HKSA 265 - Communicating Deficiencies in Internal Control (Condensed)
| Section Name | Key Concept | Brief Description |
|---|---|---|
| Introduction and Scope | Auditor's responsibility | Communicate deficiencies in internal control identified during financial statement audit; no opinion on effectiveness required. |
| Definitions | Deficiency vs. Significant Deficiency | Deficiency: control unable to prevent/detect/correct misstatements or missing. Significant: merits attention of those charged with governance. |
| Determination of Deficiencies | Identification and discussion | Auditor determines if deficiencies exist; may discuss with management; considers entity size. |
| Determination of Significant Deficiencies | Factors and indicators | Based on likelihood and magnitude of misstatement; includes control environment and other red flags. |
| Communication to Those Charged with Governance | Written, timely | Significant deficiencies must be communicated in writing; timing depends on entity; repeat if unresolved. |
| Communication to Management | Written or oral | Significant deficiencies in writing; other deficiencies orally or in writing; appropriate level of management. |
| Content of Written Communication | Description and context | Must include description, potential effects, and explanation of audit purpose and limitations. |
Introduction and Scope
Purpose
HKSA 265 deals with the auditor's responsibility to communicate appropriately to those charged with governance and management deficiencies in internal control identified in an audit of financial statements.
Key Scope Limitations
Important: This HKSA does NOT impose additional responsibilities on the auditor regarding obtaining an understanding of internal control beyond HKSA 315 (Revised 2019) and HKSA 330.
- HKSA 260 (Revised) establishes further requirements regarding communication with those charged with governance.
- The auditor considers internal control to design audit procedures, NOT for expressing an opinion on effectiveness.
- Control deficiencies may be identified during risk assessment or any other stage of the audit.
Note: Nothing in this HKSA precludes the auditor from communicating other internal control matters identified during the audit.
Effective Date
Effective for audits of financial statements for periods beginning on or after 15 December 2009.
Definitions
Deficiency in Internal Control
Exists when:
- A control is designed, implemented or operated in such a way that it is unable to prevent, or detect and correct, misstatements in the financial statements on a timely basis; OR
- A control necessary to prevent, or detect and correct, misstatements in the financial statements on a timely basis is missing.
Significant Deficiency in Internal Control
A deficiency or combination of deficiencies in internal control that, in the auditor's professional judgment, is of sufficient importance to merit the attention of those charged with governance.
Key Distinction: A deficiency is any control flaw; a significant deficiency is one important enough to report to governance.
Determination of Deficiencies
Requirement
The auditor shall determine whether, on the basis of the audit work performed, one or more deficiencies in internal control have been identified.
Discussion with Management (A1)
- May discuss relevant facts and circumstances with appropriate level of management.
- Appropriate level: familiar with control area and has authority to take remedial action.
- May NOT be appropriate if findings call management's integrity or competence into question.
Information from Discussions (A2)
| Type | Description |
|---|---|
| Causes | Management's understanding of actual or suspected causes of deficiencies |
| Exceptions | Exceptions arising from deficiencies (e.g., misstatements not prevented by IT controls) |
| Response | Preliminary indication of management's response to findings |
Smaller Entity Considerations (A3-A4)
- Concepts similar to larger entities, but formality varies.
- Management-applied controls (e.g., sole authority for credit) may make certain controls unnecessary.
- Fewer employees may limit segregation of duties.
- Owner-manager may exercise more effective oversight, but risk of management override is higher.
Determination of Significant Deficiencies
Requirement
If deficiencies are identified, the auditor shall determine whether, individually or in combination, they constitute significant deficiencies.
Factors in Determining Significance (A5-A6)
Significance depends on:
- Whether a misstatement has actually occurred
- The likelihood that a misstatement could occur
- The potential magnitude of the misstatement
| Factor | Description |
|---|---|
| Likelihood of future material misstatements | Probability that deficiencies will lead to material misstatements |
| Susceptibility to loss or fraud | Vulnerability of related asset or liability |
| Subjectivity and complexity | Determining estimated amounts (e.g., fair value) |
| Financial statement amounts exposed | Magnitude of amounts affected |
| Volume of activity | Account balance or class of transactions exposed |
| Importance of controls to financial reporting | General monitoring, fraud prevention, accounting policies, related party transactions, period-end reporting |
| Cause and frequency of exceptions | Detected as a result of deficiencies |
| Interaction with other deficiencies | Combined effect of multiple deficiencies |
Indicators of Significant Deficiencies (A7)
Control Environment Indicators:
- Significant transactions where management is financially interested not appropriately scrutinized by governance
- Management fraud (whether or not material) not prevented by internal control
- Management's failure to implement remedial action on previously communicated significant deficiencies
Other Indicators:
- Absence of a risk assessment process where one would ordinarily be expected
- Ineffective entity risk assessment process
- Ineffective response to identified significant risks
- Misstatements detected by auditor that were not prevented or detected by internal control
- Restatement of previously issued financial statements
- Management's inability to oversee preparation of financial statements
Combination of Deficiencies (A8)
A single deficiency may not be significant, but a combination affecting the same account balance, disclosure, assertion, or component of internal control may increase risks to constitute a significant deficiency.
