SA 265 requires the auditor, on identifying any deficiency in internal control during the audit, to determine whether it is individually or in combination a significant deficiency, and if so to communicate it in writing to those charged with governance on a timely basis — ordinarily before the audit report is issued, not in a letter that follows weeks later. Deficiencies judged not significant still need to be communicated, but can go to management at an appropriate level and need not be in writing unless the auditor judges it appropriate.
Judging whether a deficiency is significant
- The likelihood that the deficiency will result in material misstatements in the financial statements, now or in the future
- The susceptibility to loss or fraud of the related asset or liability
- The subjectivity and complexity of determining estimated amounts, such as fair value accounting estimates
- The volume of activity that has occurred, or could occur, in the account balance or class of transactions affected
- The importance of the controls to the financial reporting process — e.g. general monitoring controls versus controls over a routine, low-risk account
- The interaction of the deficiency with other deficiencies — several individually minor gaps in the same control objective can combine into a significant one
Regulatory requirement
SA 265 explicitly treats an identified material weakness or the restatement of previously issued financial statements to correct a material misstatement caused by fraud or error, and any indication that oversight of financial reporting and internal control by those charged with governance is ineffective, as indicators of a significant deficiency.
What the written communication must contain
- 01Describe the deficiency and its potential effectsEnough detail for those charged with governance to understand the context — not just "controls over X are weak" but what, specifically, is missing or not operating and what could go wrong as a result.
- 02State that the audit is not designed to identify all deficienciesThe communication has to be clear that the matters communicated are limited to those identified during the audit and are not a comprehensive internal control review.
- 03Position it correctly relative to the audit opinionThe communication is separate from, and does not qualify, the opinion on the financial statements — it should not be worded in a way that implies otherwise.
Common practice, not a requirement
Many firms route less-than-significant deficiencies into a single management letter issued alongside the report. That's a reasonable practice, not a requirement — SA 265 only mandates the written form, and the before-the-report timing, for deficiencies judged significant.
A verbal mention at the closing meeting, with no written record, does not satisfy SA 265 for a significant deficiency even if management acknowledges it on the spot. The standard requires the communication in writing and on the file.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCControl walkthrough documentation: what belongs in the fileWhat a control walkthrough has to establish beyond description, narrative versus flowchart formats, and the shortfalls that recur most often on file inspection.
- Internal audit & IFCBuilding a risk control matrix (RCM) for audit testingHow to structure an RCM so it actually drives testing, map it to financial statement assertions, and stop it from becoming the document nobody updates after the first year.
- Audit workflow & automationSA 315: identifying and assessing the risks of material misstatementA risk assessment that doesn't name a specific assertion isn't a risk assessment under SA 315 — it's a general impression written down.
- Internal audit & IFCIFC testing: internal financial controls over financial reportingHow IFC testing differs from a substantive statutory audit, what design versus operating effectiveness testing actually means in practice, and what the file needs to show for each.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.