Auditors typically deliver financial statements to calendar-year businesses in the spring. A useful tool that accompanies the annual report is the management letter. It may provide suggestions — based on industry best practices — on how to fortify internal control systems, streamline operations and reduce expenses.

Managers generally appreciate the suggestions found in management letters. But, realistically, they may not have time to implement those suggestions, because they’re focusing on daily business operations. Don’t let this happen at your company!

What’s covered?

A management letter may address a broad range of topics, including segregation of duties, account reconciliations, physical asset security, credit policies, employee performance, safety, Internet use and expense reduction. In general, the write-up for each deficiency includes the following elements:

Observation. The auditor describes the condition, identifies the cause (if possible) and explains why it needs improvement.

Impact. This section quantifies the problem’s potential monetary effects and identifies any qualitative effects, such as decreased employee morale or delayed financial reporting.

Recommendation. Here, the auditor suggests a solution or lists alternative approaches if the appropriate course of action is unclear.

Some letters present deficiencies in order of significance or the potential for cost reduction. Others organize comments based on functional area or location.

What elements are required?

AICPA standards specifically require auditors to communicate two types of internal control deficiencies to management in writing:

1. Material weaknesses. These are defined as “a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the organization’s financial statements will not be prevented or detected and corrected on a timely basis.”

2. Significant deficiencies. These are “less severe than a material weakness, yet important enough to merit attention by those charged with governance.”

Operating inefficiencies and other deficiencies in internal control systems aren’t necessarily required to be communicated in writing. However, most auditors include these less significant items in their management letters to inform their clients about risks and opportunities to improve operations.

Have you improved over time?

When you review last year’s management letter, consider comparing it to the letters you received for 2019 (and earlier). Often, the same items recur year after year. Comparing consecutive management letters can help track the results over time. But, be aware: Certain issues may autocorrect — or worsen — based on factors outside of management’s control, such as changes in technology or external market conditions. If you’re unsure how to implement a particular suggestion from your management letter, reach out to your audit team for more information.

© 2021