An auditor finds the same AP clerk both adds vendors and approves payments. The audit committee never hears about it because the auditor "didn't think it was material." That silence is an AU-C 265 violation, regardless of whether a misstatement occurs.
Why AU-C 265 exists. Control deficiencies don't always cause a misstatement: a flaw can sit dormant for years. The standard surfaces them to TCWG and senior management before they cause damage. Severity is measured on potential exposure, not actual loss.
HIGH-FREQUENCY: Misclassify the fact pattern and you communicate the wrong things to the wrong people.
- Control deficiency. A control is missing, poorly designed, or fails in operation. The baseline: every weakness starts here.
- Significant deficiency. Less severe than a material weakness but important enough to merit attention by those charged with governance. The threshold is governance attention, not financial-statement impact alone.
- Material weakness. A deficiency or combination such that there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis.
Common mistakes
- Treating compensating controls as a cure. Compensation reduces severity; it does not eliminate the deficiency. Trap: "no communication required because a compensating control exists." If post-compensation severity is still significant or material, write the letter.
- Communicating only to management. AU-C 265 requires the letter to both management AND TCWG. Trap: "communicate to management only" violates the standard.
- Confusing severity with actual misstatement. Severity is judged on potential, not whether one occurred. Trap: "no material misstatement, so no material weakness." A clean audit can still have a material weakness.
Bottom line
- AU-C 265 defines three severity levels: control deficiency (design or operation flaw), significant deficiency (merits TCWG attention), material weakness (reasonable possibility of material misstatement)
- Severity is judged on likelihood times magnitude, evaluating the potential for misstatement, not whether one occurred
- Material weakness uses the reasonable possibility threshold, the same standard as ASC 450, not probable
- Significant deficiencies and material weaknesses must be communicated in writing to both management and TCWG; plain control deficiencies require no AU-C 265 letter
Exam shortcut
When a question tests classification, look for "reasonable possibility" combined with "material": that's the material weakness signal. For timing, count 60 days from the report release date; anything beyond violates AU-C 265. The letter goes to both management AND TCWG in writing; picking either alone is the trap. Memory aid: "Reasonable + Material = Weakness" for severity.
The full lesson (about 1,838 words, 12 min read) adds 2 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- I.F2
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.