If the auditor leaves a letter on internal control deficiencies, what should the manager and the accountant do?
The audit is over, and in addition to the report the auditor has also provided a list of deficiencies and recommendations. Does this letter affect the report and how should you respond to it? Short key points and a sample action plan.
When the auditor finishes the work, besides the auditor's report they leave one more document: the internal control deficiencies noticed during the audit and recommendations for fixing them. Many managers put it in a folder without reading it. That is a mistake.
Key points
- This is not the report. The auditor's report is an opinion on the financial statements. The letter on deficiencies, by contrast, points to weak spots in processes.
- The report does not change automatically. The auditor expresses an opinion depending on the materiality of misstatements in the statements. A deficiency in the letter does not by itself make the opinion qualified.
- A deficiency missing from the letter does not mean there is "none". The auditor studies internal control to the extent needed for the audit and does not check it in full.
- Give a written response to each item: do you agree, what action will be taken, who is responsible, by when.
- Set priorities. Deficiencies that directly affect money, goods and payments are fixed first.
- If a deficiency is not fixed, the next audit gets harder. If controls cannot be relied on, the auditor performs more substantive procedures: the sample gets bigger and the work takes longer.
- Prove that it has been done. Before the next audit, prepare evidence for each item: an order, a new procedure, a signed reconciliation sheet.
Example: the "Navro'z Agro" action plan
The auditor's letter had three items. Chief accountant Feruza drew up a response table for each of them and submitted it to the director for signature.
| Deficiency | Risk | Action | Responsible | Deadline |
|---|---|---|---|---|
| A single employee both creates and approves payments in the banking system | Unjustified or fraudulent payment | Creating and approving are split between two employees | Director | 1 month |
| The bank statement is not reconciled with account 5110 month by month | An error or a lost payment is discovered late | A reconciliation sheet is prepared and signed every month | Chief accountant | From next month |
| The storekeeper both receives goods into stock and carries out the count himself | A shortage may stay hidden | An employee independent of the warehouse is added to the count | Deputy director | By the next stocktaking |
Test yourself
5 questions on this topic: pick an option or reveal the answer.
Internal control at "Gulobod sut" is very strong; the auditor performed tests of controls and confirmed that they operated effectively. Under ISA 330, what happens to substantive procedures for material account balances (for example, receivables)?
In the audit of "Zarmitan agro", the auditor could not obtain sufficient evidence on the warehouse balance. The manager gave a written confirmation that "the balance is correct". What is the role of this letter as audit evidence?
The management of "Nurota marmar" did not allow the auditor to send its largest customer a letter confirming the balance owed. Following the logic of ISA 505, what does the auditor do?
Under the IESBA Code of Ethics, which fundamental principle includes the auditor's duty to take steps so that staff working under their authority have appropriate training and supervision?
To verify the balance a customer owes the company, the auditor sends a request to the customer and receives the reply directly. What is this audit procedure called?
Answered: 0 / 50 of 5 correct
All tests →See also
Sources
- Law "On Auditing Activity" (25 February 2021, O'RQ-677), Article 9 · international standards on auditing are applied as the standards of auditing activity
- Example and action plan · compiled by the author