Communication to Those Charged with Governance
Requirement
The auditor shall communicate in writing significant deficiencies in internal control identified during the audit to those charged with governance on a timely basis.
Timing Considerations (A13)
- Consider whether receipt would enable governance to discharge oversight responsibilities.
- For listed entities, may be needed before date of approval of financial statements.
- For other entities, written communication may be issued at a later date.
- Written communication is part of the final audit file; assembly should ordinarily be completed within 60 days after the date of the auditor's report.
Oral Communication (A14)
Regardless of timing of written communication, the auditor may communicate orally in the first instance to assist in taking timely remedial action. This does NOT relieve the auditor of the responsibility to communicate in writing.
Level of Detail (A15)
| Factor | Consideration |
|---|---|
| Nature of entity | Public interest vs. non-public interest |
| Size and complexity | Larger entities may require more detail |
| Nature of deficiencies | Complex deficiencies need more explanation |
| Governance composition | Experience of members |
| Legal/regulatory requirements | May prescribe minimum content |
Repeat Communication (A17)
Mandatory: If a significant deficiency was communicated in a previous audit and remedial action has not been taken, the auditor must repeat the communication. Failure to act without rational explanation may itself represent a significant deficiency.
Communication to Management
Requirement
The auditor shall communicate to management at an appropriate level of responsibility on a timely basis:
- In writing: Significant deficiencies communicated or intended to be communicated to those charged with governance, unless it would be inappropriate to communicate directly to management.
- Other deficiencies: Identified during the audit that have not been communicated by other parties and that merit management's attention.
Appropriate Level of Management (A19)
| Type of Deficiency | Appropriate Level |
|---|---|
| Significant deficiencies | CEO or CFO (or equivalent) |
| Other deficiencies | Operational management with direct involvement in affected control areas |
Inappropriate Communication to Management (A20-A21)
Certain deficiencies may call into question management's integrity or competence, e.g., evidence of fraud or intentional non-compliance by management, or management's inability to oversee preparation of adequate financial statements. In such cases, direct communication to management may be inappropriate.
Other Deficiencies Communication (A22-A26)
- Determination of which other deficiencies merit management's attention is a matter of professional judgment.
- Communication need NOT be in writing (may be oral).
- If discussed with management, oral communication may be considered made at that time.
- No need to repeat from prior period if management chose not to remedy.
- No need to repeat if previously communicated by other parties (internal audit, regulators).
- May re-communicate if there has been a change of management or new information.
- Failure to remedy previously communicated other deficiencies may become a significant deficiency.
Content of Written Communication
Required Elements
The written communication of significant deficiencies shall include:
- Description and Explanation: A description of the deficiencies and an explanation of their potential effects.
- Contextual Information: Sufficient information to enable those charged with governance and management to understand the context. The auditor shall explain that:
- The purpose of the audit was to express an opinion on the financial statements.
- The audit included consideration of internal control relevant to the preparation of the financial statements in order to design audit procedures, but not for the purpose of expressing an opinion on the effectiveness of internal control.
- The matters being reported are limited to those deficiencies identified during the audit that the auditor has concluded are of sufficient importance to merit being reported.
Content Details (A28)
| Element | Guidance |
|---|---|
| Quantification | Need not quantify potential effects |
| Grouping | Significant deficiencies may be grouped together for reporting |
| Suggestions | May include suggestions for remedial action |
| Management responses | May include management's actual or proposed responses |
| Verification | May include statement as to whether auditor has verified implementation of management's responses |
Additional Context (A29)
The auditor may indicate that more extensive procedures might have identified more deficiencies, and that the communication is for purposes of those charged with governance and may not be suitable for other purposes.
Regulatory Authorities (A30)
Law or regulation may require furnishing a copy to regulatory authorities. The written communication may identify such regulatory authorities.
Public Sector Considerations
Additional Responsibilities
Public sector auditors may have additional responsibilities:
- Communicate deficiencies in ways, at a level of detail, and to parties not envisaged in this HKSA.
- Significant deficiencies may need to be communicated to the legislature or other governing body.
- Law, regulation, or other authority may mandate reporting regardless of significance.
- Legislation may require reporting on broader internal control-related matters (e.g., compliance with legislative authorities, regulations, contracts, or grant agreements).
Conformity and Compliance
As of March 2023, this HKSA conforms with ISA 265. Compliance with the requirements of this HKSA ensures compliance with ISA 265.
โ Ready to Test?
50 MCQs โข 1.25 min each โข 62.5 min total
๐ Start Q&A โ๐ Full Reference Version๐จ๏ธ Save as PDF