A management letter that lists twenty vague ‘strengthen controls’ points helps no one. We limit observations to issues that either affect the audit opinion path or create a realistic risk of loss.

Each point names the process, the gap, the evidence we saw, and a concrete fix. ‘Segregate cheque signing from vendor master edits’ is usable; ‘improve IT general controls’ is not, unless we specify which access right is wrong.

We rank items as significant deficiencies or lesser observations so boards can prioritise. Ranking also stops every finding from sounding equally urgent.

Clients who reply in writing—even briefly—create a record that next year’s team can follow. Silence leaves the same points to resurface with less patience.

Ask for a draft letter before the closing meeting. Clarifying facts while memories are fresh keeps the final document accurate and shorter.

← Back to field notes