Management letters and internal control points

A management letter is the auditor’s written report of weaknesses in internal control found during the audit, usually with recommendations and space for management’s response. ISA (UK) 265 requires significant deficiencies to be reported in writing to those charged with governance, and lesser ones that merit attention to be passed to management. The auditor is not giving an opinion on the controls, and the directors decide what to fix, but ignoring points year after year can itself become a significant deficiency.

What is a deficiency in internal control?

ISA (UK) 265 paragraph 6 defines a deficiency in internal control as existing when a control is designed, implemented or operated so that it cannot prevent, or detect and correct, misstatements in the accounts on a timely basis, or when a control needed for that purpose is missing. A significant deficiency is one that, in the auditor’s professional judgement, is important enough to merit the attention of those charged with governance.

The auditor finds these as a by product of the audit. Paragraph 2 explains that the auditor looks at internal control to design audit procedures, not to express an opinion on its effectiveness. That is why management letters always say the list is not exhaustive. Paragraph A29 suggests telling the board that more extensive work might have found more deficiencies.

What decides whether a weakness is significant?

Paragraph A5 says significance depends on how likely a misstatement is and how large it could be, not just whether one has actually happened. A significant deficiency can exist even if the auditor found no errors. Paragraph A6 lists factors including:

• the susceptibility of the related asset or liability to loss or fraud;
• the subjectivity and complexity of estimates such as fair values;
• the amounts and volume of transactions exposed;
• whether the control is important to the reporting process, for example controls over fraud, related party transactions, unusual transactions or non recurring journals at the period end;
• how the deficiency interacts with others.

Paragraph A7 gives indicators that point strongly towards a significant deficiency, such as management fraud of any size that controls did not prevent, misstatements the auditor found that the company’s controls missed, a restatement of prior year accounts, evidence that management cannot oversee preparation of the accounts, and management’s failure to fix significant deficiencies already reported.

For smaller companies, paragraph A3 recognises that a hands on owner may provide effective control, for example by personally approving credit and significant purchases, which can reduce the need for detailed controls. Paragraph A4 balances this against the greater risk of management override where staff are few and segregation of duties is limited.

Who receives the letter and when?

ISA (UK) 265 sets out two lines of reporting:

Type of deficiency	Who is told	Form
Significant deficiency	Those charged with governance (paragraph 9) and management at an appropriate level (paragraph 10(a))	In writing, on a timely basis
Other deficiency that merits management’s attention	Management at an appropriate level (paragraph 10(b))	May be oral (paragraph A23)

Paragraph A19 says the appropriate level for significant deficiencies is likely to be the chief executive or finance director, while other points may go to operational managers with authority to fix them. Paragraph A20 recognises that where a deficiency calls management’s integrity or competence into question, such as suspected fraud by management, it may not be appropriate to report it to management directly.

On timing, paragraph A13 allows the written communication for most private companies to be issued after the audit report, but it forms part of the audit file, which ISA (UK) 230 says should ordinarily be assembled within 60 days of the report date. Paragraph A14 allows the auditor to raise points orally first so they can be fixed quickly, but that does not replace the written report. In a small company where all the directors run the business, ISA (UK) 260 paragraph 13 means points given to them as managers need not be repeated to them in their governance role.

What should the letter contain?

Paragraph 11 requires the written communication of significant deficiencies to include a description of each deficiency and an explanation of its potential effects, together with enough context for the reader. The auditor must explain that the purpose of the audit was to express an opinion on the accounts, that controls were considered only to design audit procedures, and that the points reported are limited to those found and judged important enough to report.

Paragraph A28 says the auditor need not quantify the effects, may group deficiencies together, and may include recommendations, management’s actual or proposed responses and whether the auditor has checked that responses have been implemented. Most UK firms use a table with columns for the finding, the risk, the recommendation, the priority and management’s comment.

How should directors respond?

The decision on what to fix is the board’s. Paragraph A16 states that responsibility for weighing the costs and benefits of remedial action rests with management and those charged with governance, and that the auditor must still report significant deficiencies regardless of cost. A sensible response for each point is to:

1. agree or challenge the facts, since the auditor may have misunderstood a compensating control;
2. decide whether to fix it, accept the risk, or fix it partly, and record the reason;
3. name an owner and a target date;
4. write a short management comment the auditor can include in the letter;
5. check at the next year end that the action was taken.

Accepting a risk is legitimate, but it should be a recorded board decision rather than silence. Paragraph A17 says a significant deficiency reported last year must be reported again if not remedied, and that a failure to act without a rational explanation may itself be a significant deficiency. Under paragraph A24, a lesser point management has chosen not to fix need not be repeated, but persistent failure to act may escalate it to a significant deficiency reported to the board.

Directors should also expect the auditor to ask, under ISA (UK) 580 paragraph A11, for a written confirmation that the directors have told it about all deficiencies they are aware of. That links the management letter to the management representation letter.

What does a typical management letter point look like?

Illustration only. A distribution company with eight finance staff receives three points:

• Supplier bank details. Changes to supplier bank details are made by the same clerk who sets up payment runs, with no independent call back. Risk: payment diversion fraud. Recommendation: second person verifies changes by phoning a known contact. This is reported as significant because of the susceptibility to loss; see preventing payment diversion fraud.
• Control accounts. The purchase ledger was not reconciled to the nominal ledger for four months. Recommendation: monthly reconciliation reviewed by the financial controller, as described in ledger control accounts.
• Journals. Year end journals are posted without review. Recommendation: review and sign off of manual journals above an agreed limit.

The board accepts the first two and implements them within a month. On the third it decides the finance director will review all journals personally because the team is small, and records that in its comment.

Does a management letter affect the audit opinion?

Not directly. The audit opinion is about whether the accounts give a true and fair view, and a company can have weak controls and still receive a clean report if the auditor obtains enough evidence by other means. Control weaknesses usually mean more substantive testing, which can mean a longer and more expensive audit. Where weaknesses are so severe that the auditor cannot obtain sufficient evidence, the opinion is affected under ISA (UK) 705, as explained in audit opinions.

What are the common mistakes?

• Filing the letter without a board discussion, so the same points reappear every year.
• Assuming the absence of a point means a control works. The auditor only reports what it happened to find.
• Sending the auditor’s letter to a lender or buyer as evidence of good controls. Paragraph A29 suggests the letter states it was prepared for those charged with governance and may not suit other purposes.
• Arguing that a point is wrong because no error occurred. Significance depends on likelihood and potential size, not past losses.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Related Accountapedia entries

• Communicating with those charged with governance
• Audit risk assessment under ISA (UK) 315
• Fraud and the auditor: ISA (UK) 240
• Auditing accounting estimates
• Internal audit vs external audit

Sources

• Financial Reporting Council: ISA UK 265 Updated September 2025
• Financial Reporting Council: ISA UK 260 Revised November 2019 Updated September 2025
• Financial Reporting Council: ISA UK 580 Updated September 2025
• Financial Reporting Council: ISA UK 705 Revised June 2016 Updated September 2025

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.