Key Takeaways
- ISA 580 requires the auditor to obtain written representations from management confirming responsibility for the financial statements, internal control, and that all relevant information and access have been provided (ISA 580.10–11). These are mandatory on every engagement.
- Beyond the mandatory paragraphs, other ISAs require engagement-specific representations: ISA 240 (fraud), ISA 450 (unadjusted misstatements), ISA 540 (estimates), ISA 550 (related parties), ISA 560 (subsequent events), and ISA 570 (going concern).
- The representation letter should be dated on the same day as the audit report, or no more than one or two days before (ISA 580.14). A significant gap is a finding.
- If management refuses to provide the mandatory representations, the auditor must disclaim the opinion (ISA 580.20). No exceptions.
- Written representations are not a substitute for audit procedures. ISA 580.A1 states they do not provide sufficient appropriate audit evidence on their own.
What ISA 580 requires and what it does not
ISA 580 establishes two categories of written representations. The first category (ISA 580.10–11) covers management's acknowledgement of its responsibilities: responsibility for the preparation of the financial statements in accordance with the applicable framework, responsibility for internal control relevant to the preparation of financial statements free from material misstatement, and confirmation that all relevant information and access have been provided to the auditor. These representations are mandatory on every engagement. If management refuses to provide them, ISA 580.20 requires the auditor to disclaim the opinion. There is no middle ground.
The second category (ISA 580.13) covers additional representations the auditor determines are necessary to support other audit evidence. These are engagement-specific. They depend on the risks identified, the judgments made, and the areas where audit evidence from other sources is limited. The distinction matters because the first category carries a nuclear consequence (disclaimer), while the second category carries a scope limitation consequence (qualified opinion or disclaimer depending on materiality and pervasiveness, per ISA 580.19).
What ISA 580 does not require: the representation letter is not a substitute for audit procedures. ISA 580.A1 states directly that written representations do not provide sufficient appropriate audit evidence on their own about any of the matters with which they deal. A representation that inventory is fairly stated does not replace an inventory count. A representation that provisions are complete does not replace testing the provision calculations. If the auditor is relying on the representation letter as the primary evidence for a material balance, the file has a scope limitation regardless of whether the letter is signed.
The mandatory representations: what every letter must contain
ISA 580.10–11 and the illustrative letter in ISA 580 Appendix 2 provide the baseline. Every representation letter must include these paragraphs, adapted for the applicable financial reporting framework.
The responsibility representation (ISA 580.10a)
Management confirms it has fulfilled its responsibility for the preparation of the financial statements in accordance with the applicable framework, including (where relevant) their fair presentation. The wording must match the responsibility description agreed in the engagement letter under ISA 210.6(b)(i). If the engagement letter says management is responsible for preparation in accordance with IFRS, the representation letter must use the same language.
The information representation (ISA 580.11)
Management confirms it has provided the auditor with all information relevant to the preparation of the financial statements as agreed in the terms of the engagement, that all transactions have been recorded and reflected in the financial statements, and that the auditor has been given access to all relevant records and personnel. This is not a formality. If a reviewer finds that management withheld information during the audit (for example, an undisclosed related party transaction), the signed representation letter is evidence that management made a false statement. The auditor's reliance on it becomes the question.
The internal control representation (ISA 580.10b)
Management acknowledges its responsibility for internal control that management determines is necessary to enable the preparation of financial statements free from material misstatement, whether due to fraud or error. This does not require management to assert that internal controls are effective. It requires management to acknowledge that the responsibility is theirs.
No knowledge-and-belief qualifier on mandatory representations
These representations are not qualified with "to the best of our knowledge and belief." ISA 580.A8 is explicit: the responsibility representations in paragraphs 10 and 11 are not subject to the knowledge-and-belief qualifier, because they relate to management's own actions and responsibilities, not to factual matters that might be outside management's full knowledge.
Engagement-specific representations required by other ISAs
Beyond the ISA 580 mandatory paragraphs, other ISAs require specific representations. These must be included in the letter if the relevant circumstances exist on the engagement.
ISA 240 (fraud)
Management confirms that it has disclosed to the auditor the results of its assessment of the risk that the financial statements may be materially misstated as a result of fraud, that it has disclosed all known instances of fraud or suspected fraud affecting the entity involving management, employees with significant roles in internal control, or others where the fraud could have a material effect, and that it has disclosed all allegations of fraud communicated by employees, former employees, regulators, or others (ISA 240.39).
