ACT 3202 –

PRINCIPLES OF
AUDITING
Lecture 8- The Letter of Weakness
z
 z Letter of Weakness
The auditor is expected to report any weaknesses
discovered in the system of internal control to the
management of the company. This report takes
the form of an interim management letter.

The letter to management varies from firm to firm. They are known by various
names such as letter of weakness, management letter, post audit letter, letter of
comment, letter of recommendation, internal control letter, follow-up letter.
 z The Interim Management Letter/Letter Of Weakness

The auditor performs compliance tests to obtain reasonable assurance

that the controls on which he wishes to rely have been functioning
properly; such that material errors of omissions could arise he will
move directly to designing and carrying out substantive tests.

It is important that the auditor should report, as soon as practicable

significant weaknesses in internal controls which come to his attention
during the course of an audit to an appropriately senior level of
management of the enterprise.

Any such report should indicate that the weaknesses notified are only
those which have come to the attention of the auditor during the course
of his normal audit work and are not necessarily, therefore, all the
weaknesses which may exist.
 z
Purpose
 To enable the auditor to give his comments on the accounting
records, systems and control.
 To enable the auditor to bring to the attention of management areas
of weakness that might lead to material errors.
 In some audit engagements there is a requirement to make a report.
These include local authorities, stock exchange firms, housing
associations and the financial services sector.
 To enable the auditor to communicate matters that may have an
impact on future audits.
 z
Purpose
 To enable the management to put right matters that may otherwise
have led to audit report qualification.
 To enable the auditor to point out areas where management could
be more efficient or more effective or where economies could be
made or resources used more effectively.
For example unnecessarily large balances may occur occasionally in the bank. The
auditor could point out that facilities exist in the banking sector for short term investment
of surplus funds. This is clearly outside the audit assignment but can be very helpful to
management and may well make the audit fee more palatable
 z Timing
 As the report is a natural by-product of the audit the production of the
report to management should be incorporated in the audit plan.
 The report should be sent as soon as possible after the end of the
audit procedures out of which the report arises.
 Where the audit is spread over several visits then it may be
appropriate to send a report after each visit. Frequently two reports are
sent – one after the interim and one after the final.
 z Timing
 Where procedures need to be improved before the year end (e.g.
stock control or identification of doubtful debts or undisclosed liabilities)
then the report must be sent as soon as the weaknesses are identified
by the auditor.
 z Procedures
 As weaknesses or breakdowns are identified they should be discussed
in detail with the operating staff involved and/or with more senior
management. It is vital that the auditor has his facts right.
 The report should then be written, and then discussed with the
addressee.
 The report should then be sent.
 An acknowledgement should be obtained from management stating
what they propose to do about the weaknesses.
 The weaknesses should be followed up on the next visit.
 z Addresses
 It is usual to address the report to the Board or the audit committee
who may then choose to send it down the line for action. Alternatively
with the agreement of the Board the report may be sent to the
management of the appropriate section, branch, division, region, etc.

In some cases separate reports are prepared for the Board and for line
management.
 z Contents
The report will include:
A. A list of weaknesses in the structure of accounting systems and
internal controls. This means where the client has records or controls
which are ill-designed or inadequate. For example there may be no
serial numbering of sales invoices so that it is possible for sales
invoices to be lost and not be entered in the records.
 z Contents Cont’d
The report will include:
B. A list of deficiencies in operation of the records or controls. In principle
good records and controls have been designed but they may be by
passed or not always carried out. For example the system in a
department store may require all credit notes to be approved by a
departmental manager. But in practice the auditor may find that not all
credit notes are so approved so that fraudulent credit notes may be
issued.
 z Contents Cont’d
 Unsuitable accounting policies and practices.
 Non-compliance with accounting standards or legislation.
 Explanations of the risks arising from each weakness. For example the
possibility of non-collection of the sum due on an invoice or the issue of a
fraudulent credit note.
 Comments on inefficiencies as well as weaknesses.
 Recommendations for improvement. In some cases the required changes
may be complex and the auditor should not delay his report if suggestions
cannot be made quickly. Also improvements may require much research and
in such cases the auditor would not be able to recommend specific action.
 z

It should be noted that items a, c and d may require the

auditor to qualify his report to the MEMBERS as required
by statutes (e.g. the Companies Act or proper accounting
records, accounting requirements and true and fair view
and a professional duty re compliance with Accounting
Standards).
The report to management is not a substitute for the
management report.
 z Format
The report should be clear, constructive and concise. It should contain:
- An opening paragraph explaining the purpose of the report.

- A note that it contains only those matters which came to the auditor’s
attention and cannot be a comprehensive list of all weaknesses;
- If required the report may be tiered by having major weaknesses
separated from minor weaknesses;
- A request that the management should reply to each point made.
 z
Response
 It is essential that the auditor should obtain a response from his
client on each point in the report. The auditor should expect an
acknowledgement of receipt, a note of the actions to be taken and
in some impo0rtant cases the directors’ discussions should be
recorded in their minutes.
 The report and third parties At present the auditors are much
frightened of legal actions for negligence and are also much
concerned with confidentiality. The auditor should not himself
disclose the report to any third party without permission from the
client.
 z

 It may be that the client may disclose the report to others (e.g. the
bank, regulatory bodies). The report may be relied upon by third
parties and the auditor may then have a potential claim for
damages arising out of his negligence. The auditor may include
paragraphs stating that the report has been produced for the
private use of his client only and/or requesting that it not be shown
to third parties without permission from the auditor.
 As the report may be critical of individuals care should be taken
that all its contents are factually accurate and that there are not
gratuitously derogatory remarks.