What Is a Management Letter After an Audit?

A clean audit opinion does not mean an organization has nothing left to improve. During fieldwork, auditors may identify control gaps, process inefficiencies, or governance practices that deserve management’s attention but do not rise to the level of a material misstatement. This is where the question, what is a management letter, becomes highly relevant for CFOs, executive directors, controllers, and audit committees.

A management letter is a written communication from an auditor to management and, in many cases, those charged with governance. It describes observations identified during the audit and recommends practical improvements to internal controls, financial reporting processes, compliance procedures, or operational oversight. It is not the financial statement audit report, and it does not replace required communications about material weaknesses or significant deficiencies.

For an institutionally accountable organization, a well-considered management letter can provide one of the clearest pictures your board will ever get of where financial and compliance practices can become more disciplined before an issue becomes more serious.

What Is a Management Letter in an Audit?

A management letter is generally used to communicate matters that merit attention but may fall below the threshold for formal reporting as a significant deficiency or material weakness. The letter often reflects the auditor’s independent perspective on the organization’s control environment and day-to-day financial practices.

Its purpose is constructive. Auditors are not directing management’s operations or assuming management responsibility. Rather, they identify conditions observed through audit procedures, explain the related exposure, and offer recommendations for consideration. Management retains responsibility for assessing the recommendation, deciding on a response, and implementing corrective action.

The exact content depends on the organization and the scope of the engagement. For example, a nonprofit receiving substantial restricted funding may receive observations concerning grant documentation, allocation methodologies, or timely reconciliation of donor restrictions. A school district may receive recommendations related to purchasing approvals, payroll change controls, or segregation of duties. A HUD-assisted housing entity may need stronger support for tenant-file reviews or program-specific reporting.

What a Management Letter Typically Includes

A useful management letter is specific enough to support action. It generally identifies the condition observed, explains why it matters, describes the potential risk, and recommends a reasonable corrective measure.

An observation might state that bank reconciliations were prepared on time but lacked documented supervisory review. The associated risk is that errors, unusual transactions, or unreconciled items could remain undetected. The recommendation may be to require a designated reviewer to sign and date each completed reconciliation, with evidence of follow-up on reconciling items.

The best letters avoid vague statements such as “improve controls.” They connect the issue to the organization’s actual processes, staffing structure, funding requirements, and governance responsibilities. A practical recommendation also accounts for proportionality. A small nonprofit with limited accounting staff cannot always segregate every financial duty in the same way as a large municipality. In that setting, compensating controls, such as increased executive review or board treasurer oversight, may be more realistic and equally meaningful.

Management Letter Findings Versus Audit Findings

The terminology can create confusion because not every observation has the same level of consequence. Audit standards require auditors to communicate certain internal control matters to management and those charged with governance. A management letter may supplement those required communications, but it should not be treated as a substitute for them.

A material weakness is a deficiency, or combination of deficiencies, creating a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected and corrected on a timely basis. This is the most serious category of internal control deficiency and requires formal written communication.

A significant deficiency is less severe than a material weakness but important enough to merit the attention of those charged with governance. It also requires formal communication. Depending on the circumstances, it may be included in a separate required communication letter or addressed alongside other audit communications.

A management letter observation is often less severe. It may concern an opportunity to strengthen documentation, improve review procedures, formalize a policy, or reduce operational risk. That does not make it optional. Repeated smaller issues can signal a broader weakness in financial management, especially when an organization relies on federal awards, public funding, restricted contributions, or lender reporting.

For Single Audits and governmental audits, auditors may also report compliance findings, questioned costs, and internal control findings under the applicable federal or governmental framework. Those findings have prescribed reporting requirements and should not be casually characterized as management letter comments. The distinction matters to boards, regulators, pass-through entities, and funding agencies.

Why Boards and Audit Committees Should Take It Seriously

A management letter is not a scorecard on the finance team. It is an independent tool for governance. Board members and audit committee members should use it to understand where management’s existing procedures may be vulnerable to error, inconsistency, insufficient documentation, or avoidable compliance exposure.

The most effective boards ask direct questions: Is the observation isolated or recurring? Has the condition affected reporting, grant compliance, cash management, or program operations? Who owns the corrective action? What resources are needed? When will the board receive confirmation that the response has been implemented?

This level of attention is particularly important when an organization is experiencing turnover in finance personnel, rapid growth, new funding streams, a system conversion, decentralized operations, or heightened regulatory scrutiny. Controls that worked well at a smaller scale may no longer provide adequate oversight.

At the same time, boards should avoid overcorrecting. Not every recommendation calls for a new software platform, an additional staff position, or a lengthy policy manual. The appropriate response depends on the risk, the institution’s size, and the controls already in place. Good governance means addressing the underlying exposure without creating procedures that staff cannot sustain.

How Management Should Respond

Management’s written response is often included with the management letter or provided separately. It should be candid, specific, and accountable. A response that simply says “management agrees” gives the board little assurance that the matter will be resolved.

A stronger response identifies the action to be taken, the individual responsible, and a realistic target date. If management does not agree with the recommendation, it should explain why and describe the alternative controls that address the identified risk. In some cases, an auditor’s recommendation may not fit the organization’s operating model, but the risk still requires a thoughtful response.

For example, management may respond that monthly bank reconciliations will be reviewed by the CFO beginning immediately, that review evidence will be retained in the accounting system, and that the audit committee will receive a quarterly exception report. That response establishes ownership, documentation, and oversight.

Management should also maintain an internal remediation tracker. This is especially valuable for entities subject to Uniform Guidance, Yellow Book requirements, HUD oversight, Medicaid or HHS reporting, or recurring lender and investor reporting. The tracker should distinguish completed actions from planned actions and document evidence of implementation. When the next audit begins, management can demonstrate that prior observations were addressed rather than merely acknowledged.

When No Management Letter Is Issued

Not every audit produces a management letter. An auditor may have no additional observations to communicate, or all relevant matters may be addressed through required governance communications. The absence of a management letter is generally positive, but it is not a certification that every control is perfect.

An audit is designed to obtain reasonable assurance that the financial statements are free from material misstatement. It is not designed to identify every inefficiency, compliance risk, or control improvement opportunity. Organizations with complex funding, multiple locations, or significant regulatory obligations should maintain their own ongoing risk-assessment and internal-control review processes between annual audits.

A management letter is most valuable when it leads to disciplined follow-through. Treat each observation as an opportunity to clarify accountability, strengthen evidence, and give leadership greater confidence that financial stewardship is keeping pace with the organization’s mission and obligations.