Management Representation Letter Template (ISA 580, AS 2805)

Management Representation Letter: [Entity or group name] [Financial statements for the period ended YYYY-MM-DD]

Letter in which the entity's management and, where appropriate, those charged with governance confirm to the auditor, in writing, the matters the auditor needs as audit evidence: responsibility for the financial statements, completeness of information, fraud, compliance with laws, related parties, subsequent events, going concern, estimates, uncorrected misstatements, litigation, internal control over financial reporting (integrated audits) and entity-specific matters, followed by the schedule of uncorrected misstatements and the supporting sub-representation process. Structure aligned with the subjects on which auditors request written representations under ISA 580 "Written Representations", ISA (UK) 580, PCAOB AS 2805 "Management Representations", PCAOB AS 2201 (integrated audits) and AICPA AU-C 580, cited by number only. The representations are written in original wording, grouped by the evidence the signatories rely on, and do not follow the order or phrasing of any illustrative letter published with those standards or by audit firms. Obtain the standard or law for the normative text. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, audit or accounting advice; ask your auditor and counsel to review the final letter.

Document control

Approvals

Revision history

Contents

1. How the letter works
2. Letter heading and addressee
3. Responsibility for the financial statements
4. Information and access
5. Completeness of transactions and records
6. Fraud and suspected fraud
7. Laws and regulations
8. Related parties
9. Events after the reporting period
10. Going concern
11. Accounting estimates and judgements
12. Uncorrected misstatements
13. Litigation, claims and contingencies
14. Entity-specific representations
15. Internal control over financial reporting (integrated audits)
16. Signatures
17. Sub-representations and supporting evidence
18. Glossary and references

1. How the letter works

A management representation letter is written evidence that the auditor requests from the people responsible for preparing the financial statements. It does not replace other audit evidence: the auditor still tests transactions, balances and disclosures. Its value lies in matters that only management can confirm, such as whether anything has been withheld, what management knows about fraud, and whether management really intends to take the actions on which accounting judgements depend.

Every main auditing framework expects the auditor to obtain such a letter: ISA 580 (and ISA (UK) 580 for UK statutory audits), PCAOB AS 2805 for audits of SEC issuers, and AICPA AU-C 580 for other US audits. In each, the letter comes from people with responsibility for the statements and knowledge of the facts, covers every period and set of statements the auditor's report covers, and carries the date of the auditor's report. In an integrated audit of internal control over financial reporting (ICFR) under PCAOB AS 2201, the auditor also needs representations about internal control, covered in section 15. If management declines a representation the auditor needs, or the auditor has reason to doubt one, the auditor reconsiders the evidence as a whole and may modify or disclaim the opinion. Treat any refusal as a governance event and take it to the audit committee before the auditor does.

The letter is signed by the people with overall responsibility for financial reporting, normally the chief executive officer and the chief financial officer. Some entities add the chair of the board or the audit committee where the auditor asks for confirmation from those charged with governance. Signatories should rely on a documented process (section 17), not on general impressions, because they are personally confirming facts.

Use this template as follows:

1. When the auditor's draft arrives, map each of its paragraphs to sections 3 to 15 below. Note any statement the auditor requests that this template does not cover and the reason for it.
2. Identify the entity-specific matters (section 14) early in the audit, usually at the planning meeting, so they do not appear for the first time on the signing day.
3. Run the sub-representation process three to four weeks before the signing date and close every open response before the final draft.
4. Attach the schedule of uncorrected misstatements (section 12) in the auditor's final form and check that the totals agree with the audit committee papers.
5. Sign on the auditor's report date. If the date moves, agree with the auditor whether a bring-down letter is needed.

Each section below opens with the question the signatories must be able to answer "yes" to, followed by the numbered confirmations (REP-NN) written in the first person plural on behalf of the signatories. The numbers let sub-representations and audit working papers refer to each statement.

2. Letter heading and addressee

[Entity letterhead]

[Audit firm name] Example: Ashgrove & Partners LLP [Address]

Date: [YYYY-MM-DD, the date of the auditor's report] Example: 2027-03-10

Dear [Audit firm name],

[Entity name]: financial statements for the year ended YYYY-MM-DD

You are auditing the [consolidated and parent company] financial statements of [Entity name] for the year ended [YYYY-MM-DD] (the "financial statements") prepared under [reporting framework], [and the effectiveness of internal control over financial reporting at that date,] in order to report on them. This letter sets out, for that purpose, the matters you have asked us to confirm.

