The following is the text of the Standard on Internal Audit (SIA) 9, Communication with Management, issued by the Council of the Institute of Chartered Accountants of India.. These Standards should be read in conjunction with the Preface to the Standards on Internal Audit, issued by the Institute.
In terms of the decision of the Council of the Institute of Chartered Accountants of India taken at its 260th meeting held in June 2006, the following Standard on Internal Audit shall be recommendatory in nature in the initial period. The Standards shall become mandatory from such date as notified by the Council.
1. This Standard on Internal Audit provides a framework for the internal auditor’s communication with management and identifies some specific matters to be communicated with the management as described in the terms of the engagement.
2. The internal auditor while performing audit should :
a. Communicate clearly the responsibilities of the internal auditor, and an overview of the planned scope and timing of the audit with the management;
b. Obtain information relevant to the internal audit from the management;
c. Provide timely observations arising from the internal audit that are significant and relevant to their responsibility as described in the scope of the engagement to the management; and
d. Promote effective two-way communication between the internal auditor and the management.
Matters to be Communicated
The Internal Auditor’s Responsibilities in Relation to the Terms of Engagement
3. The internal auditor is responsible for performing the internal audit in accordance with the terms of engagement.
Planned Scope and Timing of the Internal Audit
4. Communication regarding the planned scope and timing of the internal audit may:
a. Assist the management:
b. Assist the internal auditor to understand better the entity and its environment.
5. When communicating to management about planned scope and timing of the internal audit, the internal auditor would need to ensure that such communication does not reduce the effectiveness of internal audit. For example, communicating the nature and timing of detailed audit procedures may make those procedures predictable.
6. Matters communicated may include:
7. Communication with management may assist the internal auditor to plan the scope and timing of the internal audit. It does not, however, change the internal auditor’s sole responsibility to establish the overall internal audit strategy and the internal audit plan, including the nature, timing and extent of procedures necessary to obtain sufficient appropriate audit evidence.
Significant Findings from the Internal Audit
8. Paragraph 25 of the Standard on Internal Audit(SIA) 4, “Reporting”, states:
“25. The internal audit report contains the observations and comments of the internal auditor, presents the audit findings, and discusses recommendations for improvements. To facilitate communication and ensure that the recommendations presented in the final report are practical from the point of view of implementation, the internal auditor should discuss the draft with the entity’s management prior to issuing the final report. The different stages of communication and discussion should be as under:
Discussion Draft – At the conclusion of fieldwork, the internal auditor should draft the report after thoroughly reviewing his working papers and the discussion draft before it is presented to the entity’s management for auditee’s comments. This discussion draft should be submitted to the entity management for their review before the exit meeting.
Exit Meeting – The internal auditor should discuss with the management of the entity regarding the findings, observations, recommendations, and text of the discussion draft. At this meeting, the entity’s management should comment on the draft and the internal audit team should work to achieve consensus and reach an agreement on the internal audit findings.
Formal Draft – The internal auditor should then prepare a formal draft, taking into account any revision or modification resulting from the exit meeting and other discussions. When the changes have been reviewed by the internal auditor and the entity management, the final report should be issued.
Final Report – The internal auditor should submit the final report to the appointing authority or such members of management, as directed. The periodicity of the Report should be as agreed in the scope of the internal audit engagement. The internal auditor should mention in the Report, the dates of discussion draft, exit meeting, Formal Draft and Final Report.”
The Communication Process
Establishing the Communication Process
9. Clear communication of the internal auditor’s responsibilities, the planned scope and timing of the internal audit, and the expected general content of communications helps establishing the basis for effective two-way communication.
10. Matters that contribute to effective two-way communication include:
Forms of Communication
11. Effective communication may involve structured presentations and written reports as well as less structured communications, including discussions. The internal auditor may communicate matters other than those described in the terms of engagement, either orally or in writing.
12. In addition to the significance of a particular matter, the form of communication (e.g., whether to communicate orally or in writing, the extent of detail or summarization in the communication, and whether to communicate in a structured or unstructured manner) may be affected by such factors as:
a. Whether the matter has been satisfactorily resolved.
b. Whether management has previously communicated the matter.
c. The size, operating structure, control environment, and legal structure of the entity.
d. In the case of an internal audit of a specific aspect of an operation, whether the internal auditor also audits the entire operation or the entity.
e. The expectations of the management, including arrangements made for periodic meetings or communications with the auditor.
f. The amount of ongoing contact and dialogue the internal auditor has
with the management.
g. Whether there have been significant changes in the membership of a governing body.
Timing of Communications
13.The appropriate timing for communications will vary with the circumstances of the engagement. Relevant circumstances include the significance and nature of the matter, and the action expected to be taken by the management. For example:
Adequacy of the Communication Process
14. The internal auditor need not design specific procedures to support the evaluation of the two-way communication with the management, rather, that evaluation may be based on observations resulting from audit procedures performed for other purposes. Such observations may include:
15. Inadequate two-way communication may indicate an unsatisfactory control environment and influence the internal auditor’s assessment of the risks of material misstatements. There is also a risk that the internal auditor may not have obtained sufficient appropriate internal audit evidence to support his findings or opinion.
16. Where matters required by this SIA to be communicated are communicated orally, the internal auditor shall document them, and when and to whom they were communicated. Where matters have been communicated in writing, the auditor shall retain a copy of the communication as part of the internal audit documentation.
17. This Standard on Internal Audit is effective for all internal audits beginning on or after ………. Earlier application of the Standard is encouraged.
* Published in the January, 2009 issue of The Chartered Accountant.