ISA 450 (unadjusted misstatements)
Management confirms that the effects of uncorrected misstatements are immaterial, individually and in aggregate, to the financial statements as a whole. A list of the uncorrected misstatements is attached to the representation letter (ISA 450.14). This is one of the most frequently omitted items. If the auditor has identified misstatements that management declined to correct, the representation letter must include this confirmation with the attached schedule.
ISA 550 (related parties)
Management confirms that it has disclosed to the auditor the identity of the entity's related parties and all related party relationships and transactions of which it is aware, and that it has appropriately accounted for and disclosed those relationships and transactions (ISA 550.26).
ISA 560 (subsequent events)
Management confirms that all events occurring subsequent to the date of the financial statements and for which the applicable framework requires adjustment or disclosure have been adjusted or disclosed.
ISA 570 (going concern)
Where relevant, management confirms that its plans for future actions in relation to its going concern assessment are feasible, that all relevant information relating to going concern has been disclosed, and that management believes the going concern basis of accounting is appropriate. This representation is only required when events or conditions have been identified that may cast significant doubt on the entity's ability to continue (ISA 570.16e). It is not a default inclusion on every letter. If the going concern checklist indicates no material uncertainty conditions, this representation is unnecessary.
ISA 540 (accounting estimates)
Where estimates are significant, management confirms that the methods, significant assumptions, and data used in making accounting estimates and related disclosures are appropriate in the context of the applicable framework (ISA 540.37).
How to add client-specific representations without overloading the letter
ISA 580.13 allows the auditor to request additional representations to support other audit evidence. In practice, representation letters go wrong in two directions.
The first failure: the letter includes no client-specific representations at all. It is a generic template with the ISA 580.10–11 paragraphs and nothing else. A reviewer comparing the representation letter to the audit file's risk assessment will see significant risks that have no corresponding representation. If the entity has a material litigation provision, a representation about the completeness of litigation disclosures should be in the letter. If the entity has complex revenue arrangements, a representation about the appropriateness of the revenue recognition policy should be in the letter.
The second failure: the letter includes 40 client-specific representations covering every conceivable risk, turning it into a contract-length document that management signs without reading. An unread representation letter is not evidence of anything. ISA 580.A2 notes that written representations provide audit evidence, but their reliability depends on whether management has been informed about the matters covered. A representation letter that management could not reasonably have read before signing has reduced evidential value.
The practical rule
Add a client-specific representation for every significant risk identified in the planning memorandum where the audit evidence from other sources is inherently limited. Estimates, legal matters, management intent (for example, the intention to hold an investment to maturity), and matters where the information is confined to management. One representation per significant area, stated in one or two sentences. No more than four to six client-specific additions beyond the standard paragraphs.
Dating and signing: the timing rules that generate findings
ISA 580.14 requires the date of the written representations to be as near as practicable to, but not after, the date of the auditor's report. ISA 580.15 requires the representations to cover all financial statements and periods referred to in the auditor's report.
In practice, this means the representation letter should be dated on the same day the audit report is signed, or no more than one or two days before. A representation letter dated two weeks before the audit report creates an unaddressed gap. Events could have occurred in that gap that would have required a different representation. The fix is procedural: schedule the representation letter signing as the last step before the audit report is issued, not as a task completed during fieldwork.
The letter must be addressed to the auditor. It must be on the entity's letterhead. ISA 580.A19 confirms the required form: a letter from management to the auditor. In practice, the auditor drafts the letter and management reviews it, then signs and issues it on entity letterhead. This is standard practice and ISA 580 does not prohibit it. But the auditor must ensure management has actually read the letter and understood its contents. A letter that management signs sight-unseen is a compliance risk, not audit evidence.
Who signs
ISA 580.9 requires the representations to come from management with appropriate responsibilities for the financial statements and knowledge of the matters concerned. In practice, this means the CEO (or managing director) and the CFO (or finance director). For smaller entities with a single director-owner, that person signs. ISA 580.A4–A6 recognises that the appropriate signatory depends on the entity's governance structure.
