AUD, Auditing and Attestation

Sources for Misstatements and Control Deficiencies

Last reviewed 2026-09-14

The standards and authorities behind PocketCPA's AUD lessons on Misstatements and Control Deficiencies. The topic rests on AU-C 450.

About this topic

An audit turns up two kinds of problem. Some numbers come out wrong, and some of the controls meant to keep them right do not work. This topic covers what the auditor does about each.

Both feed the opinion and both drive required communications, so the exam tests the definitions and the reporting obligations precisely.

Key points

• A misstatement is the difference between the reported amount and the amount required by the applicable framework.
• Clearly trivial misstatements need not be accumulated; all others are accumulated and evaluated in aggregate.
• A significant deficiency is less severe than a material weakness but important enough to merit attention by those charged with governance.
• A material weakness is a deficiency in which there is a reasonable possibility that a material misstatement will not be prevented or detected.

What the lessons cover

1. Accumulating and evaluating misstatements
2. Severity of control deficiencies
3. Required communications (AU-C 265)
4. Evaluating uncorrected misstatements: materiality, aggregation, and prior periods
5. When management will not correct: reasons, representations, and the opinion
6. Documentation (AU-C 450.12)
7. AU-C versus PCAOB: the same deficiency in two frameworks

Authoritative references

Where these requirements sit in the literature. AS paragraph numbers were checked against PCAOB primary text.

