Integrated Audit Reporting: How to Communicate Control Weaknesses Right
Overview: Communicating deficiencies and reporting results is crucial in an integrated audit. This guide breaks down who gets notified, what goes in your report, and how to handle adverse or disclaimer opinions.
✅ What Must Be Communicated?
- Significant Deficiencies & Material Weaknesses: Both must be communicated in writing to management and governance (nonissuers) or the audit committee (issuers).
- All Deficiencies: Even lesser deficiencies must be reported in writing to management.
- Previously reported but uncorrected deficiencies may be referenced by date, no need to repeat detail.
✅ Timing Rules
- Nonissuers: Written communication for significant deficiencies/material weaknesses is due by the report release date; all other deficiencies no later than 60 days after.
- Issuers: Must communicate material weaknesses before issuing the ICFR report. Significant deficiencies also go to the audit committee.
✅ Sample Wording for Nonissuers
Auditors include:
- Definitions of deficiencies, significant deficiencies, and material weaknesses.
- Details of each identified issue and its potential effects.
- Disclaimers: Do not say “no weaknesses exist” if you found none — simply omit that language.
✅ Separate vs. Combined Reports
- Auditors may issue separate reports for FS and ICFR or a combined report.
- If separate, each must reference the other with the opinion type.
✅ Adverse Opinion
- A material weakness = adverse opinion on ICFR.
- Include a clear “Basis for Adverse Opinion” section defining material weakness and its impact.
✅ Disclaimer of Opinion (Scope Limitation)
- If unable to get sufficient evidence (scope restriction), issue a disclaimer.
- Remove the scope paragraph and explain why evidence was insufficient.
✅ Using Component Auditors
Decide whether to refer to other auditors in the ICFR report separately from the FS report. It may differ from your FS approach.
✅ Key Reporting Reminders
- Sample language varies for issuers (PCAOB standards) and nonissuers (AICPA standards).
- Always coordinate the date of the ICFR report to match the FS report date.
- Subsequent events: If you learn of new conditions before report date, adjust as needed.
🔗 Helpful References
👉 Communicate issues clearly, report with confidence — and stay compliant every time!
