Auditors should report significant deficiencies in internal control considered to be reportable conditions as defined in AICPA standards.
The AICPA standards define what should be considered reportable conditions.
Auditors can choose not to report significant internal control deficiencies.