The management representation letter is the last thing to get signed and the first thing to get rolled forward. Most firms run the PY letter through a find-and-replace on the client name and date, then route it for signature. Nobody drafts a rep letter from scratch. The PY file opens, the dates update, the CFO signs. SALY wins again.
That would be fine if nothing changed on the engagement. But the rep letter isn’t boilerplate. The file should tell a story about risk, evidence, and representation, and the rep letter is where management signs off on the story. A letter that says the same thing year three that it said year one is either evidence that nothing happened, or evidence that nobody looked.
Consider a real timing problem. The engagement partner (EP) signed the audit report on 28 March. The rep letter was dated 15 March. ISA 580.14 requires the date of the written representations to be as near as practicable to, but not after, the date of the auditor’s report. A 13-day gap between the rep letter and the audit report leaves an unaddressed window where events could have occurred without management confirmation. If a quality reviewer spots this, the file has a finding before they read a single WP.
ISA 580.10 -11 requires the auditor to obtain written representations from management confirming responsibility for the financial statements (FS), provision of all relevant information, access to records and personnel, and completeness of recorded transactions under the applicable financial reporting framework.
Key Takeaways
- Every representation ISA 580.10 -11 requires, plus the representations required by ISA 240 , ISA 450 , ISA 540 , ISA 550 , ISA 560 , and ISA 570
- How to add engagement-specific representations without turning the letter into a risk transfer document
- The timing and dating rules under ISA 580.14 -15 that cause more findings than the content itself
- What happens when management refuses to sign, modifies the wording, or qualifies a representation ( ISA 580.16 -20)
What ISA 580 requires and what it does not
ISA 580 establishes two categories of written representations. The first category ( ISA 580.10 -11) covers management’s acknowledgement of its responsibilities. Responsibility for the preparation of the FS in accordance with the applicable framework, responsibility for internal control relevant to the preparation of FS free from material misstatement, confirmation that all relevant information and access have been provided to the auditor, and confirmation that all transactions have been recorded. These representations are mandatory on every engagement. If management refuses to provide them, ISA 580.20 requires the auditor to disclaim the opinion. There is no middle ground.
The second category ( ISA 580.13 ) covers additional representations the auditor determines are necessary to support other audit evidence. These are engagement-specific. They depend on the risks identified and the areas where audit evidence from other sources is limited. The distinction matters because the first category carries a nuclear consequence (disclaimer), while the second category carries a scope limitation consequence (qualified opinion or disclaimer depending on materiality and pervasiveness, per ISA 580.19 ).
What ISA 580 does not require. The rep letter is not a substitute for audit procedures. A representation that inventory is fairly stated does not replace an inventory count. A representation that provisions are complete does not replace testing the provision calculations. If the auditor is relying on the rep letter as the primary evidence for a material balance, the file has a scope limitation regardless of whether the letter is signed.
The ciferi ISA 580 glossary entry covers the evidential hierarchy in more detail, including the interaction between representations and corroborating evidence.
The mandatory representations: what every letter must contain
ISA 580.10 -11 and the illustrative letter in ISA 580 Appendix 2 provide the baseline. Every rep letter must include these paragraphs, adapted for the applicable financial reporting framework.
The responsibility representation ( ISA 580.10a )
Management confirms it has fulfilled its responsibility for the preparation of the FS in accordance with the applicable framework, including (where relevant) their fair presentation. The wording must match the responsibility description agreed in the engagement letter under ISA 210.6 (b)(i). If the engagement letter says management is responsible for preparation in accordance with IFRS, the rep letter must use the same language.
The information representation ( ISA 580.11 )
Management confirms it has provided the auditor with all information relevant to the preparation of the FS as agreed in the terms of the engagement, that all transactions have been recorded and reflected in the FS, and that the auditor has been given access to all relevant records and personnel. This is not a formality. If a reviewer finds that management withheld information during the audit (for example, an undisclosed related party transaction), the signed rep letter is evidence that management made a false statement. The auditor’s reliance on it becomes the question.
The internal control representation ( ISA 580.10b )
Management acknowledges its responsibility for internal control that management determines is necessary to enable the preparation of FS free from material misstatement, whether due to fraud or error. This does not require management to assert that internal controls are effective. It requires management to acknowledge that the responsibility is theirs.
