The audit opinion is unmodified, but the management letter lists problems: what next?

A board receives an unmodified opinion on the financial statements and a separate communication describing weaknesses in the accounting process. It is tempting to treat the second document as optional advice because the first appears satisfactory. Instead, establish what each document addresses. The financial statement opinion and a communication about identified control deficiencies serve different purposes.

In an ordinary U.S. nonissuer financial statement audit, the auditor considers internal control to design appropriate audit procedures. That does not mean the auditor expresses an opinion on the effectiveness of internal control. AICPA's AU-C section 265 addresses communication of identified deficiencies; an integrated audit of internal control has a different scope.

The label management letter can be used for different kinds of communication. Ask the auditor which findings are formally classified control deficiencies, which are other observations and which communications go to those charged with governance. Read the stated scope and intended use rather than assigning significance from the document's filename.

For each item, identify the process, observed condition, consequence and period involved. Ask whether the finding concerns a missing control, a poorly designed control or a control that did not operate as intended. A response aimed at the wrong cause can produce a completed action list while leaving the original risk untouched.

Suppose, hypothetically, one employee can change a supplier's payment details and release the resulting payment without another review. A reminder to be careful does not change those permissions. Management needs to understand how a payment could be misdirected, which existing safeguards apply and what additional approval or verification would address the actual exposure.

Discuss any disputed facts with the auditor while the evidence is available. Provide the missing context and ask how it affects the finding. Avoid treating disagreement about wording as progress on the underlying issue. Management may disagree with a recommendation while still needing to address a clearly identified weakness.

A material weakness and a significant deficiency are distinct classifications under the auditing standards. Broadly, the former concerns a reasonable possibility that a material misstatement will not be prevented or detected and corrected in time; the latter is less severe but merits governance attention. Have the auditor explain its classification in the circumstances rather than relabeling every item as a minor improvement.

The absence of a detected error does not by itself prove the process is sound. A control can be ineffective during a period in which the feared event does not occur. Similarly, correcting a particular journal entry does not necessarily correct the process that allowed the error. Review both the accounting consequence and the continuing control condition.

Maintain the issued finding and classification in the action record. If later work changes management's assessment, document the evidence and any discussion with the auditor. Do not quietly downgrade a finding in a board dashboard merely because the team finds the original label uncomfortable.

An effective action describes what will change, who will make the change, who will operate the control and how management will know it is working. A target date alone is insufficient. For the hypothetical supplier-detail issue, the plan could specify an independent verification step and a separate payment approval, subject to the business's systems and actual risks.

Think through the normal working conditions. Who covers an approver's absence? Can an administrator override the restriction? How are urgent requests handled? If the design depends on a person always being available, document an authorized alternative that preserves the control objective. Otherwise, the first exception may become the ordinary process.

Ask the affected team to test the proposed workflow using a realistic example before rollout. Confirm that it can be completed without sharing credentials or moving sensitive records into an uncontrolled channel. A control that exists only in a policy document may fail as soon as the staff try to use it.

Installing a permission change is evidence that a system setting changed. It is not yet evidence that the complete process operates consistently. Define a proportionate follow-up using actual activity after implementation. The reviewer should know which transactions or periods were examined and what evidence would demonstrate the control worked.

For the illustrative supplier process, management might examine a defined set of subsequent changes to confirm that independent verification occurred and that payment approval remained separate. An exception needs investigation: was the control bypassed, the evidence lost or the procedure unsuitable for that case? Record the result rather than simply reporting that staff received training.

Keep responsibility for this follow-up clear. Do not assume the external auditor will certify every management action as complete unless that work is agreed. Management owns its controls and should establish how it will assess operation between audits. The next annual engagement is a poor substitute for timely internal follow-through.

Use a concise action record with the original finding, risk, responsible owner, agreed response, target date, evidence and current status. Explain delays using their actual dependency, such as an unavailable system permission or a decision about staffing. A repeated status of in progress gives the board little basis to judge whether intervention is needed.

Where full remediation will take time, describe any interim measure and its limits. An additional manual review may reduce exposure while a system change is built, but it may cover only certain transactions. The approving group should know what remains outside that protection and who has accepted the temporary arrangement.

Distribute detailed findings according to their intended use and sensitivity. A report can expose weaknesses in payments, access or financial reporting. Provide the information to those who need to act or oversee, using approved channels, and check with the auditor before broader distribution where the communication contains use restrictions.

Close an action only when the designated reviewer has evaluated the agreed evidence. Record the implementation date, period of operation reviewed, exceptions found and conclusion. If management accepts a residual risk instead of implementing the original recommendation, document the actual decision and authority rather than describing the issue as fixed.

Carry recurring findings into the next reporting cycle with their history intact. Repetition may indicate that the previous response addressed a symptom, that ownership changed or that the control stopped operating. Reviewing that history can prevent the organization from approving the same incomplete remedy again.

An unmodified financial statement opinion does not remove the value of this work. The control communication gives management specific issues to address in the way records are produced and reviewed. A useful response ends with an operating change that can be demonstrated, a clear owner and an honest account of any remaining exposure.