Internal Audit Communication Process

Communication of IA Services Results

• The Chief Audit Executive (CAE) is responsible for regularly communicating the results of Internal Audit (IA) services to the board and Senior Management (SM).
• It's essential for the CAE to grasp the expectations regarding the nature and timing of these communications.

Types of Results

• Results of IA services encompass:
  • Engagement conclusions that summarize key findings.
  • Identification of themes, such as effective practices or root causes of issues.
  • Overall conclusions regarding governance, risk management, and control processes at both the business unit and organizational levels.

Engagement Communication Process

• The CAE must:
  • Review and approve all final engagement communications before distribution.
  • Determine the appropriate audience for disseminating these engagement conclusions.

Insights and Trends

• Findings from multiple engagements can unveil patterns or trends that require timely communication to the board and SM.
• Themes identified should be accompanied by actionable insights and advice.

Supporting Information Requirement

• Conclusions drawn by the CAE should be based on relevant, reliable, and sufficient information to support the effectiveness assessments.

Standards for Communicating Conclusions

• When conveying conclusions to the board and SM, the CAE must include:
  • A summary of the original request made for the engagement.
  • Criteria that form the basis for the conclusions reached.
  • The scope of the engagement, including any limitations and the timeframe covered.
  • A summary of supportive information that contributes to the conclusions.
  • Disclosure of reliance on the work of other assurance providers, if applicable.

Principle Summary

• Principle 11 emphasizes the need for effective communication guided by the CAE, ensuring that stakeholders are well-informed about IA service outcomes.