The auditor should communicate to management and those charged with governance, in writing, all significant deficiencies and material weaknesses found during the audit of the internal controls of a non issuer (including those remediated during the integrated audit and those that were previously communicated in writing, but which have not been corrected).

The auditor must communicate, in writing, to management and the audit committee, all material weaknesses identified during the audit. The written communication should be made prior to the issuance of the auditor's report on internal control over financial reporting.

Nonissuers

The auditor is required to report on both the company's financial statements and on its internal control over financial reporting. Two separate reports, or one combined report (that is, one report containing both an opinion on the financial statements and an opinion on internal control), may be issued.

Issuers

The auditor is required to report on both the company's financial statements and on its internal control over financial reporting. Two separate reports, or one combined report (that is, one report containing both an opinion on the financial statements and an opinion on internal control), may be issued.

Scope Limitations

The auditor should withdraw from the engagement or issue a disclaimer of opinion if the scope of the audit is restricted.

Use of Component Auditor (Other Auditor)

As is the case with a financial statement audit, a component auditor (other auditor) may be involved in the audit of an entity's internal control. The group engagement partner (principal auditor) decides whether the involvement of the other auditor warrants reference in the auditor's report.

Subsequent Events

As is the case with a financial statement audit, subsequent events (in this case, changes in internal control) may occur after the "as of'' date of the report, but prior to the date of the auditor's report.