 3

Term “material weakness” no longer used in the ISAs Standard introduces two new terms – A deficiency in internal control – A significant deficiency No longer a requirement to communicate material weaknesses in the ISAs, but a requirement to communicate significant deficiencies New Terms and Definitions 4

This exists when – A control is designed, implemented, or operated in such a way that it is unable to prevent, or detect and correct, misstatements in the financial statements on a timely basis, or – A control necessary to prevent, or detect and correct, misstatements in the financial statements on a timely basis is missing Deficiency in Internal Control New Terms and Definitions 5

Defined as – A deficiency or combination of deficiencies in internal control that, in the auditor’s professional judgment, is of sufficient importance to merit the attention of those charged with governance Significant Deficiency New Terms and Definitions 6

IAASB does not intend that further work be performed beyond practice of communicating material weaknesses under old standards Significant deficiency regarded as being at the same level of significance as material weakness under old standards No expectation that new standard should result in reporting of more matters than would have been the case with material weaknesses under old standards Implications of New Terms and Definitions New Terms and Definitions 7

Communicate significant deficiencies in writing to TCWG on timely basis Also communicate significant deficiencies in writing to management on timely basis, unless inappropriate to do so in the circumstances Requirement to communicate applies regardless of cost or other considerations by TCWG or management in determining whether to take remedial action Requirement also applies if significant deficiencies have been communicated in prior audit but no remedial action has been taken Communicating Significant Deficiencies 8

A description of the significant deficiencies An explanation of their potential effects Sufficient information to enable TCWG to understand context of communication – Purpose of audit – Audit does not include expression of opinion on effectiveness of internal control – Significant deficiencies reported limited to those identified during the audit Content of written communication Communicating Significant Deficiencies 9

Some jurisdictions may have a legal or regulatory requirement for auditor to communicate material weaknesses to TCWG – Standard does not directly address such a requirement However, if “material weakness” has not been defined in law or regulation, standard provides guidance to explain how interpretation of such a requirement might be made in context of the standard Communication of Material Weaknesses in Law or Regulation Communicating Significant Deficiencies 10

A matter of the auditor’s professional judgment – Based on what auditor believes is of sufficient importance to merit attention by TCWG Judgment needs to be made having regard to roles and responsibilities of TCWG, informed by auditor’s understanding of the entity and its environment, including its internal control Determining Significance of a Deficiency 11

Auditor’s determination necessarily a subjective exercise because it rests on professional judgment However, standard provides new guidance to assist auditor in making that judgment In particular, the significance of a deficiency depends on two factors – The likelihood that a misstatement could occur – The potential magnitude of the misstatement Guidance in Determining Significance Determining Significance of a Deficiency 12

Standard also provides guidance on – Relevant considerations, e.g.,   Susceptibility to loss or fraud of the related asset or liability   Subjectivity and complexity of determining accounting estimates   Financial statement amounts exposed to the deficiencies –Indicators of the existence of significant deficiencies, e.g.,   Evidence of ineffective aspects of the control environment Guidance in Determining Significance Determining Significance of a Deficiency 13

Governance structures will be simpler and less formal in SMEs relative to larger entities Therefore, less of a need for formality in the communication of significant deficiencies in SME context However, communication of significant deficiencies will need to be in writing SME Considerations Determining Significance of a Deficiency 14

Communicate identified deficiencies other than significant deficiencies to management if auditor believes that they merit management’s attention – These other deficiencies may be of importance to management in effectively discharging their internal control responsibilities Use of professional judgment essential in making this determination – No elaborate evaluation or communication process intended Communication of Deficiencies to Management 15

However, no requirement to re-communicate other deficiencies previously communicated to management by – The auditor – Other parties Also no requirement to communicate other deficiencies to management in writing – In most cases, this communication will take place when auditor discusses relevant facts and circumstances of the matter with management Communication of Deficiencies to Management 16

Note This set of support slides does not amend or override the ISAs, the texts of which alone are authoritative. Reading the slides is not a substitute for reading the ISAs. The slides are not meant to be exhaustive and reference to the ISAs themselves should always be made. In conducting an audit in accordance with ISAs, the auditor is required to comply with all the ISAs that are relevant to the engagement. 17

Copyright © October 2009 by the International Federation of Accountants (IFAC). All rights reserved. Permission is granted to make copies of this work provided that such copies are for use in academic classrooms or for personal use and are not sold or disseminated and provided that each copy bears the following credit line: “Copyright © October 2009 by the International Federation of Accountants (IFAC). All rights reserved. Used with permission of IFAC. Contact for permission to reproduce, store, or transmit this work.” Otherwise, written permission from IFAC is required to reproduce, store, or transmit, or to make other similar uses of, this work, except as permitted by law. Contact International Federation of Accountants ISBN: