What challenges do you face in complying with AU-C 265?

• Understanding the new requirements to communicate other deficiencies in internal control to management.
• Evaluating the severity of identified internal control deficiencies to determine if they must be communicated to those charged with governance and/or management.
• Combining identified deficiencies affecting the same account balance or disclosure, relevant assertion, or component of internal control to determine whether they are material weaknesses or significant deficiencies.
• Writing clearly worded comments related to material weaknesses or significant deficiencies identified during the audit, including a description of the potential effects of those matters as required by AU-C 265.

AU-C 265, Communicating Internal Control Related Matters Identified in an Audit, establishes standards for making internal control communications to your clients, and PPC’s Guide to Internal Control Communications helps you implement those standards when communicating internal control deficiencies identified during the audit. Specifically, the new Guide provides:

• Hundreds of illustrative communication examples covering the internal control deficiencies you are likely to encounter in your audit engagements.
• Comments categorized by audit area to help you find just the right one.
• An index of comments to help you identify potential internal control comments during your audit.
• Guidance on evaluating the severity of those deficiencies to determine whether they are control deficiencies, significant deficiencies, or material weaknesses.
• Guidance on aggregating the deficiencies to see if they rise to the level of something you must communicate.
• Practice aids to help with evaluation and aggregation.
• Guidance on the form of the required communication report, not just the comments that are included.
• Help with specified issues, such as whether preparing financial statements for your clients always results in a material weakness or a significant deficiency, which must be communicated to your client.
• Two case studies designed to illustrate how auditors might (a) evaluate the severity of internal control deficiencies identified during an audit; (b) document their evaluation in the workpapers; and (c) communicate the identified control deficiencies to management and others charged with governance in accordance with AU-C 265. The case studies include background information on two hypothetical manufacturing clients, along with the illustrative PPC practice aids the auditors completed when performing their evaluation.