An auditor must communicate internal control significant deficiencies to senior management and the board of directors of the company