If a transaction, say, a purchase of non-current asset which is perfect in all matters except it was not authorized properly by suitable management level as required by internal policies of the entity, so what is the effect of this transaction to our audit? Could I consider it just is a deficiency of internal control and include it in management letter only?
Almost certainly that is correct. Even if the transaction were fraudulent, as opposed to not having been properly authorised, it would only affect the audit report if the effect were material.