The Management Letter After an Audit

How the letter differs from the auditor's report

• The auditor's report is a document containing the audit firm's written opinion on the reliability of the financial statements and their compliance with accounting legislation; its form and content are set by auditing standards (ZRU-677, Article 39).
• The management letter contains no opinion on the statements. The purpose of the audit is to express an opinion on the financial statements, not on the effectiveness of internal control, and the auditor says so in the letter (ISA 265, para. 11).
• The report accompanies the financial statements and reaches their users; the letter is addressed to those charged with governance and management. The auditor may state that it was prepared for their purposes and may not be suitable for others (para. A29).
• A modified opinion does not necessarily mean a long letter, and vice versa: serious control deficiencies can be found alongside an unmodified opinion.

Deficiency versus significant deficiency

A deficiency in internal control exists when a control is designed, implemented or operated in such a way that it cannot prevent, or detect and correct, misstatements on a timely basis, or when a control needed for that is missing (ISA 265, para. 6(a)). A significant deficiency is a deficiency or combination of deficiencies that, in the auditor's professional judgement, is important enough to merit the attention of those charged with governance (para. 6(b)).

Significance depends not only on whether a misstatement has occurred but also on its likelihood and potential size, so significant deficiencies may exist even if the auditor found no misstatements (para. A5).

• the likelihood that the deficiencies will lead to material misstatements in future;
• the susceptibility of the related asset or liability to loss or fraud;
• the subjectivity and complexity of estimates such as fair value;
• the importance of the control: oversight of management, fraud prevention, selection of accounting policies, significant related party and unusual transactions, the period-end close (para. A6);
• indicators of a weak control environment: management fraud not prevented by controls, or failure to act on significant deficiencies reported earlier (para. A7).

To whom and in what form the auditor reports

• Significant deficiencies: in writing and on a timely basis to those charged with governance (owners, supervisory board) (para. 9).
• Management at an appropriate level: the same significant deficiencies in writing where appropriate, plus other deficiencies that merit management's attention and have not been reported by others (para. 10).
• For significant deficiencies the appropriate level is usually the chief executive or chief financial officer; for others, the operational managers responsible for the area (para. A19).
• Other deficiencies may be communicated orally, including when findings are discussed with management (para. A23).
• Where deficiencies call management's own integrity or competence into question, communicating them directly to management may not be appropriate (para. A20).

What the letter contains

In the written communication of significant deficiencies the auditor describes the deficiencies and explains their potential effects, and gives context: the audit was performed to express an opinion on the statements, internal control was considered to design procedures rather than to assess its effectiveness, and only deficiencies identified during the audit and judged important enough are reported (para. 11).

Effects need not be quantified, and deficiencies may be grouped. The auditor may include suggestions for remedial action, management's actual or proposed responses, and whether the auditor has checked their implementation (para. A28). The level of detail depends on the nature and size of the entity, the composition of its governing bodies and regulatory requirements (para. A15).

• Typical structure: short introduction and caveats → significant deficiencies (description, risk, recommendation) → other observations → management responses with owners and deadlines.
• Typical topics for Uzbek companies: no segregation of duties over cash and bank, no regular reconciliations with counterparties, manual period-end adjustments without approval, overdue receivables without analysis, an accounting policy that is not formalised.

Timing

The standard requires timely communication (paras. 9, 10). In choosing the timing the auditor considers whether the letter matters for governing bodies to discharge their oversight duties; some companies receive it before the statements are approved, for others it may be issued later (para. A13). But the letter forms part of the final audit file, whose assembly is ordinarily completed not more than 60 days after the date of the auditor's report (para. A13, referring to ISA 230).

The auditor may first discuss significant deficiencies orally so the company can start fixing them sooner, but this does not remove the duty to report them in writing (para. A14).

What the company should do

By law the audited entity must review information on violations identified during the audit and, no later than thirty days after receiving it, inform the audit firm in writing of the results, and must remedy identified violations in bookkeeping, financial reporting and the calculation of taxes and fees (ZRU-677, Article 37). At the same time the company is entitled to advice from the auditor on how to correct the deficiencies and violations found.

• Assign an owner and a deadline to each point and include them in the written response.
• Deciding not to fix a deficiency for cost reasons is the right of management and those charged with governance, but the auditor's duty to report a significant deficiency does not depend on it (para. A16).
• An unremedied significant deficiency will be reported again next year, and failure to act without a rational explanation may itself be a significant deficiency (para. A17).
• Use the letter as a work plan for accounting and internal audit for the following year.