2400 – Communicating Results
Internal auditors must communicate the results of engagements.

2410 – Criteria for Communicating
Communications must include the engagement’s objectives, scope, and results.

2410.A1 - Final communication of engagement results must include applicable conclusions, as well as applicable recommendations and/or action plans. Where appropriate, the internal auditors’ opinion should be provided. An opinion must take into account the expectations of senior management, the board, and other stakeholders and must be supported by sufficient, reliable, relevant, and useful information.

Interpretation: Opinions at the engagement level may be ratings, conclusions, or other descriptions of the results. Such an engagement may be in relation to controls around a specific process, risk, or business unit. The formulation of such opinions requires consideration of the engagement results and their significance.

2410.A2 – Internal auditors are encouraged to acknowledge satisfactory performance in engagement communications.

2410.A3 – When releasing engagement results to parties outside the organization, the communication must include limitations on distribution and use of the results.

2410.C1 – Communication of the progress and results of consulting engagements will vary in form and content depending upon the nature of the engagement and the needs of the client.

2420 – Quality of Communications
Communications must be accurate, objective, clear, concise, constructive, complete, and timely.

Interpretation:
Accurate communications are free from errors and distortions and are faithful to the underlying facts. Objective communications are fair, impartial, and unbiased and are the result of a fair-minded and balanced assessment of all relevant facts and circumstances. Clear communications are easily understood and logical, avoiding unnecessary technical language and providing all significant and relevant information. Concise communications are to the point and avoid unnecessary elaboration, superfluous detail, redundancy, and wordiness. Constructive communications are helpful to the engagement client and the organization and lead to improvements where needed. Complete communications lack nothing that is essential to the target audience and include all significant and relevant information and observations to support recommendations and conclusions. Timely communications are opportune and expedient, depending on the significance of the issue, allowing management to take appropriate corrective action.

2421 – Errors and Omissions
If a final communication contains a significant error or omission, the chief audit executive must communicate corrected information to all parties who received the original communication.

2430 – Use of “Conducted in Conformance with the International Standards for the Professional Practice of Internal Auditing”
Indicating that engagements are “conducted in conformance with the International Standards for the Professional Practice of Internal Auditing”, is appropriate only if supported by the results of the quality assurance and improvement program.

2431 – Engagement Disclosure of Nonconformance
When nonconformance with the Code of Ethics or the Standards impacts a specific engagement, communication of the results must disclose the:

• Principle(s) or rule(s) of conduct of the Code of Ethics or Standard(s) with which full conformance was not achieved.
• Reason(s) for nonconformance.
• Impact of nonconformance on the engagement and the communicated engagement results.

2440 – Disseminating Results
The chief audit executive must communicate results to the appropriate parties.

Interpretation:
The chief audit executive is responsible for reviewing and approving the final engagement communication before issuance and for deciding to whom and how it will be disseminated. When the chief audit executive delegates these duties, he or she retains overall responsibility.

2440.A1 – The chief audit executive is responsible for communicating the final results to parties who can ensure that the results are given due consideration.

2440.A2 – If not otherwise mandated by legal, statutory, or regulatory requirements, prior to releasing results to parties outside the organization the chief audit executive must:

• Assess the potential risk to the organization.
• Consult with senior management and/or legal counsel as appropriate.
• Control dissemination by restricting the use of the results.

2440.C1 – The chief audit executive is responsible for communicating the final results of consulting engagements to clients.

2440.C2 – During consulting engagements, governance, risk management, and control issues may be identified. Whenever these issues are significant to the organization, they must be communicated to senior management and the board.

2450 – Overall Opinions

When an overall opinion is issued, it must take into account the strategies, objectives, and risks of the organization, and the expectations of senior management, the board, and other stakeholders. The overall opinion must be supported by sufficient, reliable, relevant, and useful information.

Interpretation:
The communication will include:

• The scope, including the time period to which the opinion pertains.
• Scope limitations.
• Consideration of all related projects, including the reliance on other assurance providers.
• A summary of the information that supports the opinion.
• The risk or control framework or other criteria used as a basis for the overall opinion.
• The overall opinion, judgment, or conclusion reached.

The reasons for an unfavorable overall opinion must be stated.

SIAAB’s Requirements:

Internal auditors may report that their activities are “conducted in accordance with the International Standards for the Professional Practice of Internal Auditing,” without an explanatory statement, only if internal and external assessments of the quality improvement program support a conclusion that the internal audit activity Generally Conforms with the Standards. When internal or external assessments result in a conclusion of Partially Conforms or Does Not Conform to the Standards and/or Code of Ethics adopted by the Board’s Bylaws in Article II, Sections III and IV, audit organizations are required by SIAAB to disclose the nonconformance and corrective action to be taken to senior management and the board. The Chief Internal Auditor shall determine the manner of disclosure appropriate for the agency which may include explanatory paragraphs in audit reports, inclusion in the internal audit annual report, or other as deemed appropriate. The disclosure is required annually until a subsequent review has been conducted by the external validator verifying that appropriate corrective action has been taken and approved by SIAAB.

Further, in accordance with the IIA’s International Professional Practice Framework (IPPF), interim reports that are written or oral and may be transmitted formally or informally. Such reports are used to communicate information that requires immediate attention, to communicate a change in engagement scope for the activity under review, or to keep management informed of engagement progress when engagements extend over a long period. The use of interim reports does not diminish or eliminate the need for a final report.

The chief internal auditor distributes the final engagement communication to the management of the audited activity and to those members of the organization who can ensure engagement results are given due consideration and take corrective action or ensure that corrective action can be taken. Where required by the internal audit charter or organizational policy, the chief internal auditor also communicates to other interested or affected parties such as external auditors and the board.

From: The IIA’s International Professional Practices Framework Copyright 2017 by The Institute of Internal Auditors, Inc., 1035 Greenwood Blvd, Suite 401, Lake Mary, FL 32746. Reprinted with permission

Please close this window to return to Ability LMS to take the quiz for this lesson.