What Is a Representation Letter in Auditing?

A representation letter in auditing is a written statement that a company’s management gives to its external auditor at the end of a financial statement audit, confirming the assertions management made during the audit and acknowledging that the financial statements are management’s responsibility. Auditing standards treat the letter as mandatory. Without it, the auditor cannot issue a clean opinion.

Who Signs It and When

The letter moves from management to the auditor. For public companies, the CEO and CFO (or officers in equivalent roles) sign, matching the officers who already certify financial reports under Sarbanes-Oxley.¹ For private companies, the AICPA standard calls for signatures from “management with appropriate responsibilities for the financial statements and knowledge of the matters concerned,” which in practice means the owner, president, or controller.²

The letter carries the same date as the auditor’s report.³ That date matters. It means management’s confirmations run through the end of audit fieldwork, including events that happened after the balance sheet date.

What Management Is Confirming

The content follows a standard structure set by auditing standards. Specific items shift with the company and engagement, but the same categories appear in almost every letter.

Responsibility for the Financial Statements

Management acknowledges that the financial statements belong to it, not to the auditor. That covers presentation of financial position, results of operations, and cash flows under the applicable framework, usually GAAP. It also covers responsibility for designing and running internal controls aimed at preventing and catching material misstatements from either error or fraud.³

Completeness of Information

Management certifies that the auditors received all financial records, supporting documents, and relevant data, including meeting minutes from shareholders, the board, and board committees.³ It also covers the names of all related parties and every transaction with them. This is where auditors nail down whether side deals, loans to executives, or transactions with entities owned by board members have been disclosed.

Unrecorded Liabilities

The letter states that no transactions have been left unrecorded and no material liabilities, contingent or otherwise, are missing from the books.³ Pending lawsuits, guarantee obligations, and similar exposures fall in here even when they don’t sit in the general ledger.

Fraud, Noncompliance, and Subsequent Events

Management must disclose any known or suspected fraud involving executives, employees with significant internal control roles, or anyone else whose fraud could materially affect the statements. The letter also requires disclosure of known violations of laws or regulations that should show up in the financials.³

Management also confirms that events occurring between the balance sheet date and the auditor’s report date have been handled properly, either through an adjustment or a disclosure.⁴ A company that learns of a major lawsuit or loses a key customer after year-end but before the auditor’s report date cannot stay quiet about it.

Uncorrected Misstatements

During the audit, auditors keep a running list of errors management chose not to correct, usually because they fell below materiality. The letter requires management to state that these uncorrected misstatements, individually and in total, are immaterial to the financial statements as a whole. A summary must be included in or attached to the letter.³ What counts as immaterial is often the most contested part of the letter.

How the Auditor Uses It

The letter is required audit evidence under both PCAOB and AICPA standards.³ It corroborates what the auditor learned through document inspection, testing, and interviews. It is never sufficient on its own. An auditor cannot skip an inventory count because management wrote a letter saying the count is accurate.

What the letter does add is a written record of management’s assertions. If a misstatement surfaces later, the auditor can point to the signed letter showing that management affirmed the opposite, and executives lose the option of claiming they were unaware.

What Happens if Management Refuses

A refusal is one of the most serious events that can happen during an audit. Under PCAOB standards, it is a scope limitation that is “ordinarily sufficient to cause an auditor to disclaim an opinion or withdraw from the engagement.”³ A disclaimer is a report saying the auditor cannot express any opinion on the financial statements. The AICPA standard for private companies reaches the same conclusion: disclaim or withdraw.²

In narrow cases the auditor may issue a qualified opinion instead, but only when the missing representations are limited in scope and the rest of the audit evidence is strong enough to support a partial opinion. The exception is rare. A refusal also puts the reliability of every other representation management made in doubt, which usually tips the outcome toward a disclaimer or withdrawal.

Which Standard Applies

Public companies follow PCAOB Auditing Standard 2805, enforced by the Public Company Accounting Oversight Board.³ Private companies follow AU-C Section 580, issued by the AICPA’s Auditing Standards Board.²

The core requirements overlap. Both call for written confirmation of management’s responsibility, completeness of information, fraud disclosures, related-party transactions, subsequent events, and uncorrected misstatements. The PCAOB version carries the additional weight of Sarbanes-Oxley compliance. AU-C 580 uses somewhat more detailed language around litigation, accounting estimates, and the reasonableness of significant assumptions.

Criminal Exposure for a False Letter

For public companies, a false representation letter is not just an audit problem. The same officers who sign it are also on the hook for the Sarbanes-Oxley certifications that financial reports fairly present the company’s condition.¹

Under 18 U.S.C. § 1350, an officer who knowingly certifies a financial report that does not comply with the law faces up to a $1,000,000 fine and 10 years in prison. If the certification is willful, the penalties climb to a $5,000,000 fine and up to 20 years.⁵ These provisions apply to publicly traded companies filing with the SEC. Private companies can face fraud liability under state law, but the Sarbanes-Oxley criminal provisions do not reach them.

Representation Letter vs. Management Letter

The names sound alike, but the documents move in opposite directions. The representation letter goes from management to the auditor and confirms what management asserts about the financial statements. The management letter (sometimes called the internal control deficiency letter) goes from the auditor to management and flags internal control weaknesses the auditor noticed during the audit.

A management letter might note that a company lacks segregation of duties in payroll, or that journal entries get approved without adequate review. Significant deficiencies and material weaknesses must be communicated in writing to those responsible for governance, and those findings keep reappearing until the company fixes them. The representation letter is a one-time document for each engagement. Management signs it, it goes into the audit file, and the engagement closes.

1
Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports
2
American Institute of Certified Public Accountants. AU-C Section 580 – Written Representations
3
Public Company Accounting Oversight Board. AS 2805 – Management Representations
4
Public Company Accounting Oversight Board. AS 2801 – Subsequent Events
5
Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports