AU-C 265 Communicating Internal Control Related Matters Identified in an Audit
A. Scope: This section addresses the auditor’s responsibility to appropriately communicate to those charged with governance and management, deficiencies in internal control that the auditor has identified in an audit of financial statements.
1. IC deficiencies may be identified during the risk assessment process, but also at any other stage of the audit.
B. Objective: The objective of the auditor is to appropriately communicate, to those charged with governance and management, deficiencies in internal control that the auditor has identified during the audit and that, in the auditor’s professional judgment, are of sufficient importance to merit attention.
1. Deficiency in internal control. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed, or when the person performing the control does not possess the necessary authority or competence to perform the control ...