What to do when management pushes back
Management refuses to provide a specific representation. ISA 580.16–19 sets out the response in a decision sequence.
If management does not provide one or more of the mandatory representations (ISA 580.10–11), the auditor must disclaim the opinion under ISA 580.20. No exceptions. The mandatory representations relate to management's responsibilities under the terms of the engagement. If management won't acknowledge those responsibilities, the auditor cannot conduct the audit.
If management does not provide one or more engagement-specific representations (ISA 580.13), the auditor must consider why (ISA 580.17), determine whether it affects the reliability of other representations (ISA 580.18), and take appropriate action including the possible effect on the auditor's opinion under ISA 580.19. The appropriate action depends on the representation. If management refuses to represent that litigation disclosures are complete, the auditor has a scope limitation on legal provisions and must assess whether the matter is material and pervasive.
If management modifies a representation (adds qualifying language), the auditor must evaluate whether the modification affects the reliability of the representation and whether additional audit procedures are needed (ISA 580.A27). A common modification: management changes "we confirm that all related party transactions have been disclosed" to "to the best of our knowledge, all related party transactions have been disclosed." For ISA 580.13 representations, the knowledge-and-belief qualifier is acceptable (ISA 580.A7–A8). For the ISA 580.10–11 mandatory representations, it is not.
Worked example: Dijkstra Logistics B.V.
Client profile: Dijkstra Logistics B.V., a freight forwarding company based in Rotterdam. Revenue: €42M. Reporting framework: Dutch GAAP. Year-end: 31 December 2025. Audit report date: 15 March 2026. One significant estimate (provision for onerous contracts, €1.4M). One ongoing legal claim (€800K, disclosed in the notes). Revenue recognition identified as a significant risk under ISA 240.26.
The representation letter for Dijkstra Logistics B.V. contains the following sections:
Mandatory representations (ISA 580.10–11)
The managing director (A. Dijkstra) and the finance director (M. Hendriks) confirm that they have fulfilled their responsibility for the preparation of the financial statements in accordance with Titel 9, Boek 2 BW. They confirm their responsibility for internal control relevant to the preparation of financial statements free from material misstatement. They confirm that all information relevant to the preparation of the financial statements has been provided to the auditor, that all transactions have been recorded, and that access to all records and personnel has been provided.
Documentation note
These paragraphs are not subject to a knowledge-and-belief qualifier. They must match the engagement letter wording under ISA 210.
ISA-required engagement-specific representations
Fraud (ISA 240.39): management confirms disclosure of its fraud risk assessment, all known or suspected fraud, and all fraud allegations received.
Unadjusted misstatements (ISA 450.14): management confirms that two unadjusted misstatements totalling €18,400 are immaterial, individually and in aggregate. The schedule of unadjusted misstatements is attached.
Related parties (ISA 550.26): management confirms disclosure of all related party identities and transactions.
Subsequent events (ISA 560): management confirms that all subsequent events requiring adjustment or disclosure have been addressed.
Documentation note
The ISA 570 going concern representation is not included because the going concern assessment identified no events or conditions casting doubt on continuity. Record this omission decision in the file.
Client-specific representations (ISA 580.13)
Onerous contracts provision: management confirms that the assumptions used to calculate the provision for onerous contracts (€1.4M, covering two loss-making freight contracts expiring in Q3 2026) are reasonable and that no additional onerous contracts exist at the balance sheet date. This representation is included because the provision is a significant estimate and the underlying assumptions (expected loss per shipment, remaining contract volume) are within management's knowledge.
Legal claim: management confirms that the €800K legal claim disclosed in the notes represents the best estimate of the probable outflow, that no other material legal claims exist that have not been disclosed, and that legal counsel's assessment has been shared with the auditor.
Documentation note
Each client-specific representation maps to a significant risk in the planning memorandum. Cross-reference the representation to the ISA 540 estimate evaluation working paper (onerous contracts) and the ISA 501 litigation confirmation (legal claim).
Dating and signing
The letter is dated 15 March 2026, matching the audit report date. Both A. Dijkstra and M. Hendriks sign the letter on entity letterhead. The signed letter is obtained before the audit report is issued.
The letter runs to two pages. It contains the mandatory paragraphs, four ISA-required representations, and two client-specific representations. A reviewer can match every representation to a risk in the file.