• AU-C 450.05 is the accumulation requirement: accumulate misstatements identified during the audit other than those that are clearly trivial, which is not another expression for not material but a wholly smaller order of magnitude than the materiality used in the audit, inconsequential individually and in the aggregate, with any uncertainty resolved by accumulating. This is the research answer for "why do we not add very small identified differences to the summary of audit differences."
• AU-C 450.A6 is the application guidance naming a sample result extrapolated to its population a projected misstatement, the auditor's best estimate for that population, as distinguished from the factual amount identified in the tested items.
• AU-C 450.09 governs management's refusal to correct: obtain an understanding of management's reasons and take them into account when evaluating whether the financial statements as a whole are free from material misstatement.
• AU-C 450.10 requires the auditor, prior to evaluating the effect of uncorrected misstatements, to reassess the materiality determined under AU-C 320 against the entity's actual financial results.
• AU-C 450.11 is the evaluation: whether uncorrected misstatements are material individually or in the aggregate, on size and nature and the particular circumstances, including the effect of uncorrected misstatements related to prior periods. It is the paragraph behind both the aggregation arithmetic and the rollover versus iron-curtain comparison.
• AU-C 580.14 requires a written representation from management, and when appropriate those charged with governance, about whether they believe the effects of uncorrected misstatements are immaterial individually and in the aggregate, with a summary of the items included in or attached to it, regardless of the auditor's own conclusion on immateriality.
• AU-C 450.12 is the documentation paragraph, a closed list of three:
  • (a) the amount below which misstatements are regarded as clearly trivial.
  • (b) all misstatements accumulated and whether they were corrected.
  • (c) the conclusion on materiality individually or in the aggregate and its basis.
• AU-C 265.07 carries the definitions. A material weakness is a deficiency, or combination, such that there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis. Severity, not whether a misstatement actually occurred, drives the classification, and it exceeds that of a significant deficiency, which is less severe yet important enough to merit attention by those charged with governance.
• AU-C 265.09 requires the auditor to determine whether identified deficiencies, individually or in combination, are significant deficiencies or material weaknesses. AU-C 265's indicators of a material weakness, carried here at standard level, include a material misstatement the entity's controls failed to detect, a restatement to correct a material error, and fraud by senior management whether or not material in amount.
• AU-C 265.11 requires significant deficiencies and material weaknesses to be communicated in writing to management and those charged with governance on a timely basis. Oral communication does not satisfy it.
• AU-C 265.12(b) permits other deficiencies, less severe than significant deficiencies but meriting management's attention, to go to management in writing or orally. A prior-period significant deficiency still unremediated must be communicated again in writing to those charged with governance, and the application guidance allows the auditor to reference the earlier written communication and its date rather than repeat all details.
• AU-C 265.15 and .16.
  • .15 prohibits a written communication stating that no significant deficiencies were identified, because the limited assurance could be misread as assurance about the effectiveness of internal control.
  • .16 permits a written statement that no material weaknesses were identified, often needed for a governmental or regulatory submission.
• AU-C 265.13 puts the written communication no later than 60 days following the report release date. AU-C 265.14 separately sets its content:
  • the definitions.
  • a description of the deficiencies and their potential effects.
  • the statements that the purpose of the audit was an opinion on the financial statements and that no opinion on the effectiveness of internal control is expressed.
  • an alert restricting its use.
• AS 2810.10 through .19 is the PCAOB counterpart to AU-C 450.
  • Accumulate other than clearly trivial, which is not another expression for not material (.10).
  • The auditor may designate an amount below which misstatements need not be accumulated (.11).
  • The accumulation includes the best estimate of total misstatement in what was tested, including sampling projections (.12).
  • An unreasonable estimate is measured to the closest reasonable estimate in a supported range (.13).
  • Communicate accumulated misstatements to management timely (.15).
  • Evaluate uncorrected misstatements individually or in combination on quantitative and qualitative factors (.17).
  • Include prior-year items and current-year items relating to prior years (.18).
  • Never assume an error or fraud is isolated (.19).
• AS 2810.24 through .27 and Appendix B carry the qualitative side.
  • Evaluate qualitative aspects including management bias (.24).
  • Selective correction and management's offsetting adjusting entries are named forms of bias, with a note requiring the auditor to understand why management chose not to correct (.25).
  • Bias in individually reasonable estimates (.27).
  • Appendix B.2 lists the qualitative factors, from loss turned into income and covenant compliance through management compensation, segment information, misclassification, offsetting effects, and cumulative effects.
• Three supporting PCAOB paragraphs sit under the same analysis.
  • AS 2315.26 requires projecting the sample's misstatement results to the population, adding misstatements from items examined in full, and comparing the total against tolerable misstatement.
  • AS 2105.11 and .12 require reevaluating materiality where it was set on estimated amounts that differ significantly from actual, and modifying procedures if it falls.
  • AS 2805.06 carries the representation that uncorrected misstatements are immaterial individually and in the aggregate, with a summary attached.
• AS 1305.01 through .08 governs deficiency communications in an issuer audit of financial statements only.
  • The anatomy of a deficiency in design and in operation (.01).
  • The definitions, with material weakness reaching annual or interim statements (.02, .03).
  • A must to communicate in writing to management and the audit committee prior to issuance of the report, distinguishing clearly between the two rungs (.04).
  • Ineffective audit committee oversight as an indicator, communicated in writing to the board (.05).
  • The required content, being the definitions, a statement that the audit's objective was to report on the financial statements and not to give assurance on internal control, and a restriction on use (.06).
  • Permission to report lesser matters (.07).
  • The prohibition on writing that no significant deficiencies were discovered (.08).
• AS 2201.62 through .70 is the PCAOB severity framework.
  • Evaluate each deficiency, individually or in combination, as of the date of management's assessment, with no duty to search for deficiencies less severe than a material weakness (.62).
  • Severity is reasonable possibility of failure times magnitude (.63).
  • It does not depend on a misstatement having occurred (.64).
  • Risk factors, with a note that deficiencies in the same account may combine into a material weakness (.65).
  • Magnitude factors, the maximum overstatement generally being the recorded amount while understatements could be larger (.66, .67).
  • Compensating controls must operate at a precision that would prevent or detect a misstatement that could be material (.68).
  • The four indicators (.69).
  • The prudent official test (.70).
• AS 2201.78 through .83 and AS 2201.90 through .92 carry the integrated-audit outputs.
  • Material weaknesses in writing to management and the audit committee before the ICFR report issues (.78).
  • Ineffective audit committee oversight in writing to the board (.79).
  • Significant deficiencies in writing to the audit committee before that report (.80).
  • All deficiencies in writing to management, with the audit committee informed it was done (.81).
  • No duty to find every deficiency (.82).
  • No report that none less severe than a material weakness were noted (.83).
  • An adverse ICFR opinion for a material weakness absent a scope restriction (.90), including the definition and identifying the weakness (.91).
  • A duty to determine the effect on the financial statement opinion and disclose whether it was affected (.92).
  • The definitions at AS 2201.A7 and .A11 track AS 1305 rather than AU-C 265, referring to those responsible for oversight of the company's financial reporting.
• AS 2301.32 through .34 connects deficiencies back to planning.
  • Assess control risk from all sources including misstatements detected and deficiencies identified (.32).
  • Assess it at the maximum where necessary controls are missing or ineffective (.33).
  • Where deficiencies hit controls the auditor meant to rely on, test other controls over the same assertion or revise control risk and expand substantive procedures (.34).
  • AS 3105.18 and .19 then carry the reporting consequence of material misstatement: a qualified or an adverse opinion, with the choice turning on magnitude together with significance and pervasiveness.

How PocketCPA uses these sources

Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.

See also

• Sources for every AUD topic
• Free AUD sample questions
• The CPA exam glossary