Standard Of Internal Audit : Communication with the Management

Introduction

1. This Standard on Internal Audit provides a framework for the internal

auditor’s communication with management and identifies some specific

matters to be communicated with the management as described in the

terms of the engagement.

2. The internal auditor while performing audit should :

a. Communicate clearly the responsibilities of the internal auditor,

and an overview of the planned scope and timing of the audit

with the management;

b. Obtain information relevant to the internal audit from the

management;

c. Provide timely observations arising from the internal audit that

are significant and relevant to their responsibility as described

in the scope of the engagement to the management; and

d. Promote effective two-way communication between the internal

auditor and the management.

Matters to be Communicated

The Internal Auditor’s Responsibilities in Relation to the Terms of

Engagement

3. The internal auditor is responsible for performing the internal audit in

accordance with the terms of engagement.

Planned Scope and Timing of the Internal Audit

4. Communication regarding the planned scope and timing of the internal

audit may:

a. Assist the management:

 to understand better the objectives of the internal auditor’s

work; to discuss issues of risk and materiality with the internal auditor;

and

 to identify any areas in which they may request the internal

auditor to undertake additional procedures;

b. Assist the internal auditor to understand better the entity and its

environment.

5. When communicating to management about planned scope and timing of

the internal audit, the internal auditor would need to ensure that such

communication does not reduce the effectiveness of internal audit. For

example, communicating the nature and timing of detailed audit

procedures may make those procedures predictable.

6. Matters communicated may include:

 How the internal auditor proposes to address the significant risks of

material misstatement, whether due to fraud or error.

 The internal auditor’s approach to internal control relevant to the

internal audit.

 The application of materiality in the context of an internal audit.

7. Communication with management may assist the internal auditor to plan

the scope and timing of the internal audit. It does not, however, change

the internal auditor’s sole responsibility to establish the overall internal

audit strategy and the internal audit plan, including the nature, timing and

extent of procedures necessary to obtain sufficient appropriate audit

evidence.

Significant Findings from the Internal Audit

8. Paragraph 25 of the Standard on Internal Audit (SIA) 4, “Reporting”, states:

“25. The internal audit report contains the observations and comments of

the internal auditor, presents the audit findings, and discusses

recommendations for improvements. To facilitate communication and

ensure that the recommendations presented in the final report are practical

from the point of view of implementation, the internal auditor should discuss the draft with the entity’s management prior to issuing the final

report.

The different stages of communication and discussion should

be as under:

Discussion Draft - At the conclusion of fieldwork, the internal auditor

should draft the report after thoroughly reviewing his working papers

and the discussion draft before it is presented to the entity’s

management for auditee’s comments. This discussion draft should be

submitted to the entity management for their review before the exit

meeting.

Exit Meeting - The internal auditor should discuss with the

management of the entity regarding the findings, observations,

recommendations, and text of the discussion draft. At this meeting,

the entity’s management should comment on the draft and the

internal audit team should work to achieve consensus and reach an

agreement on the internal audit findings.

Formal Draft - The internal auditor should then prepare a formal draft,

taking into account any revision or modification resulting from the

exit meeting and other discussions. When the changes have been

reviewed by the internal auditor and the entity management, the final

report should be issued.

Final Report - The internal auditor should submit the final report to

the appointing authority or such members of management, as

directed. The periodicity of the Report should be as agreed in the

scope of the internal audit engagement. The internal auditor should

mention in the Report, the dates of discussion draft, exit meeting,

Formal Draft and Final Report.”

Establishing the Communication Process

9. Clear communication of the internal auditor’s responsibilities, the planned

scope and timing of the internal audit, and the expected general content of

communications helps establishing the basis for effective two-way

communication.10. Matters that contribute to effective two-way communication include:

 Clarity in the purpose of communications which makes the internal

auditor and the management better placed to have a mutual

understanding of relevant issues and the expected actions arising

from the communication process.

 Clarity in the form in which communications will be made.

 Identifying the person(s) in the internal audit team and the

management who will be responsible for communicating particular

matters.

 The internal auditor’s expectation that communication will be two-way,

and that the management will communicate with the internal auditor,

matters they consider relevant to the internal audit, for example,

strategic decisions that may significantly affect the nature, timing and

extent of internal audit procedures, the suspicion or the detection of

fraud, and concerns with the integrity or competence of senior

management.

 The process for taking action and reporting back on matters

communicated by the internal auditor and the management.

Forms of Communication

11. Effective communication may involve structured presentations and written

reports as well as less structured communications, including discussions.

The internal auditor may communicate matters other than those described

in the terms of engagement, either orally or in writing.

12. In addition to the significance of a particular matter, the form of

communication (e.g., whether to communicate orally or in writing, the

extent of detail or summarization in the communication, and whether to

communicate in a structured or unstructured manner) may be affected by

such factors as:

a. Whether the matter has been satisfactorily resolved.

b. Whether management has previously communicated the matter. c. The size, operating structure, control environment, and legal structure

of the entity.

d. In the case of an internal audit of a specific aspect of an operation,

whether the internal auditor also audits the entire operation or the

entity.

e. The expectations of the management, including arrangements made

for periodic meetings or communications with the auditor.

f. The amount of ongoing contact and dialogue the internal auditor has

with the management.

g. Whether there have been significant changes in the membership of a

governing body.

Timing of Communications

13. The appropriate timing for communications will vary with the

circumstances of the engagement. Relevant circumstances include the

significance and nature of the matter, and the action expected to be taken

by the management. For example:

 Communications regarding planning matters may often be made early

in the audit engagement.

 It may be appropriate to communicate a significant difficulty

encountered during the internal audit as soon as practicable.

 Similarly, it may be appropriate to communicate material weaknesses

in the design, implementation or operating effectiveness of internal

control that have come to the internal auditor’s attention as soon as

practicable.

 Communications regarding independence may be appropriate

whenever significant judgments are made about threats to

independence and related safeguards.

 The exit meeting may also be an appropriate time to communicate

findings from the internal audit.

Adequacy of the Communication Process

14. The internal auditor need not design specific procedures to support the

evaluation of the two-way communication with the management, rather,

that evaluation may be based on observations resulting from audit

procedures performed for other purposes. Such observations may include:

 The appropriateness and timeliness of actions taken by the

management in response to matters raised by the internal auditor.

Where significant matters raised in previous communications have

not been dealt with effectively, it may be appropriate for the internal

auditor to inquire as to why appropriate action has not been taken,

and to consider raising the point again. This avoids the risk of giving

an impression that the internal auditor is satisfied that the matter has

been adequately addressed or is no longer significant.

 The apparent openness of the management in their communications

with the internal auditor.

 The apparent ability of the management to fully comprehend matters

raised by the internal auditor, for example, the extent to which the

management probes issues and questions recommendations made to

them.

 Difficulty in establishing the management, a mutual understanding of

the form, timing and expected general content of communications.

 Whether the two-way communication between the internal auditor and

the management meets applicable legal and regulatory requirements.

15. Inadequate two-way communication may indicate an unsatisfactory control

environment and influence the internal auditor’s assessment of the risks of

material misstatements. There is also a risk that the internal auditor may

not have obtained sufficient appropriate internal audit evidence to support

his findings or opinion.

Documentation

16. Where matters required by this SIA to be communicated are

communicated orally, the internal auditor shall document them, and when and to whom they were communicated. Where matters have been

communicated in writing, the auditor shall retain a copy of the

communication as part of the internal audit documentation.

Effective Date

17. This Standard on Internal Audit is effective for all internal audits beginning

on or after _____________. Earlier application of the Standard is

encouraged.