Before signing we asked the directors, officers and employees who know the facts, and looked at the records, to the extent we judged necessary to be confident in each statement. Those enquiries and the answers we received are filed as described in section 17.

We treat a matter as material in this letter when, alone or together with other matters, leaving it out or getting it wrong could reasonably change the economic decisions of people who use the financial statements. Where a statement concerns what we know, it means what we know and believe after the enquiries described above.

3. Responsibility for the financial statements

Question for the signatories: have we done what the engagement letter says management is responsible for, and are the statements complete and consistent with our policies?

REP-01. The engagement terms dated [YYYY-MM-DD] make us responsible for preparing the financial statements under [reporting framework] so that they give a true and fair view [present fairly]. We have discharged that responsibility.

REP-02. We are responsible for the controls needed to produce financial statements without material error or fraud, and we have kept those controls in place throughout the year. You know of every control weakness that we judge significant or worse. Example (Corvid): the significant deficiency AGG-01 (deficiencies DEF-2026-001 and DEF-2026-003 over deferred revenue), reported to the audit committee and to you on 2026-10-14, remediated by 2026-10-15 and retested before the year end, and the separate deficiency DEF-2026-002 in Vietnam ERP access controls.

REP-03. Our accounting policies suit the group's transactions, are described in note [x], and have not changed from last year except as explained in the statements.

REP-04. The notes contain every disclosure that [reporting framework] requires of us. Where the framework offered us a presentation choice, we made it deliberately and kept to it.

REP-05. Standards issued but not yet in force have been reviewed and their expected effect is described as the framework requires. Example (Corvid): note 2 explains the expected effect of IFRS 18, which the group applies from 2027-01-01.

4. Information and access

Question for the signatories: has anything been held back from the auditor, or has anyone been out of the auditor's reach?

REP-06. Nothing we know to be relevant to the financial statements has been withheld from you. That includes the ledgers and supporting documents, contracts, and the minutes of shareholder, board and committee meetings; for meetings after the year end whose minutes are not yet approved, you have a written summary of decisions. Example (Corvid): summaries of the board meeting of 2027-02-24 and the audit committee meeting of 2027-03-05.

REP-07. Every request on the agreed request list has been answered or withdrawn by you, and so has every later request you made in the course of the audit.

REP-08. Nobody in the group, at head office or in a component, including internal audit, was put out of your reach when you asked to speak to them.

REP-09. Correspondence with regulators, tax authorities and other public bodies that points to weaknesses in financial reporting, or to any other matter that could materially affect the statements, has been passed to you in full.

5. Completeness of transactions and records

Question for the signatories: is there any transaction, agreement or obligation that sits outside the ledgers or outside what we have shown the auditor?

REP-10. The ledgers from which these statements were prepared contain every transaction the group entered into in the period; we know of no transaction kept outside them.

REP-11. No side letter, oral understanding or informal arrangement changes the terms of any customer, supplier, lender or employee contract without your knowledge. Example (Corvid): there are no side letters on customer contracts; the one rebate letter with a commerce customer is in your file and recorded.

REP-12. Every guarantee, indemnity, comfort or support letter and commitment that needs disclosure is disclosed. Example (Corvid): the parent company support letter to Corvid Commerce Inc covering the period to 2028-03-31.

REP-13. The group owns, or has the right to use, every asset in the balance sheet. Charges, pledges and other security over them, including any under the facility agreements, are disclosed; there are no others.

REP-14. Every liability and contingent liability we know of is recorded or disclosed.

6. Fraud and suspected fraud

Question for the signatories: what do we know, or what have we been told, about fraud, and has all of it reached the auditor?

REP-15. Preventing and detecting fraud is our job, not yours, and we have controls designed for that purpose.

REP-16. You have our fraud risk assessment, including our view of how the financial statements could be manipulated and how we respond. Example (Corvid): the group fraud risk assessment reviewed by the audit committee in December 2026, prepared using Fraud Risk Assessment (compliance/fraud-risk-assessment).

REP-17. You know of every fraud, actual or suspected, that we are aware of where the people involved include management or staff with significant control duties, and of any other fraud that could be material to the statements. Example (Corvid): the attempted diversion of supplier payments of EUR 41k through a false change of bank details, partly recovered, described in the investigation report; no employee was involved.

