AUD, Auditing and Attestation

Sources for Communication with Management and Those Charged with Governance

Last reviewed 2026-09-14

The standards and authorities behind PocketCPA's AUD lessons on Communication with Management and Those Charged with Governance. The topic rests on AU-C 260.

About this topic

An audit is not a one-way exercise. The auditor engages in two-way communication with those charged with governance, the people who oversee the entity, to share what the auditor will do, what the auditor found, and matters that governance needs to act on. Clear communication also helps the auditor obtain information relevant to the audit.

Three standards carry the tested content. AU-C 260 covers what the auditor communicates about the audit, and much of it may be oral. AU-C 265 covers internal control deficiencies, and its central requirement is writing. AU-C 240 carries fraud, tested almost entirely on who receives it. For an issuer the area moves to the PCAOB: AS 1301, AS 1305, and AS 2201 for the integrated audit. The two frameworks are drawn apart in a table near the end rather than blended into single sentences.

Key points

• The auditor communicates significant findings and internal control deficiencies to those charged with governance.
• Significant deficiencies and material weaknesses must be communicated in writing.
• Communications may be oral or written; significant matters always require written communication.
• The auditor must communicate fraud or suspected fraud involving management to those charged with governance.

What the lessons cover

1. Those charged with governance
2. Required communications
3. Deficiencies, fraud, and noncompliance (AU-C 265)
4. Form, timing, and documentation of the communication
5. Issuer audits: PCAOB AS 1301 and AS 1305
6. Two frameworks compared
7. When governance and management are the same people

Authoritative references

Where these requirements sit, and on what evidence.

• AU-C 260, The Auditor's Communication With Those Charged With Governance.
  • .12 the overview of planned scope and timing.
  • .14 uncorrected misstatements, individually and in aggregate, with their effect on the opinion, whenever not all of governance is involved in managing the entity.
  • .16 writing where the auditor judges oral would not be adequate.
  • Carried at section level: the auditor's responsibilities and reasonable rather than absolute assurance, the overview of significant risks, qualitative aspects of accounting practices, significant difficulties, the disagreement carve-out, the listed-entity independence communication, the nature-sensitivity-significance factors, timeliness, and the overlap relief.
• AU-C 265, Communicating Internal Control Related Matters Identified in an Audit.
  • .07 the material weakness definition.
  • .11 written communication of significant deficiencies and material weaknesses, timely.
  • .12 other deficiencies to management, in writing or orally.
  • .16 the prohibition on writing that no significant deficiencies were identified.
  • .A11 a material misstatement the controls missed as an indicator of a material weakness.
  • Carried at section level: the deficiency and significant deficiency definitions, that severity turns on magnitude and likelihood rather than an actual misstatement, the management leg of .11, that oral discussion and prior awareness and remediation do not discharge it, and the permitted no-material-weaknesses statement where a governmental authority requires a written communication.
• AU-C 240, Consideration of Fraud in a Financial Statement Audit, at section level throughout: the two recipients, that the communication is not deferred until the amount is quantified and is not directed solely to the implicated individual, and that any duty outside the entity is limited and situational.
• Both are reproduced above rather than reconciled by guesswork. If a question quotes a number, answer on the rule, which is not in doubt either way.
• PCAOB AS 1301, Communications with Audit Committees.
  • .03 the four objectives and the two-way note.
  • .04 appointment and retention issues.
  • .05 to .07 the engagement-terms understanding, the annual letter, and the duty to decline.
  • .08 the duty to inquire.
  • .09 and .10 strategy, timing, significant risks and the note limiting detail.
  • .11 significant changes.
  • .12 and .13 critical policies and estimates, significant unusual transactions, and identified bias.
  • .15 consultations outside the engagement team.
  • .17 going concern.
  • .18 the uncorrected-misstatement schedule.
  • .19 corrected misstatements.
  • .20 other material written communications.
  • .21 the draft of the auditor's report.
  • .22 disagreements and the carve-out.
  • .23 significant difficulties.
  • .24 complaints and other matters.
  • .25 form plus work-paper documentation.
  • .26 timing, prior to issuance.
  • .A2 the audit committee definition and its fallbacks.
  • Appendix B the other sources, including Rule 3526 and AS 1305.
• PCAOB AS 1305, Communications About Control Deficiencies in an Audit of Financial Statements.
  • .01 to .03 the three definitions, with the note equating reasonable possibility to reasonably possible or probable.
  • .04 written communication to management and the audit committee before the report issues, clearly distinguishing the categories.
  • .05 ineffective oversight as a material weakness indicator plus written escalation to the board.
  • .06 required content.
  • .07 other matters.
  • .08 no written report that no significant deficiencies were discovered.
  • .09 communicating during the audit.
• PCAOB AS 2201.
  • .78 material weaknesses in writing to management and the committee.
  • .79 escalation to the board.
  • .80 significant deficiencies in writing to the committee.
  • .81 lesser deficiencies in writing to management with the committee informed.
  • .82 no duty to find every deficiency.
  • .83 no report that no lesser deficiencies were noted.
  • .84 fraud or possible illegal acts.
• PCAOB AS 2401.
  • .79 the two recipients, and that an inconsequential low-level defalcation is still reported to management.
  • .80 fraud risks with continuing control implications tested against the deficiency definitions.
  • .81 other fraud risks.
  • .81A disclosure to the Securities and Exchange Commission.
  • .82 the limited duties outside the entity, being successor auditor inquiry, a subpoena, and requirements for entities receiving governmental financial assistance.

How PocketCPA uses these sources

Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.

See also

• Sources for every AUD topic
• Free AUD sample questions
• The CPA exam glossary