The auditor shall determine whether, on the basis of the audit work performed, the auditor has identified one or more deficiencies in internal control.  (Ref: Para. A1‑A4)

If the auditor has identified one or more deficiencies in internal control, the auditor shall determine, on the basis of the audit work performed, whether, individually or in combination, they constitute significant deficiencies.  (Ref: Para. A5‑A11)

The auditor shall communicate in writing significant deficiencies in internal control identified during the audit to those charged with governance on a timely basis.  (Ref: Para. A12‑A18, A27)

The auditor shall also communicate to management at an appropriate level of responsibility on a timely basis:  (Ref: Para. A19, A27)

1. In writing, significant deficiencies in internal control that the auditor has communicated or intends to communicate to those charged with governance, unless it would be inappropriate to communicate directly to management in the circumstances; and  (Ref: Para. A14, A20‑A21)
2. Other deficiencies in internal control identified during the audit that have not been communicated to management by other parties and that, in the auditor’s professional judgement, are of sufficient importance to merit management’s attention.  (Ref: Para. A22‑A26)

​​​​​​The auditor shall include in the written communication of significant deficiencies in internal control:

1. A description of the deficiencies and an explanation of their potential effects; and (Ref: Para. A28)
2. Sufficient information to enable those charged with governance and management to understand the context of the communication.  In particular, the auditor shall explain that:  (Ref: Para. A29‑A30)
   1. The purpose of the audit was for the auditor to express an opinion on the financial report;
   2. The audit included consideration of internal control relevant to the preparation of the financial report in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal control; or

1. In circumstances when the auditor has a responsibility to express an opinion on the effectiveness of internal control in conjunction with the audit of the financial report, the auditor shall omit the phrase that the auditor’s consideration of internal control is not for the purpose of expressing an opinion on the effectiveness of internal control; and
   3. The matters being reported are limited to those deficiencies that the auditor has identified during the audit and that the auditor has concluded are of sufficient importance to merit being reported to those charged with governance.