In what cases is an auditor required to provide a written report on internal control understanding?

An auditor is required to provide a written report on their understanding of internal control in all audits regardless of the findings. This requirement stems primarily from the standards set forth by the AICPA and the respective audit framework being followed. The auditor's evaluation of internal controls is a key component of the audit process, helping to assess risks of material misstatement and providing insight into the effectiveness of the organization’s internal control systems.

This report typically includes relevant details about the internal controls, including the design and implementation of the controls, as well as any identified deficiencies. While reporting specific deficiencies or significant deficiencies might usually focus more on detailed findings, the overarching requirement to document the understanding of internal controls applies under all audit circumstances, facilitating transparency and accountability regardless of whether the auditor identifies shortcomings.

The other options are narrower in scope compared to the requirement outlined in the correct answer. Deficiencies may warrant specific mention or follow-up, but the initial written report itself is mandatory in every audit engagement, regardless of the outcomes related to the internal control evaluation.