Deficiencies in internal control identified by the auditor that are lesser than significant deficiencies: Must be communicated to the board of directors, the audit committee, and management. Must be reported to the audit committee and management. Must be communicated to management, with the audit committee only informed of the communication to management. Need not be disclosed unless they in aggregate equal (at least) a significant deficiency.