Audit Committee Communications: 5 Essential Rules for Small Firm Auditors

Audit Committee Communications: The Obligations Small Firm Auditors Miss Most Often

Audit committee communications are not a checklist item at the end of the engagement. Under PCAOB AS 1301 for public company audits and AU-C 260 for private company audits, the communication obligations begin before fieldwork starts, continue through the engagement, and include a standing annual requirement that has nothing to do with the current year's audit findings.

At BusAcTa Advisors, we support audit documentation for US CPA partners across both issuer and non-issuer private-company engagements. The audit committee communication gaps we see most consistently at small firms fall into five patterns: applying the wrong standard, skipping the pre-audit communication, treating the required list as optional, communicating orally when writing is required, and missing the annual independence communication entirely. This guide covers all five.

Rule 1: Know Which Standard Applies, Because PCAOB AS 1301 and AU-C 260 Are Not Interchangeable

The first question your firm must answer on every engagement is which audit committee communication standard governs. The answer turns on whether the client is an SEC reporting company (an "issuer"):

• Public company issuers (SEC-registered, PCAOB-regulated audits): PCAOB AS 1301, Communications with Audit Committees, applies. PCAOB AS 1301 supersedes AU-C 260 for these engagements. If your firm is registered with the PCAOB and is auditing an SEC-registered company, AS 1301 governs, period.

• Non-issuers (private companies, nonprofits, employee benefit plans audited under AICPA standards): AU-C 260 applies. AU-C 260 audit committee guidance uses the phrase "those charged with governance" rather than "audit committee" because many private entities don't have a formal audit committee. For those that do, the audit committee is the relevant governance body.

The practical trap for small firms: a firm that mostly audits private companies occasionally takes on an SEC-registered client, a small-cap reporting company, or an SEC-reporting employee benefit plan. Your engagement team may default to the AU-C 260 communication process they use for everything else. The AS 1301 requirements are more specific, more extensive, and more demanding in several areas. Applying AU-C 260 to your client's PCAOB-regulated engagement is not a conservative choice, it is a deficiency that will be identified in a PCAOB inspection. Has your firm's engagement planning template flagged the issuer/non-issuer question and directed your team to the correct standard before fieldwork begins?

Rule 2: Required Communications Begin Before Fieldwork, Not After the Trial Balance Is Received

Audit committee communication timing under both PCAOB AS 1301 and AU-C 260 requires the auditor to communicate certain matters before or early in the engagement, not just at the conclusion. The pre-audit required communications under AS 1301 include:

• The planned scope and timing of the audit. Your client's audit committee is entitled to understand the overall approach, including significant risks identified in planning, the nature and extent of testing your team has contemplated, and the use of component auditors or specialists. This is not a detailed audit program, it is an overview that allows the audit committee to raise questions or concerns before work is underway.

• The auditor's responsibilities. Your client's audit committee must understand that the auditor is responsible for expressing an opinion on the financial statements, not preparing them, and that the audit is designed to detect material misstatements but does not provide absolute assurance that all misstatements will be detected.

• Significant risks identified in planning. Under AS 1301, the auditor must communicate, at a high level, the significant risks that have been identified, including fraud risks and significant risks related to management's use of estimates.

The pre-audit communication is where many small firm engagements fall short. Your team should be communicating these matters in writing to your client's audit committee before substantive fieldwork begins, not summarizing them in the closing conference letter. Your client who learns about your significant risk assessment for the first time when they receive the draft management letter has not received the pre-audit communication your team was required to make.

The SOX Section 204 auditor obligation also requires communication of all critical accounting policies and alternative treatments of financial information within GAAP discussed with management prior to the filing of the audit report. This communication must occur before the report is filed, not as a courtesy report after the fact.

Rule 3: Know the Full Required Content List, Not Just the Highlights

The required content of audit committee communications under PCAOB AS 1301 is more extensive than most small firm practitioners memorize. Your post-audit communication to the audit committee must cover all of the following that are applicable to the engagement:

• Significant accounting policies and practices. Including initial adoption of accounting principles, changes in accounting policies, and the reasons why any accounting policy is considered particularly sensitive.

• Alternative accounting treatments discussed with management. Under SOX Section 204, if your engagement team discussed any accounting treatment other than the one used, the alternatives and your team's preferred treatment must be disclosed to their audit committee, even if their management ultimately chose an acceptable approach.

• Critical accounting estimates audit committee disclosure. The audit committee must understand the significant accounting estimates made by management, your team's assessment of management's estimation process, and your auditor's conclusions about the reasonableness of their estimates.

• Significant difficulties encountered during the audit. Unreasonable delays by your client's management, inability to obtain sufficient documentation, significant unexpected changes in your assessed risk, restrictions on the scope of the audit.