REP-18. Allegations of fraud affecting the financial statements that reached us from any source, whether staff, former staff, whistleblowers, analysts, regulators or others, have all been passed to you. Example (Corvid): three of the 23 speak-up reports received in FY2026 concerned financial reporting matters; all three were investigated and closed with no financial reporting effect.

7. Laws and regulations

Question for the signatories: is there any breach of law, regulation or contract, actual or possible, that could affect the amounts or disclosures?

REP-19. We have told you of every actual or possible breach of law or regulation known to us that could affect amounts or disclosures in the statements. Example (Corvid): the voluntary notification to the German data protection authority in 2026-09 about a misdirected customer e-mail, with no fine expected, passed to you on 2027-02-10.

REP-20. No term of the group's borrowing agreements, whether a financial covenant or an information undertaking, was broken at any point in the year or since. Example (Corvid): the four quarterly compliance certificates for FY2026 were delivered on time, prepared using Covenant Compliance Certificate (finance/covenant-compliance-certificate).

REP-21. We know of no breach of any other contract that, if enforced, could have a material effect on the statements.

8. Related parties

Question for the signatories: is the related party register complete, and is every related party dealing in the statements on the right basis?

REP-22. The related party register we gave you is complete to our knowledge: it names every related party and every relationship and transaction with them. Example (Corvid): the Related Party Register (finance/related-party-register), updated from the directors' annual interest declarations of 2027-01-15.

REP-23. Every related party balance and transaction is accounted for and disclosed under [IAS 24 / ASC 850 / local requirement]. Any statement in the notes that a dealing was on arm's length terms is backed by evidence we hold.

REP-24. No director, officer or other related party received a loan, guarantee or other benefit from the group that the statements do not disclose.

9. Events after the reporting period

Question for the signatories: has anything happened since the year end, up to today, that should change or be added to the statements?

REP-25. Between the reporting date and today we have identified the events listed in note [x]; we know of no other event that would change or need to be added to the statements under [IAS 10 / ASC 855 / the framework]. Example (Corvid): the board's decision of 2027-02-24 to propose a final dividend of EUR 3,000k, disclosed as a non-adjusting event.

REP-26. To find such events we read board and committee minutes, the monthly management accounts since the year end, and the legal and treasury reports up to today. Example (Corvid): management accounts to 2027-02-28 and the 13-week cash forecast dated 2027-03-05.

10. Going concern

Question for the signatories: do we stand behind the going concern conclusion, the period it covers, the judgements in it and the actions it relies on?

REP-27. Our going concern assessment runs to [YYYY-MM-DD], at least twelve months after the date on which the board approves the statements, and on that basis we are satisfied that preparing them as a going concern is right. Example (Corvid): the assessment to 2028-03-31 in going concern assessment GCA-2026-001 version 1.0, approved by the board on 2027-03-10.

REP-28. You have everything we know that bears on that assessment, including known events after its end date. Example (Corvid): the maturity of the term loan and the revolving credit facility on 2028-06-30, the refinancing mandate approved on 2027-01-28, the term sheets as received, and the fallback extension.

REP-29. We have not identified a material uncertainty about the group's ability to continue as a going concern, and note 1 describes the significant judgements we made in reaching that view. Where the assessment depends on actions we would take, we would take them and they are practicable. Example (Corvid): the significant judgement on refinancing by 2027-06-30, and the mitigating actions MIT-001, MIT-002, MIT-003 and MIT-006 in the going concern assessment.

11. Accounting estimates and judgements

Question for the signatories: can we defend how each significant estimate was made, and do the intentions built into them reflect what we will actually do?

REP-30. For each estimate in the statements we chose a method, data and assumptions we consider suitable for the item and the framework, and the related disclosures explain the uncertainty fairly.

REP-31. Where an estimate assumes that the group will follow a particular course of action, we mean to follow it and can do so. Example (Corvid): the five-year plan behind the goodwill impairment test is the strategic plan approved by the board on 2026-09-24 and reconciled to the FY2027 budget approved on 2026-12-10, and we intend to carry it out; the capitalised platform development projects meet the capitalisation criteria and we intend to complete them.

REP-32. The table below lists all the estimates and judgements we regard as significant; no other item reaches the level that would require disclosure:

REP-33. Where we relied on experts (valuation, actuarial, legal), we checked that they were competent and independent of the matter, gave them full information, and used their conclusions only where they fit the facts as we understand them.

