@for425:
Significant deficiencies are less pervasive than material weaknesses, so we have no responsibility to actively search for them. However we do communicate them should they come to our attention. A test could very easily discover a material weakness yet fail to discover a significant deficiency- and that is perfectly fine. We are only responsible for providing reasonable assurance against material weaknesses.
@Dmb2stepper:
I can't find anything for nonissuers, but GAGAS specifies to report deficiencies as soon as discovered if the urgency or significance of findings requires faster corrective actions or follow-up or when ongoing noncompliance undetected by management should be stopped.
For a nonissuer, a control deficiency can be communicated orally to management. A significant deficiency (more severe) shall be communicated in writing to both management and those charged w governance.
FAR- 80
BEC- 75
AUD- 78
REG- ?