The Standard on Internal Audit (SIA) 290 mandates effective two-way communication between the Internal Auditor and Management and Those Charged with Governance (TCWG) throughout the entire audit process. The primary objective is to maintain a continuous dialogue, ensuring mutual agreement on the audit’s scope, approach, objectives, and timing, which is essential for achieving audit goals. This standard requires the auditor to establish a formal, written communication process and protocol that defines the modes, channels, periodicity, and essential information to be exchanged, promoting independence, objectivity, and timeliness. Essential matters for communication include the annual audit plan, risk assessment outcomes, and periodic updates on significant observations or scope limitations. Crucially, the standard requires a mechanism for timely conflict resolution and securing feedback from management and TCWG to facilitate continuous improvement in audit quality. Any verbal communication concerning essential matters must be documented in writing. While formal reporting is covered under SIA 310, this standard focuses on the critical, continuous information exchange necessary to inform, persuade, and act on matters important to the audit’s successful conduct.
The Institute of Chartered Accountants of India
Standard on Internal Audit
(SIA) 290
Communication with
Management and Those
Charged with Governance**
1. Introduction
1.1 The Internal Auditor is required to have an effective two-way communication with the management and Those Charged with Governance (TCWG), both while managing the internal audit function, and while conducting an internal audit assignment. A continuous dialogue with management and TCWG, at various stages of the internal audit process, is essential to the achievement of internal audit objectives.
1.2“Management” refers to persons(s) with executive responsibility to run the company’s operations.
1.3 The term “Those Charged with Governance (TCWG)” refers to either an individual, or a body of individuals, or a separate legal entity with the responsibility for overseeing the strategic direction and accountability of the organization.
1.4“Communication” refers to any information exchange between the Internal Auditor and management, either through written or verbal means.
1.5 Scope: This standard applies to all the Internal Audit activities. The communication required for the Internal Auditor to report the findings in the formal presentation or written report, which is subject matter of SIA 310, Reporting and Conformance with Standards on Internal Audit.
2. Effective Date
2.1 This Standard is applicable for internal audits beginning on or after a date to be notified by the Council of the Institute.
3. Objectives
3.1 The objective of this Standard is to:
- Ensure that there exists a continuous dialogue and free flow of information between the internal auditor and management or those charged with governance.
- Ensure clear and mutual agreement between the Internal Auditor and the management or those charged with governance about the scope, approach, objectives and timing of internal audit.
- Establish certain essential matters which shall be communicated to management or those charged with governance.
- Establish a process to inform, persuade and act on matters important to the conduct of an internal audit.
- Resolve any conflicts in a timely manner with respect to scope, access to information, or audit observations through escalation protocols wherever necessary.
- Establishing a structured feedback process for management or those charged with governance to improve audit communication effectiveness and audit quality as a process of continuous improvement.
- Ensure that this communication is independent, definite, effective and timely.
4. Requirements
4.1 Communication Process and Protocol (Refer Para. A1)
The Internal Auditor shall establish and agree a written communication process and protocol with management or those charge with governance. All communication shall be clear, appropriate, professionally structured, objective and independent. The protocol may additionally include the mechanism of risk-based communication.
4.2 Modes and Channels of Communication (Refer Para. A2)
The process documentation shall outline the various modes and channels of communication (Refer Para. A2), the periodicity and timelines for communication (Refer Para. A3), and also cover certain essential information required to be communicated (Refer Para. A5). Where essential matters (Refer Para. A7) are concerned, any verbal communication shall subsequently be confirmed in writing and maintained as audit documentation.
4.3 Feedback Mechanisms (Refer Para. A4)
The Internal Auditor (or the Engagement Partner, in case of external service provider) shall play an active role in resolving conflicts through timely communication with management or those charged with governance and securing feedback.
4.4 Essential Information for Communication (Refer Para. A5)
Certain information considered important for communication is mandated by other Standards on Internal Audit, which shall be included in the list of essential matters for communication. In addition, certain information for communication may be mandated by laws and regulations which shall also be adhered to and included in the list of essential matters for communication.
4.5 Nature of Communication (Refer Para. A6)
A formal communication process pre-agreed with Management or TCWG shall be put in place to facilitate effective and timely communication. The nature of communication is left to the professional judgements of the Internal Auditor and management or TCWG.
*****
Application and other Explanatory Material
A1. Communication Process and Protocol (Refer Para. 4.1): The communication process will require all the key elements (e.g. protocol, mode, channel, timelines, content, etc.) required for accurate, complete and timely communication. The nature and frequency of communication are influenced by the level of risk involved.
