Management Letter

An auditor reviewing financial statements may notice that one person can create a supplier and approve its payments, and a management letter can explain that control weakness and its possible effect so the business can respond. The letter should describe the condition observed, the risk it creates and enough context to make the finding understandable, so that management can distinguish a single processing error from a missing control design.

The auditor's scope matters: in a financial-statement audit, the auditor considers relevant controls to plan procedures but generally does not give a separate opinion on all control effectiveness, and International Standard on Auditing 265 makes that limitation explicit in written communications about significant deficiencies. ISA 265 requires significant control deficiencies identified during an audit to be communicated in writing to those charged with governance on a timely basis, and it also addresses communication with appropriate management, except when direct communication would be inappropriate.

The exact engagement and local standards must still be checked. A significant deficiency is a professional-judgment classification, not any mistake with a large-looking number, so consider the likelihood and possible impact of misstatement, the importance of the affected control and whether weaknesses combine.

Some letters also mention less serious observations or efficiency suggestions, and these should be separated from matters that meet the required communication threshold. A management letter may accompany a clean audit opinion, because an unmodified opinion does not mean the auditor found no control weakness, and conversely a letter finding does not by itself mean the financial statements are misstated.

Management owns the response: it may agree, explain compensating controls or contest a factual detail with evidence. For each accepted issue, name an owner, action and target date, because "Staff will be more careful" is weak when the problem is that no review step exists, whereas a revised supplier-approval workflow should identify who reviews changes and how proof is retained.

Prioritise by risk and feasibility, since a critical weakness involving payment diversion may need immediate control while a lower-risk formatting issue can wait. The board or audit committee should see important issues and management's response, because the letter is not only a task list for a junior accountant, and its audience should be protected since it may describe vulnerabilities, employees and sensitive transaction details.

Do not wait for a final letter to address an urgent issue: auditors may raise a problem orally first, and management can begin safe corrective work, but required written communication still follows, so record what changed and when. Compare each recommendation with the business's actual process, because a small team may lack full separation of duties, but a review by an owner can sometimes reduce risk.

Verify closure and track repeat findings: management can show new approvals, logs or sample transactions after a process change, and marking an issue closed when a policy is drafted but nobody follows it can leave the original risk in place. If the same weakness appears year after year, ask why the promised fix did not stick, and use the letter to improve other processes when a cause is shared.

For a business owner, read the letter with the audit opinion, not instead of it, asking what was observed, which risks matter most and who will test the fix.