AU-C 580 Written Representations: Signers, Content, and Refusal

AU-C 580 is the AICPA auditing standard that requires the auditor to obtain a signed letter from management confirming key facts about the financial statements and the information provided during the audit. Written representations under AU-C 580 are required audit evidence in every engagement conducted under generally accepted auditing standards, and if management refuses to provide the core representations, the auditor must either disclaim an opinion or withdraw from the engagement.¹

What the Letter Is and What It Is Not

A written representation is a signed letter addressed to the auditor in which management puts on record that it accepts responsibility for the financial statements, that the information given to the audit team was complete, and that specific matters the auditor needs to rely on are true to the best of management’s knowledge.

The standard is direct on one point that matters for planning the engagement: the letter is necessary evidence, but it is never sufficient on its own. Obtaining a representation letter does not reduce the amount of testing the auditor has to perform, and it does not change the nature of other audit procedures. It supports evidence gathered during fieldwork, particularly on matters where the only realistic source of information is management itself.

Who Signs

The letter has to come from the people with responsibility for and knowledge about the matters being affirmed. In most organizations that means the chief executive officer and the chief financial officer, or whoever holds equivalent positions.¹ In smaller organizations where one person wears both hats, a single signature may be appropriate. The auditor may also request representations from those charged with governance when they have financial reporting responsibilities distinct from management’s role.

Required Representations

Certain items must appear in every letter. If management cannot or will not provide any of the required items, the auditor faces a scope limitation that affects the opinion.

Responsibility for the Financial Statements

Management must confirm that it has fulfilled its responsibility for preparing and fairly presenting the financial statements under the applicable reporting framework. This representation also covers management’s responsibility for designing, implementing, and maintaining internal controls that produce financial statements free from material misstatement, whether caused by error or fraud.¹ Without this representation, the auditor has no basis for issuing any kind of opinion.

Completeness of Information

Management must state in writing that it provided the auditor with access to all relevant information, that it responded to any additional requests, and that the audit team had unrestricted access to anyone within the organization the auditor needed to speak with. Management must also confirm that all transactions have been recorded and are reflected in the financial statements.¹ The completeness assertion matters because the auditor has no way to independently verify that nothing was withheld.

Fraud

Under paragraph .12, management must confirm four things:

It accepts responsibility for designing and maintaining internal controls aimed at preventing and detecting fraud.
It has told the auditor the results of its own assessment of the risk that the financial statements could be materially misstated because of fraud.
It has disclosed any known or suspected fraud involving management, employees with significant internal control roles, or anyone else whose fraud could materially affect the financial statements.
It has disclosed any allegations of fraud communicated by employees, former employees, regulators, or others.¹

Related Parties, Subsequent Events, and Uncorrected Misstatements

Three further categories are required. Management must confirm it has identified all related parties and disclosed every related party transaction, and that those transactions have been properly accounted for and disclosed under the applicable framework. Management must state that all events occurring after the balance sheet date that require adjustment or disclosure have been properly handled. And management must affirm that it believes the effects of any uncorrected misstatements found during the audit are immaterial, individually and taken together, with a summary of those items included in or attached to the letter.¹

The uncorrected misstatement representation sometimes catches management off guard. Every audit turns up small errors that fall below the threshold for required correction, and management has to look at the full list and formally agree those items do not, in combination, push the financial statements into material misstatement territory. If the list is long or the items sit close to materiality, this can become a genuine point of discussion between the audit team and management.

Additional Representations the Auditor May Request

Beyond the mandatory items, the auditor can request other representations whenever they are needed to support audit evidence. Common additions include the appropriateness of accounting policies, management’s plans or intentions that could affect how assets and liabilities are valued or classified, contingent liabilities, encumbrances or liens on assets, compliance with laws and regulations, and whether any undisclosed side agreements exist.¹ The auditor may also ask management to confirm that all known internal control deficiencies have been communicated. Other AU-C sections sometimes trigger their own representation requirements; AU-C 570A on going concern, for example, may require a written representation about the entity’s ability to continue operating, depending on the circumstances.

Form, Dating, and Periods Covered

The letter must be written, addressed to the auditor, and signed by the appropriate members of management. Oral representations do not satisfy the standard. The format is a formal business letter, and the standard includes an illustrative example in its appendix that auditors commonly use as a template.¹

The letter must be dated as of the date of the auditor’s report on the financial statements and must cover all financial statements and periods referred to in that report.¹ The auditor’s report date is the day the auditor concludes that sufficient appropriate evidence has been obtained. Matching the letter to that date extends management’s representations through the last moment the auditor is gathering evidence. When comparative financial statements are presented, the letter needs to cover every period included in the report.

When Management Refuses or the Letter Looks Unreliable

A refusal to sign is one of the most serious situations an auditor can face, and the standard sets a clear escalation path.

If management will not provide the representations required under paragraphs .10 and .11, the financial statement responsibility and completeness representations, the auditor must either disclaim an opinion or withdraw from the engagement. There is no middle ground for these core items. The auditor should first discuss the refusal with management and try to understand the reason, but if the refusal stands, those are the only two outcomes.¹

If management refuses a requested representation outside the core set, the auditor must discuss the matter, reevaluate management’s integrity, consider how the refusal affects the reliability of other representations and audit evidence, and determine the impact on the opinion. Depending on the circumstances this could lead to a qualified opinion, a disclaimer, or withdrawal.¹

Sometimes the auditor receives the letter but has reasons to question whether the representations are reliable. If management’s written statements contradict other audit evidence, the auditor must perform additional procedures to try to resolve the inconsistency. If the conflict cannot be resolved, the auditor has to reconsider management’s competence, integrity, and ethical values, and determine what that means for the reliability of everything management has said during the audit.¹ If the doubt runs deep enough that the auditor concludes management’s integrity is compromised, the result is the same as a refusal of the core representations: disclaim or withdraw. A signed letter from someone the auditor does not trust is no better than no letter at all.

How It Relates to ISA 580 and PCAOB AS 2805

AU-C 580 applies to non-issuer audits in the United States. For audits conducted under international standards, ISA 580 covers the same ground and is substantially aligned in its requirements.² For audits of public companies, the PCAOB’s AS 2805 governs management representations and treats a refusal as a scope limitation that ordinarily leads to a disclaimer or withdrawal.³ One difference is worth flagging: under AS 2805 a qualified opinion may be appropriate depending on which representations were refused and why, whereas AU-C 580 draws a sharper line and mandates a disclaimer or withdrawal when the core responsibility and completeness representations are at issue.

1
AICPA. AU-C Section 580 – Written Representations
2
International Auditing and Assurance Standards Board. Written Representations – ISA 580
3
PCAOB. AS 2805 – Management Representations