The signed audit report is the public outcome of a charity audit, but it is not always the document that drives the most operational improvement. Auditors often issue a separate management letter or report to trustees setting out control weaknesses, observations and recommendations identified during the engagement.

A charity audit management letter should not be treated as an administrative appendix that is acknowledged and filed. It gives trustees a structured opportunity to consider financial risk, challenge whether controls are working and agree improvements that fit the charity’s size and resources. Used well, it can strengthen governance long after the accounts have been signed.

This article explains what a management letter is, how findings should be evaluated and how trustees can turn recommendations into a realistic action plan. For a broader explanation of requirements, preparation and fieldwork, read Millet Audit’s charity audit guide and checklist.

What Is a Charity Audit Management Letter?

A management letter communicates matters identified during the audit that the auditor believes should be brought to the attention of management or those charged with governance. Depending on the firm and engagement, it may be called an audit findings report, report to trustees, report to the audit committee or internal-control letter.

The content can include significant audit risks, accounting judgements, unadjusted differences, control deficiencies, observations about processes and recommendations for improvement. It may also record management’s response, the person responsible and the proposed implementation date.

The management letter is separate from the independent auditor’s report included in the financial statements. The audit opinion addresses whether the financial statements give a true and fair view and have been prepared in accordance with the applicable framework and law. A charity can receive an unmodified audit opinion and still have management-letter recommendations. This does not create a contradiction. An audit opinion is not a statement that every internal control is perfect.

Why Findings Do Not Mean the Audit Has Failed

Trustees sometimes react defensively to a finding because they believe it implies poor management. In reality, most organisations have opportunities to improve controls, documentation or oversight. Systems change, staff leave, online banking develops, funding becomes more complex and procedures that were suitable for a small charity may not keep pace with growth.

The useful question is not whether a point exists, but what risk it represents and how the charity should respond. A recurring weakness that exposes money to fraud deserves urgent attention. A documentation improvement with low financial exposure may be addressed through routine process development. Both should be considered, but they do not necessarily require the same response or timetable.

Trustees should also recognise the scope of the audit. Auditors understand controls relevant to the financial-statement audit and report deficiencies identified through that work. The audit is not designed to find every operational weakness. A short management letter does not prove that the charity has no other risks, and a detailed letter does not automatically mean the organisation is badly run.

Common Types of Charity Audit Findings

Bank and Payment Controls

Findings may concern single-person payment authority, weak approval evidence, shared online-banking credentials, changes to supplier details, credit-card oversight or infrequent bank reconciliations. These issues can create direct exposure to error or fraud.

Where staff numbers are limited, full segregation of duties may be unrealistic. The response should identify a compensating control, such as independent trustee review of bank activity, dual authorisation above a threshold, monthly review of reconciliations or a separate check when supplier details change.

Income and Restricted Funds

Auditors may identify incomplete grant records, inconsistent income cut-off, unclear donor restrictions, late monitoring of restricted-fund expenditure or funds that remain in deficit. These findings affect both financial reporting and the charity’s duty to apply resources for their intended purposes.

The remedy may include a central register of grants, named budget holders, monthly fund reports and a formal review of new agreements before income is coded. Where a restriction is unclear, the charity may need to obtain clarification from the funder rather than make an unsupported assumption.

Payroll, Expenses and Related Parties

Control points may arise where salary changes are not independently approved, payroll reports are not reconciled, expenses lack evidence or declarations of interest are incomplete. Payments to trustees and connected parties require particular care because authorisation and disclosure rules may apply.

An action plan should combine policy with evidence. Updating the expenses policy is not enough if claims continue to be approved informally. The revised process should show who checks the claim, what documents are retained and how exceptions are reported.

Journals, Systems and Access

Manual journals can bypass normal transaction controls, particularly when one person can post and approve them. Findings may also cover excessive user permissions, dormant accounts, former employees who retain access, weak passwords or inadequate review of changes to standing data.

The charity should create a proportionate approval process for higher-risk journals, review access at least periodically and remove permissions promptly when roles change. Evidence of the review matters because a policy without an operating record is difficult for trustees or auditors to evaluate.

Financial Reporting and Trustee Oversight

Late management accounts, unreconciled balance-sheet items, generic reserves policies or limited evidence of budget challenge can indicate that trustees are not receiving timely financial information. A year-end audit cannot compensate for weak oversight during the year.

The response may involve a monthly close timetable, standard board pack, variance commentary, fund-level reporting and a schedule of recurring trustee reviews. Reports should be understandable to non-financial trustees while still containing enough detail to identify risk.

Evaluate the Risk Before Accepting the Recommendation

Auditor recommendations are important, but management and trustees remain responsible for selecting and operating the charity’s controls. The board should understand each finding rather than accept a standard response automatically.

Ask five questions. What could go wrong? How likely is it? What would the financial, legal, operational or reputational impact be? What control already reduces the risk? What additional action is proportionate? The answers should determine priority and ownership.

Consider whether the point represents a design deficiency or an operating failure. A design deficiency means the process lacks necessary control. An operating failure means a suitable control exists but was not performed consistently or cannot be evidenced. The solution differs: one requires redesign, while the other may require training, supervision or better documentation.

It is also helpful to identify the root cause. A late reconciliation may result from unclear responsibility, system limitations, staff capacity, insufficient training or an unrealistic reporting timetable. Asking only for the reconciliation to be completed does not resolve the underlying problem.

Use Clear Priority Categories

Management letters often assign ratings such as high, medium and low. Trustees should understand how the auditor defines them. A high-priority issue may involve a significant risk of material error, fraud, regulatory breach or loss. A lower-priority point may improve efficiency or documentation without creating the same immediate exposure.