• Material corrected misstatements. All material misstatement audit committee disclosure is required for misstatements that management corrected during the audit, even if individually below the clearly trivial threshold, if they are material in the aggregate or individually.

• Uncorrected misstatements. All misstatements that your client's management declined to correct, individually and in the aggregate, and whether your team concludes that the aggregate is material.

• Disagreements with management. Any substantive disagreements with management about accounting or auditing matters, even if resolved before the report date.

• Management's consultations with other accountants. If your client's management consulted another accounting firm about a significant accounting or auditing matter, their audit committee must be informed.

• Other material written communications. All material written communications between your team and your client's management must be made available to their audit committee. This includes management representation letters, engagement letters, and internal control deficiency letters.

Does your firm's post-engagement audit committee communication letter address each of these items explicitly with either a discussion or a statement that the item was not applicable to this engagement? A communication that covers only the items where something notable occurred is incomplete under AS 1301.

Rule 4: More of This Must Be in Writing Than Your Team Probably Realizes

Audit committee written communication requirements under PCAOB AS 1301 and AU-C 260 permit certain communications orally if documented in working papers. However, several categories must be in writing, and the "written" requirement is stricter than many small firm practitioners assume.

Required to be in writing under PCAOB AS 1301:

• Uncorrected misstatements and the basis for the auditor's conclusion that they are not material

• Material written communications between the auditor and management (which by definition are already in writing)

• Significant deficiencies and material weaknesses (under AS 1305, which requires written communication of internal control matters)

Under AU-C 260, significant deficiencies and material weaknesses under AU-C 265 must also be communicated in writing.

The documentation trap is treating oral communications as satisfying requirements that the standard directs be in writing. "We discussed uncorrected misstatements with the audit committee at the closing conference" documented in the workpapers is not the same as a written communication of those misstatements to the audit committee. If your team cannot produce a written document addressed to the audit committee that lists the uncorrected misstatements and the basis for the materiality conclusion, the written communication requirement has not been met.

What does your firm's current audit committee communication letter look like? Best practice is to maintain a standard template completed for every engagement. The letter should be addressed to your client's audit committee, dated, and retained in your engagement files. It should cover all required items with either a substantive disclosure or an explicit statement that the item was evaluated and determined not applicable. This letter is what your team should be producing and obtaining acknowledgment of receipt from the audit committee on every engagement.

Rule 5: The Annual Independence Communication Is Separate, Standing, and Frequently Missed

The audit committee independence communication required under PCAOB AS 1301 is distinct from the content-based audit findings communications above. It is a standing annual obligation that applies regardless of whether anything notable occurred in the current year's audit. Under AS 1301, the auditor must communicate, at least annually:

• All relationships between the auditor and the audit client (including the firm, affiliates of the firm, and audit team members) that, in the auditor's professional judgment, may reasonably be thought to bear on independence

• The auditor's assessment of its own independence

This communication must be in writing. It's required before the audit report is issued. And it must occur every year, whether or not any independence matters arose during the period. Your small firm auditing the same client for ten years that has never sent a written independence communication to their audit committee has a standing deficiency on every one of those ten engagement files.

The independence communication is also the vehicle for disclosing relationships that exist but do not impair independence, such as the audit team reviewing tax returns for an audit client under applicable independence rules. These relationships must be disclosed and the firm's independence assessment must be affirmed. Silence is not a permissible approach for your firm.

You can see how we integrate audit committee communication documentation into the broader engagement support workflow on the how it works page. Our offshore accounting service covers audit committee communication letter drafting, uncorrected misstatement schedules, and the independence communication template. Our quality control framework includes a pre-issuance check confirming that all required audit committee communications have been completed and documented in the engagement file. For firms updating their audit committee communication process for PCAOB or AU-C 260 compliance, our advisory service can run a gap analysis against the applicable standard.

For the full PCAOB AS 1301 requirements and the guidance document, see the PCAOB AS 1301 Communications with Audit Committees page, which is the authoritative source for public company audit committee communication requirements.

Audit Committee Communications Done Right: Before, During, and After the Engagement

The audit committee communication obligation is not a closing formality. It begins before fieldwork with the planned scope and significant risks, continues through the engagement with timely communication of difficulties and disagreements, and includes a standing annual independence communication that exists independently of the audit findings. Getting this right protects your clients' governance process, protects your firm from inspection findings, and builds the kind of relationship with audit committee members that makes the next engagement smoother.

If you'd like to discuss how we support audit committee communication documentation for CPA partners' public and private company audit engagements, book a scoping call with BusAcTa Advisors, and we'll walk your team through the communication template before you commit to anything.