TWSA265 Communication Deficiencies in Internal Control to Those Charged with Governance and Management

Status

Revised by Auditing Standards Committee in Taiwan on 4 October, 2022

Summary

This Standard deals with the auditor's responsibility to communicate appropriately to those charged with governance and management deficiencies in internal control that the auditor has identified in an audit of financial statements.

The auditor is required to obtain an understanding of internal control relevant to the audit when identifying and assessing the risks of material misstatement in order to design audit procedures that are appropriate in the circumstances. The objective of the auditor is to communicate appropriately to those charged with governance and management deficiencies in internal control that the auditor has identified during the audit and that, in the auditor's professional judgment, are of sufficient importance to merit their respective attentions.

Deficiency in internal control exists when a control is designed, implemented or operated in such a way that it is unable to prevent, or detect and correct, misstatements in the financial statements on a timely basis; or a control necessary to prevent, or detect and correct, misstatements in the financial statements on a timely basis is missing. Significant deficiency in internal control means a deficiency or combination of deficiencies in internal control that, in the auditor’s professional judgment, is of sufficient importance to merit the attention of those charged with governance.

The auditor shall determine whether, on the basis of the audit work performed, the auditor has identified one or more deficiencies in internal control. If the auditor has identified one or more deficiencies in internal control, the auditor shall determine, on the basis of the audit work performed, whether, individually or in combination, they constitute significant deficiencies.

The auditor shall communicate in writing significant deficiencies in internal control identified during the audit to those charged with governance on a timely basis.

The auditor shall also communicate to management at an appropriate level of responsibility on a timely basis:

(a) In writing, significant deficiencies in internal control that the auditor has communicated or intends to communicate to those charged with governance, unless it would be inappropriate to communicate directly to management in the circumstances; and

(b) Other deficiencies in internal control identified during the audit that have not been communicated to management by other parties and that, in the auditor's professional judgment, are of sufficient importance to merit management's attention.

The auditor shall include in the written communication of significant deficiencies in internal control:

(a) A description of the deficiencies and an explanation of their potential effects; and

(b) Sufficient information to enable those charged with governance and management to understand the context of the communication.

When the auditor issues a written communication stating that no significant deficiencies in internal control were identified during the audit, the communication should include the definition of significant deficiency and the matters in 2. of paragraph 10.

The auditor should not issue a written communication stating that no deficiencies in internal control were identified during the audit.

Effective date

This Standard is effective from 15 December, 2022.