Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CPA] AUD: Auditor Communications with Those Charged with Governance (TCWG)
Transcript
- Hey, welcome back to VoraPrep Audio. Glad you could join me. Let's talk about something that feels a little… procedural. A little bit like checking a box. Auditor communications. But I want you to picture this for a second. An audit partner is standing in front of the audit committee of a big public company. A week ago, her firm issued a clean, unqualified opinion. Everything looked great. But yesterday, the company announced a massive restatement. The stock is in freefall. And the worst part? The partner knew about the aggressive accounting policy that caused it all. She and her team saw it, but they kind of downplayed it in their talks with the committee. Now, her credibility is shot. The firm is looking at a massive lawsuit. That's the real cost of silence. So, this topic—communicating with "those charged with governance"—isn't just about following the rules. It’s about protecting the entire system. It’s mandated by the standards, specifically AU-C 260 and for public companies, PCAOB AS 1301. Alright, so who are these "those charged with governance," or TCWG, as you'll see it? The key word here is oversight. These are the people responsible for the strategic direction and, critically, overseeing the financial reporting process. They are NOT the people running the business day-to-day. That's management. Think of it like this: management is the coaching staff, calling the plays on the field every Sunday. TCWG is the team owner, sitting up in the box. The owner hires and fires the coach, sets the budget, and has ultimate responsibility for the direction of the franchise, but they aren't on the sidelines drawing up plays. That distinction is everything. Now, who this is in practice really depends on the entity. For a big public company, an issuer, it’s almost always the audit committee of the board of directors. The Sarbanes-Oxley Act made that pretty clear. For a private company, a nonissuer, it might be the full board of directors, or maybe a smaller committee. For a small business, the owner-manager might be both management *and* governance. You still have to communicate, but obviously, the conversation is a little different when it's the same person wearing both hats. For a non-profit, you're probably talking to a board of trustees. The point is, your job as the auditor is to use your judgment and figure out who has that ultimate oversight role. When you get a question on this for the exam, your brain needs to follow a quick little path. First, and this is the most important thing: Is this an issuer or a nonissuer? A public company under PCAOB and SEC rules, or a private one under AICPA rules? That single fact changes everything—the timing, the format, a bunch of little details the exam loves to test. Once you know that, think about *what* is being communicated. Is it about independence? A problem with internal controls? A disagreement with the CFO? They all have slightly different rules. Then you have to ask, how serious is it? And finally, does it have to be in writing, or can it be oral? And when does it have to happen? Before the audit report? After? We'll get into all of that. The big idea to hold onto is that this whole process is meant to be a two-way dialogue. It’s not a one-way data dump at the end of the audit. Think of yourself as the captain of a ship on a long voyage. Management is your crew, handling the day-to-day operations. But TCWG, they're the vessel's owner back on shore. The owner needs to know your planned route—that’s your audit scope. They need to know if you spot a big storm on the horizon—that's a significant risk. And they absolutely need to know if you discover some major engine trouble along the way—that's a significant audit finding. A silent captain is a negligent one. And that dialogue also helps you, the auditor, understand the entity better. This dialogue happens in a few phases. Let’s start with the communications that happen at the beginning of the audit. Before you really dive into the fieldwork, you need to get on the same page with TCWG. This is about establishing the ground rules. First up is communicating your responsibilities as the auditor. You have to be really clear that your job is to express an opinion. You’re providing reasonable assurance. It’s a high level of assurance, but it is not absolute. It's not a guarantee. This is so important for managing the "expectation gap"—that's the difference between what people *think* an audit is, which is a promise that everything is perfect, and what it *actually* is. You need to explain that even a perfect audit might not catch a really sophisticated fraud, especially if there's collusion. Next, you'll talk about the planned scope and timing of the audit. And this is more than just sharing your calendar. It’s giving TCWG a roadmap of your audit strategy. You'll talk about the significant risks you've identified and how you plan to tackle them. You'll discuss your approach to internal controls. You'll even talk about how you're applying materiality. If you plan on using the work of internal auditors or bringing in a specialist, you mention that too. And if your plan changes significantly during the audit, you have to go back and update them. Then we get to the absolute bedrock of our profession: independence. Without it, our opinion is worthless. For any audit, you have to communicate any relationships or services that could even be *perceived* as a threat to your independence. You talk about the threats, and you talk about the safeguards your firm has put in place. For issuers, the PCAOB standards are much more specific. At least once a year, you have to give the audit committee a written statement that lists out *all* the relationships between your firm and the client that could possibly affect independence. You also have to affirm, in writing, that in your professional judgment, your firm is, in fact, independent. And you have to actually sit down and discuss it with them. This goes hand-in-hand with the rule that the audit committee has to pre-approve all services, both audit and non-audit. Okay, so that’s the setup. Now let's talk about what happens during the audit, when you actually find things. This is Phase Two. These are the significant findings you need to communicate on a timely basis, and definitely *before* you issue that audit report. First is your view on the