Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CPA] AUD: Auditor Communications with Those Charged with Governance (TCWG)
Transcript
- Marcus: Ava, on our last episode we talked about forming the audit opinion. But the job isn't done just by signing the report. What happens when the auditor knows something sensitive? Maybe about an aggressive accounting policy. It isn't quite a misstatement, but it's still... risky. Ava: That's a critical question, Marcus. That's where communication with "Those Charged with Governance" comes in. It’s not just a formality. It’s a required, direct line of communication to the people who oversee the company. Silence in that situation can lead to disaster. For the company, the investors, and the audit firm itself. Marcus: Okay, so let's define that term. Who exactly are "Those Charged with Governance," or TCWG.? Is that just another name for the management team? Ava: No, and that distinction is the most important concept here. Management runs the business day-to-day. TCWG oversees the business. Think of a pilot and an air traffic controller. The pilot—management—is flying the plane. The air traffic controller—TCWG.—has the high-level, strategic view. They oversee the flight path and ensure it's safe. Marcus: So for a big public company, an issuer, that would be the audit committee of the board of directors? Ava: Exactly. The Sarbanes-Oxley Act made that very clear. The audit committee is responsible for the appointment, compensation, and oversight of the external auditor. They are the primary recipient of these communications. Marcus: What about a smaller, private company? A nonissuer. Ava: It could be the full board of directors, or perhaps a finance committee. The auditor has to use professional judgment to identify the right group. In a very small owner-managed business, the TCWG and management might be the same person. Marcus: So you'd still have to formally communicate with the owner-manager, even though they already know what's going on because they're running the company? Ava: You do. The standards require it. The communication might look different, but the responsibility remains. This ensures there's a record. It shows these crucial topics were formally discussed in their governance role, not just in their management one. Marcus: So this isn't just a one-way report at the very end of the audit. Ava: Not at all. It's a two-way dialogue throughout the entire process. It starts at the beginning, continues as issues arise, and wraps up at the end. This dialogue gives the auditor valuable context. The perspective from Those Charged with Governance on strategy and risk can be very different from what we hear from the management team. Marcus: Okay, let's walk through that timeline. What are the key things an auditor needs to communicate at the very start of an audit? Ava: The first phase is about setting expectations. It involves communicating the auditor's responsibilities. And it includes the planned scope and timing of the audit. Marcus: Let's take the first part. What do you mean by "auditor's responsibilities"? Doesn't everyone know the auditor is there to find fraud? Ava: That’s a perfect example of the "expectation gap." The auditor's job is to express an opinion on the financial statements. We provide reasonable assurance. It's a high level of assurance, but it's not absolute. We have to explain that an audit has inherent limitations. Even a perfect audit might not detect a sophisticated, collusive fraud. We need Those Charged with Governance to understand we aren't providing a guarantee. Marcus: So we've clarified the auditor's role. What about the "planned scope and timing"? Are we just sending them a calendar? Ava: It's much more than a calendar. It’s an overview of the audit strategy. You're giving them insight into where the audit will focus. Marcus: What kind of insights? Ava: For instance, you'd communicate any significant risks you've identified and how you plan to address them. You might say, "We see a significant risk in your new subscription revenue stream. So we'll be performing extensive testing there." Marcus: What else goes into that initial scope discussion? Ava: You'd also discuss your planned approach to internal controls, especially for an integrated audit. And you'd talk about materiality. That's the threshold you'll use to judge if misstatements matter. This helps Those Charged with Governance understand the lens through which you're viewing their numbers. Marcus: Okay, that makes sense. The source material also puts a big emphasis on independence. How does that fit into these initial communications? Ava: Independence is the bedrock of our profession. Without it, our opinion is worthless. So, for every audit, we must communicate about independence. We have to describe any relationships or services that could be a threat. And we must explain the safeguards we have in place. Marcus: Is that communication different for a public company, an issuer? Ava: Yes, the PCAOB standards are more specific. For an issuer, the auditor must provide a written statement to the audit committee. And this has to happen at least once a year. Marcus: A written statement about what, exactly? Ava: It has to describe all relationships between the firm and the client that could impact independence. Think about non-audit services the firm might be providing. The firm also has to affirm, in writing, that it is independent in its professional judgment. And finally, they have to actually sit down and discuss independence with the audit committee. Marcus: So it's a formal, documented, three-part process for issuers. A written description of relationships, a written affirmation of independence, and a discussion. Ava: Correct. It’s a non-negotiable part of the process. And it happens before the audit really gets going. Marcus: That covers the beginning. What about during the audit? What happens when you find something significant? Ava: This is Phase Two. It's where the most critical, time-sensitive communication happens. These are significant findings that Those Charged with Governance need to know about. This allows them to perform their oversight function. And these must be communicated before the audit report is issued. Marcus: What qualifies as a "significant finding"? Ava: One key area is what the standards call the "qualitative aspects of accounting practices." This isn't just about whether a policy is technically allowed by GAAP. It's about the auditor's view on the choices management made. Marcus: So you’re talking about things like accounting estimates? Ava: Exactly. Think about a warranty liability or an allowance for doubtful accounts. We'd discuss the process management used to develop that estimate. We'd also discuss whether we think it's reasonable. We're specifically looking for signs of management bias, like consistently optimistic assumptions. Marcus: What about roadblocks? What if management is making the audit difficult? Ava: That's another category: "significant difficulties encountered." If management is causing unreasonable delays, or restricting our access to information or people... we have to tell Those Charged with