The charity can use its own risk framework, provided the mapping is clear. Priority should consider more than monetary value. A relatively small transaction can create serious safeguarding, regulatory or reputational consequences. Conversely, a large balance supported by strong independent evidence may carry less control risk than its size suggests.

Do not allow a low rating to become permission for indefinite delay. If an action is worthwhile, assign a realistic completion date. If trustees decide not to implement it, record the reason and the alternative control relied upon.

Write a Management Response That Commits to Action

A weak response says “noted” or “will be reviewed”. A strong response states whether management agrees, what will change, who owns the action and when it will be completed. It should be specific enough for trustees to verify later.

For example, instead of promising to improve bank controls, the response could state that from the following month all new supplier-bank details will be verified independently using a known contact, evidence will be retained with the payment record and the finance manager will review exceptions quarterly. This describes an observable process.

Where management disagrees, the response should explain the facts. The auditor may have misunderstood the process, or the recommended control may be disproportionate. An alternative can still address the underlying risk. Constructive challenge is appropriate, but rejecting a finding because it is inconvenient is not.

Build a Trustee Action Tracker

Transfer every agreed point into a central tracker. Record the finding, risk, agreed action, priority, owner, due date, current status, evidence of completion and trustee-review date. Link it to the relevant policy, procedure or control record.

The tracker should distinguish implementation from closure. An owner may mark an action complete, but somebody independent should verify that the new control exists and operates. For a revised bank-reconciliation review, evidence might include three months of signed review records. For an access-control action, it might include the user-permission report and approval of the review.

Bring overdue high-priority actions to the board or audit committee rather than allowing deadlines to roll forward without explanation. If circumstances change, agree a new date and record why. Transparency is better than a tracker that appears green because dates are repeatedly rewritten.

Monitor Whether the Control Actually Works

Implementation is only the first stage. Trustees need assurance that the change is embedded. Internal spot checks, management review, exception reporting or internal audit can test whether people follow the revised process.

Smaller charities may not have an internal-audit function, but they can still perform targeted monitoring. A trustee who is not involved in day-to-day payments could review a sample of supplier changes and approvals. The treasurer could inspect evidence of monthly bank reconciliation. The board could compare restricted-fund reports with grant milestones.

The Charity Commission’s internal financial controls guidance emphasises that all trustees retain responsibility even when detailed work is delegated. Monitoring should therefore provide the board with enough evidence to fulfil that responsibility.

Deal With Recurring Findings Differently

A repeated point deserves more scrutiny than a first observation. It may show that the previous action was too vague, the owner lacked authority or resources, the root cause was not addressed or the board did not monitor progress.

For every recurring finding, compare the previous response with what happened in practice. Was the policy changed but not communicated? Was a control introduced but performed only occasionally? Did staff turnover remove the person responsible? Did the system make the control impractical?

The new action should address that failure. It may require a different owner, automated control, additional training, clearer evidence or a shorter monitoring cycle. High-risk recurring findings should be visible in the charity’s risk register and may need direct audit-committee oversight.

Link Audit Findings to Wider Governance

Management-letter actions should not sit in isolation from the risk register, policies, staff objectives and board work plan. A payment-control weakness may relate to fraud risk. Incomplete grant monitoring may relate to funding and service-delivery risk. Weak forecasting may affect going concern and reserves.

Connecting these systems prevents duplication and helps trustees understand the wider consequence of a point. It also allows the charity to prioritise improvements that address several risks at once.

Material findings may need to influence the trustees’ annual report, particularly the discussion of principal risks, governance or financial sustainability. The wording should be balanced and should not imply that a control operated effectively throughout the year if it did not.

Understand the Auditor’s Wider Reporting Responsibilities

Some matters go beyond an ordinary management recommendation. Auditors and independent examiners of charities have duties to report certain matters of material significance to the relevant charity regulator. A modified audit opinion, evidence of dishonesty or fraud, serious governance failures or other specified matters may require separate reporting depending on the facts and jurisdiction.

Trustees should not assume that a confidential management response prevents regulatory reporting. The better approach is to disclose significant issues promptly, cooperate with the auditor and regulator and demonstrate that the board is taking appropriate action.

Audit standards also continue to develop. The Financial Reporting Council publishes the current UK auditing standards, including requirements concerning risk assessment, fraud and going concern. Trustees do not need to master the standards, but they should understand why auditors ask questions about these areas.

Use the Next Audit to Confirm Progress

Before the following year’s planning meeting, management should review the prior management letter and prepare evidence for every completed action. The audit team will often ask for an update, particularly where a point affected financial reporting or key controls.

Do not wait for the auditor to chase. A short paper can summarise the action, implementation date, monitoring performed and result. This demonstrates governance and helps the auditor understand the current control environment.

If an action remains open, explain the reason and interim control. A transparent plan is more credible than marking a partially implemented change as complete. It also allows the auditor to plan appropriately.

Turn Audit Findings Into Measurable Improvements

A management letter is most valuable when it produces proportionate, durable change. Trustees should focus on the risk behind each finding, agree on a specific response and obtain evidence that the new control works. They should also challenge recurring issues and connect audit actions with the charity’s wider governance framework.

Millet Audit communicates findings clearly and works with trustees and finance teams to agree practical recommendations appropriate to the organisation. If your charity is considering a new auditor or wants a more focused audit process, learn more about Millet Audit’s specialist charity audits or contact the team to discuss the next financial year.