qualitative aspects of their accounting. This is where you have a really candid conversation about their significant accounting policies, estimates, and disclosures. You might talk about how management came up with a really critical estimate, like the allowance for doubtful accounts. You're looking for signs of potential management bias. Are they always leaning in a direction that makes the numbers look better? You also have to communicate any significant difficulties you ran into. Did management take forever to get you the documents you needed? Did they try to restrict your access to certain information or people? TCWG needs to know about those roadblocks. Another big one: uncorrected misstatements. As you go through the audit, you'll accumulate a list of misstatements that are more than just clearly trivial. At the end, you present these to management, and maybe they decide not to correct some of them. You have to take that list to TCWG and explain that, in your view, these items could be material, individually or all together. Now, here’s a question for you. Let's say you find a material misstatement, a big one. You show it to management, and they immediately say, "You're right," and they correct it. Do you still need to tell TCWG? Yes. Absolutely. This is a "material corrected misstatement." The fact that it happened in the first place points to a potential weakness in their financial reporting process, and that's exactly the kind of thing the oversight body needs to be aware of. And finally, you have to communicate any disagreements with management. This could be about an accounting principle or even the scope of your audit. And here’s the kicker: you have to report these disagreements *whether or not they were ultimately resolved*. It signals to TCWG that there was friction. Let's walk through a quick example. You're auditing a private company, TechForward Inc. You notice their warranty liability estimate seems really low, especially since product returns have been spiking. This is a significant accounting estimate, and it smells like a potential misstatement. So, the first thing you do is identify it as a "qualitative aspect of accounting" that needs to be communicated. This has to happen before the audit report is issued, and for something this important, you're going to want it in writing. Your note to the audit committee might say something like, "The warranty liability is estimated at 2% of sales, but our analysis suggests a rate closer to 4% would be more appropriate. This difference could understate liabilities by about $500,000, which is material." You take this to the CFO, and he pushes back. He refuses to make the adjustment. Okay, now it's not just an uncorrected misstatement; it's also a *disagreement with management*. So you have to communicate *both* of those things to the audit committee. The tempting but wrong answer on an exam would be to just document the CFO's refusal and move on. That's not enough. Your duty is to make sure the people with oversight responsibility know about the issue and the disagreement. That brings us to the final phase: concluding communications, specifically about internal control. You have to communicate any deficiencies you find. The rules depend on how severe they are. If you find a material weakness—that’s a big one, a deficiency where there's a reasonable possibility of a material misstatement slipping through—you must communicate it in writing to both management and TCWG. Same goes for a significant deficiency, which is less severe but still important enough for TCWG to know about. For smaller, other deficiencies, you can just tell the right level of management, and it can be oral or written. The timing here is a classic exam trap. For issuers, under PCAOB rules, that written communication about material weaknesses and significant deficiencies has to happen *before* the audit report is issued. For nonissuers, under AICPA rules, you have to get it done by the report release date, but you have a 60-day window *after* that date to actually deliver it. So if you see a question where the communication happened 45 days after the report date, you need to know if it's an issuer or nonissuer to know if it's okay. A really common pitfall here is confusing your communication with management with your communication to TCWG. They are two separate things. You have a direct line to the oversight body that doesn't go through the CEO or CFO. For example, if you find fraud by a mid-level employee, you tell management. But if you find fraud involving senior management, or any fraud that causes a material misstatement, you have to go directly to TCWG. Telling the CFO that the CEO is faking expense reports is not sufficient. The audit committee needs to hear it directly from you. I know this is a lot of different pieces. To help keep it all straight, you can use the mnemonic SPADE. S-P-A-D-E. S is for Significant Findings and Risks. That's your accounting policies, estimates, difficulties, and disagreements. P is for Planned Scope and Timing. Your audit roadmap. A is for Auditor's Responsibilities and, crucially, Independence. D is for Deficiencies in Internal Control. Remember, the big ones have to be in writing. And E is for Errors and Misstatements, both the uncorrected ones and the material ones that got corrected. So on exam day, when you see one of these questions, first thing you do: issuer or nonissuer? That sets the rules of the game. Then, pay super close attention to the words "must be in writing." That's a non-negotiable for significant deficiencies, material weaknesses, and that annual independence letter for issuers. If you want to practice questions on this and really nail down the differences between issuer and nonissuer rules, the VoraPrep app is full of them. You can work through sims that put you right in these scenarios. Just head over to Vora Prep dot com to get started. It's free to try and it has lessons, questions, and an AI tutor all in one place. So, to wrap this up: TCWG is about oversight, not management. Your communication with them is a direct, independent, two-way dialogue. Independence is the absolute foundation. Significant findings have to be communicated *before* the report comes out. And remember those key differences in timing and form, especially for internal control communications. This isn't just about checking a box; it’s about upholding the integrity of the audit. Alright, that's it for today. Keep up the great work. You’ve got this.