The communication process shall allow flexibility to provide interim updates or revisions due to changes in audit scope, emerging risks, critical findings, management, independence, objectivity etc.
A communication protocol will clarify who will communicate with whom during assignment, including escalations required for timely intervention.
The matrix shall be in accordance with the organization’s governance structure to identify appropriate point of contact to include audit committee, board committee, etc. during the respective stage of internal audit i.e., initiation, conduct or finalisation.
Any significant deviations from the mutually agreed communication process/protocol shall be formally documented along with reasons.
The internal auditor shall keep himself updated regarding any changes in the Management or TCWG during the audit period if any, unless it is beyond his reasonable control to know the changes.
A2. Modes and Channels of Communication (Refer Para. 4.2): The manner in which information is exchanged (e.g., verbal, written, picture, video, etc.) is the mode of communication. The medium used to exchange information (e.g., through phone, hard copy (paper), email, file exchange, etc.,) is the channel of communication. Where sensitive or confidential information is involved, secure channels (in compliance with data protection and confidentiality norms) shall be used. Further, encrypted modes of communication shall be promoted to enhance audit communication and traceability.
A3. Periodicity and Timeline of Communication (Refer Para. 4.2): The Internal Auditor, jointly in consultation with management or those charged with governance, shall determine the nature and timing of communication.
A4. Feedback Mechanisms (Refer Para. 4.3): There shall be structured process to capture and respond to management feedback on audit communications, execution and deliverables. This feedback shall be evaluated to enhance the internal audit process and communication protocols.
A5. Essential Information for Communication (Refer Para. 4.4): Various Standards on Internal Audit (SIA) provide guidance on communication to management or Those Charged with Governance (TCWG) to which is considered essential for conduct of the internal audit.
Certain matters which the Internal Auditor shall consider as essential matters for communication to management and Those Charged with Governance may include the following:
- Annual Internal Audit plan, covering the scope, timing, methodology of audit assignments to be undertaken, along with resources and budgets of the internal audit department.
- Outcome of the risk assessment exercise conducted to develop the Internal Audit Plan.
- Periodic update on significant observations, with corrective action plans, as agreed with the auditee.
- Details of the functioning of the internal audit department and a continuous update on their progress, status of performance and any resource or budget constraints.
- Status update of prior audit issues, their timely closure with an Action Taken Report, and
- Any other matters as per Standards on Internal Audit, laws and regulations and professional judgement of the Internal Auditor.
Also, in para A3 of SIA 220, “Internal Audit Planning” requires a “Discussion with Management” as part of the planning process. This exchange of information is considered important and essential for conduct of internal audits.
At times, the Internal Auditor may come across sensitive information/observations with governance issues (such as management override of controls, possible fraud indicators, etc.). Also, sometimes the Internal Auditor may face sensitive situations where the audit scope is being limited by circumstances such as:
(a) Significant delays by auditee, either due to unavailability of key personnel or required information.
(b) Unreasonably short time given to complete the audit.
(c) Extensive effort required to obtain sufficient and appropriate audit evidence.
(d) Restrictions or hurdles imposed on the internal auditor.
(e) Challenging the necessity of the information asked for.
(f) Restricting the auditor to venture in areas not covered in the scope but are required to do so for establishing certain facts found within the given scope.
In such circumstances, the internal auditor shall communicate the concerned sensitive matter(s) with TCWG as per the pre-agreed laid down process and may even choose to issue a disclaimer on the scope of audit as per his professional judgment.
A6. Nature of Communication (Refer Para. 4.5): The matters to be communicated, the form and manner, and periodicity of communication are best established between the Internal Auditor and Management or TCWG. In this regard, a formal communication process shall be pre-agreed with Management or TCWG, which must be documented in the Engagement Letter or during Initial Audit Meetings to decide the scope of audit, and include the following (indicative list):
- form and content of communication (the “what”).
- manner and protocol of communication (the “who” and “how”), and
- timelines and periodicity of communication (the “when”).
A7. Documentation (Refer Para. 4.2): The Internal Auditor shall maintain all the documents as required by the Standard on Internal Audit (SIA) 250, Internal Audit Documentation. Oral communications with TCWG may be documented for records through written communication or as the minutes of meetings. All communications with TCWG must be well documented along with other reports issued by the auditor. To confirm compliance of audit procedures with this SIA, the list of documents required is as follows:
(a) Written Communication process and protocol, as part of the Internal Audit Manual.
(b) Written details of essential exchange of information, as required by other SIAs, cross reference to the Internal Audit Program, where appropriate.
