Terminology first, because I am that person. The management letter proper is the one the auditor writes to management about control weaknesses. What I am talking about is everything management writes back: representation letters, responses to audit queries, the board's answer to a regulator, the four sentences approved at midnight for an announcement that goes out before the market opens.
None of the sentences below are quotations. Each is a composite, welded together from the several dozen versions of it I have read across fourteen years. If one of them sounds like something you have drafted, that is the point and it does not make you a fraudster. Four of the five have perfectly innocent uses. The fifth I have never once seen used innocently, and I will get to why.
Our third-party partners are contractually prohibited from providing transaction-level data to the Group or to its auditors.
Rhetorically this is a lovely piece of work. It takes a missing document and moves it somewhere that asking again would be unprofessional. "We cannot show you" becomes "we are not permitted to show you", which reads as compliance rather than obstruction, and it flatters the reader by assuming they are commercial enough to understand. Nobody wants to be the auditor who does not understand confidentiality.
What it usually hides is that the data does not exist in the shape described. Occasionally there is a real restriction, and then the answer is easy: a confidentiality clause binds the counterparty, so ask the counterparty to confirm directly to the auditor, which no clause prevents them from doing about their own affairs. When the counterparty will not do that either, you have your finding, and you did not need the data. I now ask for the clause before I ask for the data. In my experience the clause either does not exist or says the opposite.
Management has reviewed the balance and is satisfied as to its recoverability.
The sentence names no procedure, no reviewer, no date and no comparison. Satisfaction is a state of mind, so what is being reported here is a mood. It cannot be wrong, which is the whole design: you cannot audit a feeling, so there is nothing to test and nothing to contradict.
Watch what it substitutes. In place of a procedure it offers the seniority of the person satisfied. That works on a surprising number of people, and it works best on the young and the tired, which describes most of the profession in March. What it hides is either that nothing was done, or that something was done and produced a figure the writer did not want on paper. The second is more common and the working papers usually still exist somewhere, because whoever did the work was proud of it.
The matter has been reviewed by our external advisers and no evidence of wrongdoing was identified.
This one is a statement about a search, dressed as a statement about the world. It is fully compatible with advisers who were asked one narrow question, with advisers who asked for documents and did not get them, and with a report of 74 pages of which this sentence quotes the only line that photographs well.
So I ask for the engagement letter first and the report second. Scope is decided in the engagement letter, months before anybody finds anything, usually by the same people the review is about. Read the scope, then read the limitations paragraph, and the sentence in the announcement will look completely different. Where a review says it could not obtain the records it needed, that is a result. It is just not the result being reported.
The balance represents a timing difference which reverses in the following period.
It is the only sentence in the letter with its verb in the future, and that alone should catch your eye, because a balance sheet is a claim about a Tuesday that has already happened. This is an assertion about events that have not occurred yet, offered as support for events that have.
Timing differences are real, common and boring, so the innocent version of this sentence appears constantly. The test is trivial and almost nobody applies it: go and look at the following period. Reversal is a fact you can inspect, not a forecast you have to accept. If the same explanation appears three years running against the same counterparty, then the explanation is the balance, and the balance is somebody's salary.
These weaknesses had already been identified by management, and a remediation programme was underway prior to the review.
This is the most damning sentence in the set and it is written to sound like the least.
The other four are all about the absence of evidence. This one supplies evidence, against its own author, and dates it. It is drafted to take the sting out of a control finding by claiming priority over it: we knew, we were already fixing it, you have told us nothing new. Read as an admission, which is what it is, it establishes knowledge, and knowledge is the hinge on which everything downstream turns. Negligence and dishonesty are separated by what a person knew and when. A defence that opens with "we knew, earlier than you think" has done a large part of somebody else's work.
It has a second use, which is why I circle it in red. Because the sentence is usually true, it is a dating tool. If management knew in the second quarter, then there was an internal document in the second quarter, and internal documents have authors, distribution lists and reply chains. The remediation programme has a project name, a budget code and a workstream lead who has kept everything. I have opened more matters from a remediation plan than from any ledger.
Nothing in this is clever, and none of it requires a fraudster to be stupid. These sentences are written by tired competent people under pressure to produce a paragraph that is technically defensible and practically empty, which is a real skill and is taught, badly, on the job. Rosa Ibanez has written about a good word being hollowed out by the people who use it most often: @nightshift/the-word-resilience-has-been-taken-from-us. This is the accounting version. The vocabulary of assurance gets worn smooth by the people who need it to mean nothing.