12. Uncorrected misstatements

Question for the signatories: do we accept the list of errors left uncorrected, and are we sure they do not matter, alone or together?

REP-34. Attachment A lists the differences you accumulated that we have not corrected, apart from those below your clearly trivial threshold; in our view they do not, alone or together, make the statements materially misstated.

REP-35. For any item in Attachment A that we do not accept as an error, the schedule gives our reason.

Schedule of uncorrected misstatements (Example): Corvid Commerce Group plc, year ended 2026-12-31, EUR thousand. Overall materiality used by the auditor EUR 700k; clearly trivial threshold EUR 35k. Positive amounts mean profit before tax (PBT), profit after tax and net assets are overstated; tax uses an illustrative blended rate of 25%.

Check: 120 + 80 + 40 = 240; tax 240 x 25% = 60 (30 + 20 + 10); after tax 240 - 60 = 180 (90 + 60 + 30). The aggregate PBT effect of 240 is 34.3% of overall materiality (240 / 700) and 3.3% of FY2026 profit before tax of EUR 7,300k (240 / 7,300 = 3.29%). Note on UM-03: management considers the extension option reasonably certain to be exercised, the auditor does not; the difference is presented as judgemental.

Consider qualitative factors as well as size: a small misstatement can be material if it turns a covenant from compliance to breach, changes a loss into a profit, affects management remuneration, or conceals an unlawful transaction. For Corvid, the 240 is far below the EBITDA change that would move any covenant, including debt service cover. State in one sentence that you have considered these factors.

13. Litigation, claims and contingencies

Question for the signatories: does the auditor know about every claim against the group, including those not yet filed, and is each one treated correctly?

REP-36. Every claim, lawsuit and assessment we know of, filed or only threatened, has been shared with you and is accounted for or disclosed under [IAS 37 / ASC 450]. Example (Corvid): the supplier claim of EUR 350k in the UK, assessed as possible and disclosed as a contingent liability; there is no other matter.

REP-37. You have the names of every external law firm that advised the group this year on matters that could affect the statements, and each has our permission to answer your enquiries.

REP-38. Open tax audits and uncertain tax positions are shared with you and treated under [IFRIC 23 / ASC 740-10]. Example (Corvid): the open transfer pricing review in Vietnam for 2024, provided for as set out in the tax note.

14. Entity-specific representations

Add only representations that are specific, verifiable by the signatories, and needed by the auditor. Discuss each one with the auditor so the wording reflects what management actually knows.

Avoid representations you are being asked to give about matters outside management's knowledge, such as the conduct of a third party, or about the outcome of future events beyond your intentions. If a requested representation is not true, do not sign around it: discuss it with the auditor and the audit committee and agree a corrected wording or a disclosure.

15. Internal control over financial reporting (integrated audits)

Question for the signatories: does what we tell the auditor about internal control match management's ICFR report, the certifications and the deficiency log?

REP-45. Establishing and maintaining effective internal control over financial reporting is our responsibility, and we have evaluated its effectiveness at [YYYY-MM-DD] using [framework]. Example (Corvid): the evaluation at 2026-12-31 against the COSO 2013 framework, documented in ICFR Management Assessment (compliance/icfr-management-assessment).

REP-46. We did not use your procedures, or your audit of internal control, as part of the basis for our own evaluation.

REP-47. Our conclusion is that internal control over financial reporting [was / was not] effective at [YYYY-MM-DD], as stated in management's report. Example (Corvid): effective at 2026-12-31; no material weakness identified.

REP-48. You know of every deficiency in the design or operation of internal control over financial reporting that we identified, and we have separately named those we consider significant deficiencies or material weaknesses. You also know of any fraud, material or not, involving management or other staff with a significant role in that control. Example (Corvid): deficiencies DEF-2026-001 to DEF-2026-003, the significant deficiency AGG-01 and its remediation, as evaluated in Control Deficiency Evaluation (compliance/control-deficiency-evaluation); no fraud of that kind.

REP-49. Since [YYYY-MM-DD], the evaluation date, no change in internal control, and no corrective action on significant deficiencies or material weaknesses, has occurred that could significantly affect internal control over financial reporting, other than those we have described to you. Example (Corvid): roll-forward testing of December 2026 operation completed in January 2027; no further changes.

Keep this section consistent with the SOX 302 certifications signed with the Form 20-F and with the disclosure committee minutes. If any control conclusion changes between the letter date and the filing date, tell the auditor at once.

