**MCQ 3 — SA 260 × SA 265**

**A deficiency can exist even when no misstatement occurred**

During the audit of **Nova Ltd.**, the auditor discovers that employees in the procurement department can create new vendors in the ERP system without independent approval.

The following additional facts are established:

no unauthorised vendor was actually identified during the audit;
monthly analytics performed by the finance controller compare vendor master data with supporting documentation;
the analytics control has operated consistently;
because of this compensating control, the auditor assesses the likelihood of an undetected material misstatement arising from the vendor-master weakness as low;
nevertheless, the auditor believes the absence of preventive authorisation is important enough to merit the attention of those charged with governance.

The CFO argues:

“Since the compensating control operates effectively and there is no identified misstatement, this is not an internal-control deficiency that needs to be communicated.”

Which ONE of the following is **most appropriate**?

**A.** The CFO’s position is correct because an internal-control deficiency exists only when the auditor identifies an actual or probable financial statement misstatement.

**B.** The CFO’s position is correct because an effective compensating control eliminates the underlying deficiency for purposes of SA 265.

**C.** The CFO’s position is not correct; the absence of a control necessary to prevent or detect and correct misstatements on a timely basis can constitute a deficiency, and whether it is a significant deficiency depends on the auditor’s professional judgment regarding its importance to TCWG.

**D.** The CFO’s position is not correct only because every deficiency in the vendor-master process is required to be communicated in writing to TCWG regardless of its significance.