These representations are not qualified with “to the best of our knowledge and belief.” ISA 580 .A8 is explicit. The responsibility representations in paragraphs 10 and 11 are not subject to the knowledge-and-belief qualifier, because they relate to management’s own actions and responsibilities, not to factual matters that might be outside management’s full knowledge.
Engagement-specific representations required by other ISAs
Beyond the ISA 580 mandatory paragraphs, other ISAs require specific representations. These must be included in the letter if the relevant circumstances exist on the engagement.
ISA 240 (fraud)
Management confirms that it has disclosed to the auditor the results of its assessment of the risk that the FS may be materially misstated as a result of fraud, that it has disclosed all known instances of fraud or suspected fraud affecting the entity involving management or employees with significant roles in internal control where the fraud could have a material effect, and that it has disclosed all allegations of fraud communicated by employees, former employees, regulators, or others ( ISA 240.39 ).
ISA 450 (unadjusted misstatements)
Management confirms that the effects of uncorrected misstatements are immaterial, individually and in aggregate, to the FS as a whole. A list of the uncorrected misstatements is attached to the rep letter ( ISA 450.14 ). This is one of the most frequently omitted items. If the auditor has identified misstatements that management declined to correct, the rep letter must include this confirmation with the attached schedule.
ISA 550 (related parties)
Management confirms that it has disclosed to the auditor the identity of the entity’s related parties and all related party relationships and transactions of which it is aware, and that it has appropriately accounted for and disclosed those relationships and transactions ( ISA 550.26 ).
ISA 560 (subsequent events)
Management confirms that all events occurring subsequent to the date of the FS and for which the applicable framework requires adjustment or disclosure have been adjusted or disclosed.
ISA 570 (going concern)
Where relevant, management confirms that its plans for future actions in relation to its going concern assessment are feasible, that all relevant information relating to going concern has been disclosed, and that management believes the going concern basis of accounting is appropriate. This representation is only required when events or conditions have been identified that may cast significant doubt on the entity’s ability to continue ( ISA 570.16e ). It is not a default inclusion on every letter. If the going concern checklist indicates no Scenario 2, 3, or 4 conditions, this representation is unnecessary.
ISA 540 (accounting estimates)
Where estimates are significant, management confirms that the methods, significant assumptions, and data used in making accounting estimates and related disclosures are appropriate in the context of the applicable framework ( ISA 540.37 ).
How to add client-specific representations without overloading the letter
ISA 580.13 allows the auditor to request additional representations to support other audit evidence. In our experience, rep letters go wrong in two directions.
The first failure is that the letter includes no client-specific representations at all. It is a generic template with the ISA 580.10 -11 paragraphs and nothing else. A reviewer comparing the rep letter to the audit file’s risk assessment will see significant risks that have no corresponding representation. If the entity has a material litigation provision, a representation about the completeness of litigation disclosures should be in the letter. If the entity has complex revenue arrangements, a representation about the appropriateness of the revenue recognition policy should be in the letter.
The second failure is that the letter includes 40 client-specific representations covering every conceivable risk, turning it into a contract-length document that management signs without reading. An unread rep letter is not evidence of anything. ISA 580 .A2 notes that written representations provide audit evidence, but their reliability depends on whether management has been informed about the matters covered. A rep letter that management could not reasonably have read before signing has reduced evidential value.
The practical rule. Add a client-specific representation for every significant risk identified in the PM where the audit evidence from other sources is inherently limited. Estimates, legal matters, completeness assertions, and management intent (for example, the intention to hold an investment to maturity) are common examples. One representation per significant area, stated in one or two sentences. No more than four to six client-specific additions beyond the standard paragraphs.
Getting management to strike a rep letter clause is the slowest part of the whole audit, and the one we most often back down on. The file should tell a story, and each client-specific representation is a line in that story. If a representation matters enough to draft, it matters enough to defend when management pushes back.
Dating and signing: the timing rules that generate findings
ISA 580.14 requires the date of the written representations to be as near as practicable to, but not after, the date of the auditor’s report. ISA 580.15 requires the representations to cover all FS and periods referred to in the auditor’s report.
In our experience, this means the rep letter should be dated on the same day the audit report is signed, or no more than one or two days before. A rep letter dated two weeks before the audit report creates an unaddressed gap. Events could have occurred in that gap that would have required a different representation. The fix is procedural. Schedule the rep letter signing as the last step before the audit report is issued, not as a task completed during fieldwork.
