Requirements of an auditor when deficiencies in internal control are identified:

• The auditor must determine whether the identified deficiencies are significant individually or in combination with others.
• The auditor must communicate in writing significant deficiencies to those charged with governance on a timely basis.
• The auditor must communicate to management any other deficiencies that have not been communicated by other parties, if deemed important enough to warrant attention.