Which of the following statements about reporting deficiencies is true?

• A. Auditors communicate deficiencies in writing to those charged with governance; i.e., directors.
• B. They report only to management.
• C. They report only to regulators.
• D. They do not provide recommendations.

Answer: (A)

Deficiencies in internal controls are weaknesses identified by the auditor that could affect the reliability of financial reporting. The proper response is to communicate these deficiencies in writing to those charged with governance, such as the board of directors or the audit committee. This ensures that those responsible for oversight understand the issues and can take corrective action. The communication typically includes observations about deficiencies, notes on significance (significant deficiencies and material weaknesses), and practical recommendations for remediation. It is not limited to management, nor is it restricted to regulators, and auditors usually provide suggestions on how to fix the problems rather than just listing them.