The letter must be addressed to the auditor. It must be on the entity’s letterhead. ISA 580 .A19 confirms the required form as a letter from management to the auditor. In our experience, the auditor drafts the letter and management reviews it, then signs and issues it on entity letterhead. This is standard practice and ISA 580 does not prohibit it. But the auditor must ensure management has actually read the letter and understood its contents. A letter that management signs sight-unseen is a compliance risk, not audit evidence.
On who signs, ISA 580.9 requires the representations to come from management with appropriate responsibilities for the FS and knowledge of the matters concerned. In our experience, this means the CEO (or managing director) and the CFO (or finance director). For smaller entities with a single director-owner, that person signs. ISA 580 .A4-A6 recognises that the appropriate signatory depends on the entity’s governance structure.
What to do when management pushes back
Management refuses to provide a specific representation. ISA 580.16 -19 sets out the response in a decision sequence.
If management does not provide one or more of the mandatory representations ( ISA 580.10 -11), the auditor must disclaim the opinion under ISA 580.20 . No exceptions. The mandatory representations relate to management’s responsibilities under the terms of the engagement. If management won’t acknowledge those responsibilities, the auditor cannot conduct the audit.
If management does not provide one or more engagement-specific representations ( ISA 580.13 ), the auditor must consider why ( ISA 580.17 ), determine whether it affects the reliability of other representations ( ISA 580.18 ), assess what additional audit evidence may be needed, and take appropriate action including the possible effect on the auditor’s opinion under ISA 580.19 . The appropriate action depends on the representation. If management refuses to represent that litigation disclosures are complete, the auditor has a scope limitation on legal provisions and must assess whether the matter is material and pervasive.
If management modifies a representation (adds qualifying language), the auditor must evaluate whether the modification affects the reliability of the representation and whether additional audit procedures are needed ( ISA 580 .A27). A common modification is that management changes “we confirm that all related party transactions have been disclosed” to “to the best of our knowledge, all related party transactions have been disclosed.” For ISA 580.13 representations, the knowledge-and-belief qualifier is acceptable ( ISA 580 .A7-A8). For the ISA 580.10 -11 mandatory representations, it is not.
Worked example: Dijkstra Logistics B.V.
Client profile. Dijkstra Logistics B.V., a freight forwarding company based in Rotterdam. Revenue: €42M. Reporting framework: Dutch GAAP. Year-end: 31 December 2025. Audit report date: 15 March 2026. One significant estimate (provision for onerous contracts, €1.4M). One ongoing legal claim (€800K, disclosed in the notes). Revenue recognition identified as a significant risk under ISA 240.26 .
The rep letter for Dijkstra Logistics B.V. contains the following sections.
Mandatory representations ( ISA 580.10 -11)
The managing director (A. Dijkstra) and the finance director (M. Hendriks) confirm that they have fulfilled their responsibility for the preparation of the FS in accordance with Titel 9, Boek 2 BW. They also confirm their responsibility for internal control relevant to the preparation of FS free from material misstatement. The letter states that all information relevant to the preparation of the FS has been provided to the auditor, that all transactions have been recorded, that access to all records and personnel has been provided, and that management has disclosed all known events requiring adjustment or disclosure.
Documentation note. These paragraphs are not subject to a knowledge-and-belief qualifier. They must match the engagement letter wording under ISA 210 .
ISA-required engagement-specific representations
On fraud ( ISA 240.39 ), management confirms disclosure of its fraud risk assessment, all known or suspected fraud, and all fraud allegations received. On unadjusted misstatements ( ISA 450.14 ), management confirms that two unadjusted misstatements totalling €18,400 are immaterial, individually and in aggregate, with the schedule of unadjusted misstatements attached. On related parties ( ISA 550.26 ), management confirms disclosure of all related party identities and transactions. On subsequent events ( ISA 560 ), management confirms that all subsequent events requiring adjustment or disclosure have been addressed.
Documentation note. The ISA 570 going concern representation is not included because the going concern assessment identified no events or conditions casting doubt on continuity (Scenario 1 under the firm’s methodology). Record this omission decision in the file.
