Annual Audit Manual

COPYRIGHT NOTICE — This document is intended for internal use. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (“CPA Canada”). These may not be modified, copied or distributed in any form as this would infringe CPA Canada’s copyright. Reproduced, with permission, from the CPA Canada Handbook, The Chartered Professional Accountants of Canada, Toronto, Canada.

2225 Contents of the communication
Dec-2023

In This Section

Contents of the communication

Contents of the communication

CAS Requirement

The engagement partner shall review, prior to their issuance, formal written communications to management, those charged with governance or regulatory authorities. (CAS 220.34)

The auditor shall include in the written communication of significant deficiencies in internal control (CAS 265.11):

(a) A description of the deficiencies and an explanation of their potential effects

(b) Sufficient information to enable those charged with governance and management to understand the context of the communication. In particular, the auditor shall explain that:

(i) The purpose of the audit was for the auditor to express an opinion on the financial statements

(ii) The audit included consideration of internal control relevant to the preparation of the financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal control

(iii) The matters being reported are limited to those deficiencies that the auditor has identified during the audit and that the auditor has concluded are of sufficient importance to merit being reported to those charged with governance

CAS Guidance

In explaining the potential effects of the significant deficiencies, the auditor need not quantify those effects. The significant deficiencies may be grouped together for reporting purposes where it is appropriate to do so. The auditor may also include in the written communication suggestions for remedial action on the deficiencies, management's actual or proposed responses, and a statement as to whether or not the auditor has undertaken any steps to verify whether management's responses have been implemented (CAS 265.A28).

The auditor may consider it appropriate to include the following information as additional context for the communication (CAS 265.A29):

  • An indication that if the auditor had performed more extensive procedures on internal control, the auditor might have identified more deficiencies to be reported, or concluded that some of the reported deficiencies need not, in fact, have been reported.
  • An indication that such communication has been provided for the purposes of those charged with governance, and that it may not be suitable for other purposes.

Law or regulation may require the auditor or management to furnish a copy of the auditor's written communication on significant deficiencies to appropriate regulatory authorities. Where this is the case, the auditor's written communication may identify such regulatory authorities (CAS 265.A30).

OAG Guidance

Verify that the dialogue, with the Audit Committee or those charged with governance, on our observations and recommendations:

  • allows a discussion of significant deficiencies and management’s plans to remediate them;

  • provides a clear message with respect to the seriousness and scale of issues we have encountered;

  • is helpful to the Audit Committee, or those charged with governance, in developing their view of the organization as a whole, e.g., by drawing out consistent themes, considering root causes, or linking issues to business objectives;

  • provides adequate detail for the Audit Committee or those charged with governance, to understand and follow up on individual issues; and

  • ensures that our overall tone and message on internal controls is consistent with our wider perception of the client

Before issuing the audit report, the engagement leader needs to be satisfied that the findings with respect to internal control, and any other matters that have been or will be presented to management or those charged with governance, taken as a whole, do not appear to contradict or conflict with the opinion to be expressed on the financial statements.

We communicate our audit findings through different means. We usually do it in writing in the Report to the Audit Committee—Annual Audit Results and the Management Letter, or we do it verbally depending on the significance of the finding and the CAS requirements.

Maintain the report issued to the Audit Committee or those charged with governance and management in the audit documentation. Evidence of the engagement leader's review of the formal written communications is included in the audit documentation.