Obtaining Written Representations ​

34. The auditor shall obtain written representations from management on the following aspects:

• Acknowledging management's responsibility for establishing and maintaining adequate controls for identifying, maintaining, controlling, and monitoring of audit trails as per the requirements on a consistent basis.
• Stating that management has performed an evaluation and assessed the adequacy and effectiveness of the company's procedures for complying to the requirements prescribed for audit trails.
• Stating management's conclusion, as set forth in its assessment, about the adequacy and effectiveness of the company's procedures in relation to audit trails.
• Stating that management has disclosed to the auditor all deficiencies in the design or operation of controls maintained for audit trails identified as part of management's evaluation.
• Describing instances where identification of fraud, if any, resulting in a material misstatement to the company's financial statements is identified while reviewing and testing the samples related to the disablement of audit trail facility of the accounting software.
• Stating whether control deficiencies identified and communicated to the audit committee in relation to audit trail during previous engagements have been resolved, and specifically identifying any deficiency that have not been resolved.

SA 580, “Written Representations” explains matters such as who may sign the letter, the period to be covered by the letter, and when to obtain an updated letter. Inability to obtain written representations from management including management's refusal to furnish them, constitutes a limitation on the scope of the audit. When the scope of the audit is limited, the auditor may either disclaim the audit opinion or resign from the engagement in accordance with Standards on Auditing.

Since the primary responsibility for establishing and maintaining audit trails is that of the management and the board of directors of the company, the management should ensure that the board of directors approving the financial statements of the company also takes on record the policies and procedures as laid down by the management in respect of assertion and conclusion on the adequacy and operating effectiveness of audit trails. Additionally, the board should also take on record the deficiencies, significant deficiencies and material weaknesses identified by the management, internal auditors, and the auditor. Refer Appendix II for an illustrative Management Representation Letter.