Client-specific representations ( ISA 580.13 )
On the onerous contracts provision, management confirms that the assumptions used to calculate the provision (€1.4M, covering two loss-making freight contracts expiring in Q3 2026) are reasonable and that no additional onerous contracts exist at the balance sheet date. This representation is included because the provision is a significant estimate and the underlying assumptions (expected loss per shipment, remaining contract volume) are within management’s knowledge. On the legal claim, management confirms that the €800K legal claim disclosed in the notes represents the best estimate of the probable outflow, that no other material legal claims exist that have not been disclosed, and that legal counsel’s assessment has been shared with the auditor.
Documentation note. Each client-specific representation maps to a significant risk in the PM. Cross-reference the representation to the ISA 540 estimate evaluation working paper (onerous contracts) and the ISA 501 litigation confirmation (legal claim).
Dating and signing
The letter is dated 15 March 2026, matching the audit report date. Both A. Dijkstra and M. Hendriks sign the letter on entity letterhead. The signed letter is obtained before the audit report is issued.
The letter runs to two pages. It contains the mandatory paragraphs, four ISA-required representations, and two client-specific representations. A reviewer can match every representation to a risk in the file.
Practical checklist for your representation letter
Common mistakes reviewers flag
- The FRC’s 2022-23 inspection findings identified rep letters that did not include the ISA 450.14 representation about unadjusted misstatements, despite the audit file containing a schedule of uncorrected errors. The letter and the file must be consistent.
- Quality reviewers frequently flag rep letters dated more than five business days before the audit report date. ISA 580.14 requires the date to be as near as practicable to the audit report date. A significant gap is a finding because it leaves a period where subsequent events are unaddressed by management confirmation.
Related content
- Written representations glossary entry: Covers the ISA 580 evidential hierarchy and the distinction between mandatory and engagement-specific representations.
- Going concern checklist tool: Use this to determine whether the ISA 570 going concern representation is needed on your engagement.
Related ciferi content
Related guides:
Put audit concepts into practice with these free tools:
Frequently asked questions
Can the auditor draft the management representation letter?
Yes. In practice, the auditor typically drafts the letter and management reviews, signs, and issues it on entity letterhead. ISA 580 does not prohibit this. However, the auditor must ensure management has actually read the letter and understood its contents before signing. A letter signed sight-unseen is a compliance risk, not audit evidence.
What happens if management refuses to sign the representation letter?
If management refuses to provide the mandatory representations under ISA 580.10 –11 (responsibility for the financial statements, internal control, and access to information), the auditor must disclaim the opinion under ISA 580.20 . There is no middle ground. If management refuses an engagement-specific representation under ISA 580.13 , the auditor must assess whether the matter is material and pervasive and determine the effect on the auditor's opinion under ISA 580.19 .
When should the management representation letter be dated?
ISA 580.14 requires the date of the written representations to be as near as practicable to, but not after, the date of the auditor's report. In practice, this means the representation letter should be dated on the same day the audit report is signed, or no more than one or two days before. A significant gap between the two dates is a finding because it leaves a period where subsequent events are unaddressed by management confirmation.
Can management add a "to the best of our knowledge" qualifier to representations?
For the mandatory representations under ISA 580.10 –11 (responsibility and information representations), a knowledge-and-belief qualifier is not acceptable because these relate to management's own actions and responsibilities. For engagement-specific representations under ISA 580.13 , the knowledge-and-belief qualifier is acceptable per ISA 580 .A7–A8, as these may relate to factual matters that could be outside management's full knowledge.
Is the representation letter a substitute for audit procedures?
No. ISA 580 .A1 states directly that written representations do not provide sufficient appropriate audit evidence on their own about any of the matters with which they deal. A representation that inventory is fairly stated does not replace an inventory count. If the auditor relies on the representation letter as the primary evidence for a material balance, the file has a scope limitation regardless of whether the letter is signed.
Further reading and source references
- IAASB Handbook 2024: the authoritative source for the complete ISA 580 text, including the illustrative representation letter in Appendix 2.
- ISA 210 , Agreeing the Terms of Audit Engagements: the engagement letter wording must be consistent with the representation letter.
- ISA 240 , The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements: requires fraud-specific representations under ISA 240.39 .
- ISA 450 , Evaluation of Misstatements Identified during the Audit: requires the unadjusted misstatements representation with attached schedule.
- ISA 570 (Revised), Going Concern: requires going concern representations when material uncertainty conditions exist.