[The following paragraph was effective before December 31, 2016. See  PCAOB Release No. 2015-002. The current standard can be found  here.]

.47

During the course of an examination engagement, the practitioner may become aware of significant deficiencies in the design or operation of internal control over compliance that could adversely affect the entity's ability to comply with specified requirements. A practitioner's responsibility to communicate these deficiencies in an examination of an entity's compliance with specified requirements is similar to the auditor's responsibility described in AU section 325, Communication of Internal Control Related Matters Noted in an Audit. If, in a multiple-party arrangement, the practitioner's client is not the responsible party, the practitioner has no responsibility to communicate reportable conditions to the responsible party. For example, if the practitioner is engaged by his or her client to examine the compliance of another entity, the practitioner has no obligation to communicate any reportable conditions that he or she becomes aware of to the other entity. However, the practitioner is not precluded from making such a communication.