Governance. The same goes if they give us an impossibly short deadline to finish the audit. Marcus: And what if you find misstatements that management refuses to correct? Ava: That definitely has to be communicated. We provide a summary of all uncorrected misstatements, except for the clearly trivial ones. We also state our view that they could be material, individually or in aggregate. We request that they be corrected. And Those Charged with Governance need to know if management refuses. Marcus: What if you disagree with management on something, but you eventually work it out? Ava: You still have to communicate it. Any significant "disagreements with management" must be reported to Those Charged with Governance. This applies whether they were ultimately resolved or not. It alerts them to points of friction. Marcus: Can we walk through an example? How does this play out in practice? Ava: Absolutely. Let's use the TechForward Inc. example. It’s a nonissuer. During the audit, you find their warranty liability estimate seems aggressively low. This is based on a recent spike in product returns. Marcus: Okay, so the first step is just identifying that this is a significant finding. Ava: Right. It's a significant accounting estimate and a potential material misstatement. It falls squarely under "qualitative aspects of accounting practices." Marcus: So what's next? Do you pick up the phone or write a formal letter? Ava: This is a significant issue. It must be communicated to the audit committee before the report is issued. You might discuss it in a meeting. But a finding this important should be put in writing to ensure there’s a clear record. Marcus: What would that written communication say? Ava: You'd be very direct. First, describe the finding. "The company is using a 2% warranty accrual rate, but our analysis of return data suggests 4% would be more appropriate." Then state the impact. "This results in a potential understatement of liabilities by $500,000, which is material." And finally, you state your view. "We believe the estimate is not reasonable and represents an uncorrected misstatement." Marcus: And what happens if you present this to the CFO, and they refuse to make the adjustment? Ava: Now the situation has escalated. It's no longer just a concern about an estimate. It's officially a "disagreement with management." You are now required to communicate both issues directly to the audit committee. You have to report the problem with the estimate AND the disagreement with management. Those Charged with Governance need to know about the underlying accounting issue and the friction it's causing. Marcus: That makes it very clear. Okay, so that covers the start and the middle of the audit. What about the end? What are the concluding communications? Ava: The main communication at the conclusion of the audit is about internal control. The auditor must communicate any deficiencies in internal control they identified during their work. Marcus: Are all deficiencies treated the same? Ava: No, they're categorized by severity. The two most serious types are "significant deficiencies" and "material weaknesses." Both must be communicated in writing to management and to Those Charged with Governance. Marcus: What's the difference between them? Ava: A material weakness is the more severe of the two. It's a deficiency where there's a reasonable possibility that a material misstatement could occur... and not be caught. A significant deficiency is less severe. But it's still important enough to bring to the attention of Those Charged with Governance. Marcus: And both of those have to be in writing. What about minor issues? Ava: Other, less severe deficiencies can be communicated to the appropriate level of management. This can be done orally or in writing. They don't have to go to Those Charged with Governance unless management fails to address them. Marcus: You mentioned timing is important here. Does it matter when that written communication is delivered? Ava: It does, and it's a key difference between issuers and nonissuers. For issuers, under PCAOB rules, that written communication must be made before the auditor's report is issued. For nonissuers, AICPA rules allow for it to be completed up to 60 days after the report release date. Marcus: That's a huge difference and a classic exam trap. What's the most common mistake people make when thinking about all these communication rules? Ava: The biggest pitfall is confusing communication with management versus communication with Those Charged with Governance. They are two separate duties. Telling the CFO about a problem doesn't satisfy your requirement to tell the audit committee. Marcus: Can you give an example? Ava: Imagine the auditor discovers the CEO is submitting fraudulent expense reports. The amount isn't material, but it involves senior management. Simply telling the CFO is not enough. Any fraud involving senior management must be communicated directly to Those Charged with Governance, regardless of materiality. The auditor's line to them is independent of the management chain of command. Marcus: There are a lot of moving parts here. Is there a good way to remember the main topics we need to communicate? Ava: There is. A great memory aid is the mnemonic SPADE. It helps you remember the five core communication areas. Marcus: Okay, what does SPADE stand for? Ava: S is for Significant Findings and Risks. That includes the accounting policies, estimates, difficulties, and disagreements we just discussed. Marcus: Got it. S for Significant Findings. What's P? Ava: P is for Planned Scope and Timing. That’s the audit strategy overview you discuss at the beginning. Marcus: A? Ava: A is for Auditor's Responsibilities and, crucially, Independence. Marcus: D? Ava: D is for Deficiencies in Internal Control. Remember, the significant ones and material weaknesses must be in writing. Marcus: And finally, E. Ava: E is for Errors and Misstatements. This covers both the uncorrected misstatements and any material misstatements the auditor found that management did correct. Marcus: SPADE. That's a great tool. Before we wrap up, Ava, what's one key tip for applying this on exam day? Ava: On any question about these communications, first identify the entity type. Is it an issuer or a nonissuer? That single fact changes the rules for timing and form. This is especially true for the independence and internal control communications. Pay very close attention to what must be in writing versus what can be oral. Marcus: Perfect. So, to recap the big ideas: Those Charged with Governance is about oversight, not management. The auditor has a direct, independent line of communication to them. Ava: Right. And that communication is a two-way dialogue that happens throughout the audit—not just a report at the end. Marcus: Independence communications are paramount. And certain key findings, like material weaknesses and significant deficiencies, absolutely must be in writing. Ava: Exactly. Mastering these rules isn't just about passing the exam. It’s about understanding a fundamental safeguard of audit quality. VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.