6. There is a requirement to communicate final deficiencies with management (Ref. AU-C 265). In practice, discussions with management are also required before finalizing those conclusions on the severity of deficiencies. Management would typically perform an impact analysis, and evidence compensating controls and control remediation as applicable. a. Conceptually, why would you need these discussions with management in concluding on the severity of a deficiency? (hint: who is ultimately responsible for the company's control environment, the auditor, or management?)