ISA 265 Communicating Deficiencies in Internal Control

ISA 265 Communicating Deficiencies in Internal Control to Those Charged with Governance and Management is the international auditing standard that governs how auditors report weaknesses in a company's internal controls to the people who can do something about them. In the course of an audit, auditors often spot control problems — and ISA 265 sets out their responsibility to communicate them. This practical guide explains what ISA 265 covers, what a deficiency in internal control is, what must be communicated and to whom, and why it matters — in plain language. It's a core auditing topic, relevant to ACCA study. (Always refer to the standard for authoritative requirements.)

What is ISA 265?

ISA 265 deals with the auditor's responsibility to communicate appropriately to those charged with governance and management the deficiencies in internal control that the auditor has identified during the audit. The auditor obtains an understanding of internal control as part of assessing the risks of material misstatement — and in doing so may identify weaknesses. ISA 265 governs what the auditor does with those findings. Importantly, the auditor is not required to search specifically for control deficiencies; ISA 265 applies to those identified in the normal course of the audit.

What is a deficiency in internal control?

A deficiency in internal control exists when either a control is designed, implemented or operated in such a way that it is unable to prevent, or detect and correct, misstatements on a timely basis; or a control that is necessary is missing altogether. In short, it's a weakness that leaves the financial statements exposed to misstatement that the control system should have caught. For example, if no one independent reviews and approves journal entries before they are posted, that missing control is a deficiency — because errors or manipulation could pass through unchecked.

Significant deficiencies

ISA 265 draws a crucial distinction based on seriousness. A significant deficiency is one that, in the auditor's professional judgement, is important enough to merit the attention of those charged with governance. Whether a deficiency is "significant" depends on factors such as the likelihood and potential magnitude of misstatement it could lead to, the importance of the control, and the susceptibility of the related balances to fraud. This distinction matters because it determines who the deficiency must be communicated to, and how formally.

What must be communicated, and to whom

ISA 265 sets out a tiered communication requirement:

• Significant deficiencies must be communicated in writing to those charged with governance on a timely basis. The written communication includes a description of the deficiencies and their potential effects, and sufficient information to enable governance to understand the context.
• Other deficiencies — those not significant enough to report to governance but still of sufficient importance to merit management's attention — are communicated to an appropriate level of management, and this can be done orally.

The communication makes clear that its purpose is the audit of the financial statements, and that the auditor's review of controls was not designed to identify all deficiencies that might exist.

Why ISA 265 matters

ISA 265 matters because internal control weaknesses can expose a business to misstatement, error and fraud — and management and those charged with governance need to know about them so they can act. The audit, through its understanding of controls, is well placed to surface these issues, and ISA 265 ensures that valuable insight is communicated rather than lost. It adds real value to the entity beyond the audit opinion itself, helping the business strengthen its controls. For auditors, understanding what counts as a significant deficiency and the corresponding communication requirements is a key, regularly-examined area of the audit.

What ISA 265 requires

ISA 265 deals with the auditor's responsibility to communicate deficiencies in internal control identified during the audit to those charged with governance and management. It requires the auditor to determine whether identified deficiencies, individually or together, are "significant", and to communicate significant deficiencies in writing on a timely basis. The aim is to help the organisation improve its controls — though the auditor's review of controls is for the purpose of the audit, not a comprehensive assessment. See the current standard for the detailed requirements.

Frequently asked questions

What is ISA 265?

The international auditing standard on communicating deficiencies in internal control to those charged with governance and management — covering control weaknesses identified during the audit.

What is a deficiency in internal control?

A control that is designed, implemented or operated so that it cannot prevent or detect and correct misstatements on a timely basis — or a necessary control that is missing altogether, leaving the figures exposed.

What is a significant deficiency?

A deficiency, or combination of deficiencies, that in the auditor's professional judgement is important enough to merit the attention of those charged with governance, based on the risk it creates.

How must deficiencies be communicated?

Significant deficiencies must be communicated in writing to those charged with governance on a timely basis. Other deficiencies of sufficient importance are communicated to an appropriate level of management, which can be done orally.

Build your auditing skills with Learnsignal

Standards like ISA 265 are central to auditing. Learnsignal's tutor-led ACCA courses develop the audit knowledge the ISAs require — with clear teaching and exam-focused practice. (Always refer to the latest text of the standard for authoritative requirements.)