Practical checklist for your representation letter
- Confirm that the ISA 580.10–11 mandatory paragraphs are present and worded consistently with the engagement letter under ISA 210. These paragraphs must not include a knowledge-and-belief qualifier.
- Check whether ISA 240 (fraud), ISA 450 (unadjusted misstatements), ISA 550 (related parties), ISA 560 (subsequent events), ISA 570 (going concern), and ISA 540 (estimates) require representations on this engagement. Include each one that applies, omit each one that does not, and document the omission decision.
- Add one client-specific representation for each significant risk where audit evidence from other sources is inherently limited. Cap the total at four to six additions beyond the standard paragraphs.
- If unadjusted misstatements exist, attach the schedule of uncorrected misstatements to the letter. A representation that misstatements are immaterial without an attached schedule is incomplete (ISA 450.14).
- Date the representation letter on the same day as the audit report. Schedule the signing as the final step before the report is issued, not as a fieldwork task.
- Confirm that both signatories have read the letter. If the letter was drafted by the audit team, obtain explicit confirmation that management reviewed and understood the contents before signing.
Common mistakes reviewers flag
- The FRC's 2022–23 inspection findings identified representation letters that did not include the ISA 450.14 representation about unadjusted misstatements, despite the audit file containing a schedule of uncorrected errors. The letter and the file must be consistent.
- Quality reviewers frequently flag representation letters dated more than five business days before the audit report date. ISA 580.14 requires the date to be as near as practicable to the audit report date. A significant gap is a finding because it leaves a period where subsequent events are unaddressed by management confirmation.
Related products
Get practical audit insights, weekly.
No exam theory. Just what makes audits run faster.
No spam — we're auditors, not marketers.
Related Ciferi content
Related guides:
Put audit concepts into practice with these free tools:
Frequently asked questions
Can the auditor draft the management representation letter?
Yes. In practice, the auditor typically drafts the letter and management reviews, signs, and issues it on entity letterhead. ISA 580 does not prohibit this. However, the auditor must ensure management has actually read the letter and understood its contents before signing. A letter signed sight-unseen is a compliance risk, not audit evidence.
What happens if management refuses to sign the representation letter?
If management refuses to provide the mandatory representations under ISA 580.10–11 (responsibility for the financial statements, internal control, and access to information), the auditor must disclaim the opinion under ISA 580.20. There is no middle ground. If management refuses an engagement-specific representation under ISA 580.13, the auditor must assess whether the matter is material and pervasive and determine the effect on the auditor's opinion under ISA 580.19.
When should the management representation letter be dated?
ISA 580.14 requires the date of the written representations to be as near as practicable to, but not after, the date of the auditor's report. In practice, this means the representation letter should be dated on the same day the audit report is signed, or no more than one or two days before. A significant gap between the two dates is a finding because it leaves a period where subsequent events are unaddressed by management confirmation.
Can management add a "to the best of our knowledge" qualifier to representations?
For the mandatory representations under ISA 580.10–11 (responsibility and information representations), a knowledge-and-belief qualifier is not acceptable because these relate to management's own actions and responsibilities. For engagement-specific representations under ISA 580.13, the knowledge-and-belief qualifier is acceptable per ISA 580.A7–A8, as these may relate to factual matters that could be outside management's full knowledge.
Is the representation letter a substitute for audit procedures?
No. ISA 580.A1 states directly that written representations do not provide sufficient appropriate audit evidence on their own about any of the matters with which they deal. A representation that inventory is fairly stated does not replace an inventory count. If the auditor relies on the representation letter as the primary evidence for a material balance, the file has a scope limitation regardless of whether the letter is signed.
Further reading and source references
- IAASB Handbook 2024: the authoritative source for the complete ISA 580 text, including the illustrative representation letter in Appendix 2.
- ISA 210, Agreeing the Terms of Audit Engagements: the engagement letter wording must be consistent with the representation letter.
- ISA 240, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements: requires fraud-specific representations under ISA 240.39.
- ISA 450, Evaluation of Misstatements Identified during the Audit: requires the unadjusted misstatements representation with attached schedule.
- ISA 570 (Revised), Going Concern: requires going concern representations when material uncertainty conditions exist.