16. Signatures

Yours faithfully,

Signed for and on behalf of [Entity name] and, where applicable, the board of directors of [Entity name].

Attachments: (A) schedule of uncorrected misstatements; (B) list of significant estimates (REP-32); (C) [other schedules the auditor requires, such as a list of related parties or of lawyers].

17. Sub-representations and supporting evidence

The signatories rely on a cascade of internal confirmations. Send sub-representation questionnaires to component finance heads and functional leaders three to four weeks before the signing date, chase non-responses, investigate every exception, and refresh responses for any change up to the letter date. Keep the responses with the audit file of the entity; they are internal records and need not be given to the auditor unless requested.

Review points for the chief financial officer before signing:

• Every questionnaire returned, signed and dated, with exceptions followed up and closed.
• The fraud, laws and litigation responses agree with the speak-up log, the legal register and the lawyers' letters.
• The going concern representations match the assessment approved by the board, including the period, the significant judgements and the mitigating actions.
• The uncorrected misstatements schedule agrees with the audit committee papers, and the qualitative factors have been considered.
• The ICFR statements agree with management's report, the SOX 302 certifications and the deficiency log.
• Any representation the auditor added late has been discussed and is true.

17.1 Practical guidance for preparers

Read the auditor's draft against this template line by line before the sub-representation round starts. For each paragraph, ask three questions: what fact does it ask us to confirm, who in the organisation actually knows that fact, and what record would show it to be true. If no one can answer the second question, the representation is either too broad or belongs to someone else, and the wording should be narrowed with the auditor. Auditors generally accept a precise statement of what management knows more readily than a sweeping one that management cannot support.

Keep the language of the letter consistent with the documents it refers to. The going concern representation must use the same period, the same judgements and the same action IDs as the assessment approved by the board; the related party statement must refer to the register version actually given to the auditor; the ICFR statements must use the same deficiency IDs and severity conclusions as the deficiency evaluation. Inconsistencies between the letter and these documents are the most common reason for last-minute redrafting on the signing day.

Common errors to avoid:

• Signing a letter that refers to a materiality figure, a request list or an engagement letter date that has changed since the draft.
• Leaving component management out of the sub-representation round because the component is "small": fraud and side agreements often arise there.
• Treating the bring-down review as optional when the signing date moves by more than a few days.
• Accepting an entity-specific representation drafted by the auditor without checking that every word is supportable.
• Forgetting the parent company statements, the Form 20-F or the ICFR opinion when the auditor reports on more than one set of statements.

Use the evidence table also as the first input to next year's letter. Representations that needed long follow-up this year point to processes that should be improved, for example a guarantee register that is not maintained during the year, or directors' interests that are collected only once a year.

18. Glossary and references

References:

• ISA 580 "Written Representations" and ISA (UK) 580; ISA 450 "Evaluation of Misstatements Identified during the Audit"; ISA 570 (Revised 2024) "Going Concern" (periods beginning on or after 2026-12-15); ISA 240 (Revised) on fraud (reported effective for periods beginning on or after 2026-12-15; check the IAASB effective date); ISA 550 "Related Parties".
• PCAOB AS 2805 "Management Representations"; PCAOB AS 2201 (audit of internal control over financial reporting integrated with an audit of financial statements); AICPA AU-C 580 "Written Representations".
• Framework standards named in the representations: IAS 10, IAS 24, IAS 37, IFRIC 23, IFRS 18; ASC 450, ASC 740-10, ASC 850, ASC 855.
• Internal: audit engagement letter, PBC request list, going concern assessment, related party register, legal register, fraud risk assessment, ICFR management assessment.

Standard and licence note

Structure aligned with the subjects of written representations under ISA 580, ISA (UK) 580, PCAOB AS 2805 and AS 2201, and AICPA AU-C 580, cited by number and title only. Every representation in this template was drafted in original wording, organised around the questions signatories answer and the evidence they rely on; it does not reproduce, adapt or follow the sentence order of the illustrative letters published with those standards or by audit firms. ISA, FRC, PCAOB, AICPA, IFRS and ASC materials are copyrighted by their publishers; obtain the official text and check the current version and its local adoption before use. Corvid Commerce Group plc and Ashgrove & Partners LLP are fictional. Have the final letter reviewed by your auditor and legal counsel. Template licence: MIT.