SA 265, Communicating Deficiencies in Internal Control to Those Charged with Governance and Management: deficiency vs significant deficiency, what must be communicated in writing, to whom and when

SA 265 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.

SA 265 tells an auditor which weaknesses in internal control found during the audit must be reported, in what form, to whom and by when. The auditor does not test controls for this purpose: the standard deals only with what to do with weaknesses that come to light.

SA 265, as effective for audits of financial statements for periods beginning on or after 1 April 2010, applies to every audit of financial statements. ICAI may revise standards, so check icai.org for the current text.

A deficiency exists when a control cannot prevent, or detect and correct, misstatements on time, or when a needed control is missing. If a deficiency, or a combination, is important enough to merit the attention of those charged with governance, it is a significant deficiency and must be communicated in writing, on a timely basis, to those charged with governance and to management. Other deficiencies worth management's attention are also reported. The letter must explain its context and limits.

Scope (paragraphs 1-3)

SA 265 deals only with communicating deficiencies the auditor has identified. It does not add duties to understand internal control or test it beyond SA 315 and SA 330 (paragraph 1). The auditor considers internal control to design suitable audit procedures, not to express an opinion on its effectiveness; deficiencies may be found during risk assessment or at any other stage (paragraph 2). Nothing stops the auditor from reporting other matters (paragraph 3).

The objective is to communicate appropriately those deficiencies that, in the auditor's professional judgment, are of enough importance to merit attention (paragraph 5).

For company audits, the separate duty to report on internal financial controls under the Companies Act is explained in our post on internal financial controls under section 143(3)(i). SA 265 does not replace it; this standard is about the communication on weaknesses found.

AccountsMonthly reportAccounting & BookkeepingOutsource Accounting & BookkeepingMonthly accounting · GST reconciliation · Financial reportsAccurate BooksGST ReconciliationExpert TeamGet Started →

Key terms

The requirements (paragraphs 7-11)

1. Determine whether deficiencies exist on the basis of the audit work performed (paragraph 7). The auditor may discuss the facts with a level of management that knows the area and can act on it, which also lets management hear about problems early (A1). Exceptions are where the findings raise questions about management's integrity or competence.
2. Determine whether any are significant, individually or in combination (paragraph 8).
3. Communicate significant deficiencies in writing to those charged with governance on a timely basis (paragraph 9).
4. Communicate to management at an appropriate level, on a timely basis: in writing, significant deficiencies already or to be communicated to governance (unless direct communication to management would be inappropriate), and other deficiencies that management has not already been told of and that merit its attention (paragraph 10).
5. Content of the written letter (paragraph 11): a description of the deficiencies and an explanation of their potential effects, and enough context. The auditor explains that the audit was to express an opinion on the financial statements; that it included considering internal control relevant to preparing them to design suitable procedures, not to express an opinion on the control's effectiveness; and that the matters reported are limited to deficiencies identified in the audit and judged important enough to report.

Deciding what is "significant"

A5 stresses that significance depends not only on whether a misstatement has happened, but on how likely one is and how large it could be; significant deficiencies may exist even though no misstatement was found. A6 lists factors:

• the likelihood of future material misstatements;
• how exposed the related asset or liability is to loss or fraud;
• subjectivity and complexity, such as in estimates;
• the amounts and volume of activity exposed;
• how important the control is, for example monitoring controls over management, fraud prevention, accounting policy selection, related party transactions, unusual transactions and period-end entries;
• the cause and frequency of exceptions; and
• how the deficiency interacts with others.

A7 gives indicators of significant deficiencies. In summary: ineffective control environment (for example significant transactions in which management is interested not being scrutinised, management fraud not prevented, or management failing to act on deficiencies already reported), no risk assessment process where one would be expected, an ineffective risk assessment or response to significant risks, misstatements that the controls did not catch, material prior period items and an inability of management to oversee the preparation of the statements.

A8 says that a deficiency alone may not be significant but a combination affecting the same balance, assertion or component can be. A9-A11 deal with cases where law or regulation requires specific terms; the SA's requirements still apply.

Timing, form and repeat findings

• Timing. The auditor considers when the letter would enable governance to do its oversight job. For listed entities, governance may need the letter before the financial statements are approved; for others it may follow later, but the letter forms part of the final audit file and must be in place within the file-assembly time limit, ordinarily not more than 60 days after the report date (A13). See SA 230.
• Oral first. The auditor may tell management orally in the first instance so it can act, but this does not remove the duty to put it in writing (A14).
• Cost is not a reason to omit. Management may know of a significant deficiency and have chosen not to fix it because of cost; the duty to communicate still applies (A16).
• Repeat points. A deficiency reported last year must be reported again if it remains, either by repeating or by referring to the earlier communication. Failing to act without a good reason may itself be a significant deficiency (A17).
• Smaller entities. Communication may be less structured (A18).

Two-way communication with governance generally is covered in SA 260, and the understanding of internal control that leads to these findings is in SA 315 part 1. The auditor's response to controls is in SA 330.

Illustrative example

During the audit of Narang Distributors Pvt Ltd, an invented company, the auditor finds that the same accounts executive creates vendors, approves invoices and releases payments, and that bank reconciliations have not been prepared for four months. Alone, each weakness might be a deficiency; together, in an area open to fraud and with a high volume of payments, they are significant. The auditor tells the finance head orally, then sends a written letter to the board describing both weaknesses, their possible effects, the limits of the audit's consideration of controls, and a request for management's response. Next year, if nothing has changed, the auditor repeats the point.

Need help with internal control?

If you want your controls reviewed before the auditor finds the gaps, TaxClue's books of accounts compliance team can map your processes and suggest fixes such as segregation of duties and timely reconciliations. Finance heads can also use our books of accounts compliance support to close earlier findings.

Key takeaways

• A deficiency is a control that cannot work on time or is missing; significant means worthy of governance attention.
• Significant deficiencies go in writing to governance and to management.
• Significance depends on the likelihood and size of possible misstatement, not only on actual errors.
• Cost is not a reason to leave a significant deficiency unreported.
• Repeat findings are reported again until fixed.

Read next

• SA 260: communication with those charged with governance
• SA 315, part 1: understanding internal control
• SA 330: responses to assessed risks
• Internal financial controls under section 143(3)(i)

Disclaimer: Based on the Standards on Auditing and quality standards issued by the Institute of Chartered Accountants of India, in the versions named in the article, and ICAI's announcement of 31 March 2026 on SQM 1 and SQM 2, as consulted on 3 October 2026. ICAI revises standards from time to time; check the current text and effective dates on icai.org. This article is general information, not legal advice; check the official text before acting.