Standard on Internal Audit (SIA) 9, Communication with Management

The following is the text of the Standard on Internal Audit (SIA) 9, Communication with Management, issued by the Council of the Institute of Chartered Accountants of India.. These Standards should be read in conjunction with the Preface to the Standards on Internal Audit, issued by the Institute.

In terms of the decision of the Council of the Institute of Chartered Accountants of India taken at its 260th meeting held in June 2006, the following Standard on Internal Audit shall be recommendatory in nature in the initial period. The Standards shall become mandatory from such date as notified by the Council.

Introduction

1. This Standard on Internal Audit provides a framework for the internal auditor’s communication with management and identifies some specific matters to be communicated with the management as described in the terms of the engagement.

2. The internal auditor while performing audit should :

a. Communicate clearly the responsibilities of the internal auditor, and an overview of the planned scope and timing of the audit with the management;

b. Obtain information relevant to the internal audit from the management;

c. Provide timely observations arising from the internal audit that are significant and relevant to their responsibility as described in the scope of the engagement to the management; and

d. Promote effective two-way communication between the internal auditor and the management.

Matters to be Communicated

The Internal Auditor’s Responsibilities in Relation to the Terms of Engagement

3. The internal auditor is responsible for performing the internal audit in accordance with the terms of engagement.

Planned Scope and Timing of the Internal Audit

4. Communication regarding the planned scope and timing of the internal audit may:

a. Assist the management:

• to understand better the objectives of the internal auditor’s work;
• to discuss issues of risk and materiality with the internal auditor; and
• to identify any areas in which they may request the internal auditor to undertake additional procedures;

b. Assist the internal auditor to understand better the entity and its environment.

5. When communicating to management about planned scope and timing of the internal audit, the internal auditor would need to ensure that such communication does not reduce the effectiveness of internal audit. For example, communicating the nature and timing of detailed audit procedures may make those procedures predictable.

6. Matters communicated may include:

• How the internal auditor proposes to address the significant risks of material misstatement, whether due to fraud or error.
• The internal auditor’s approach to internal control relevant to the internal audit.
• The application of materiality in the context of an internal audit.

7. Communication with management may assist the internal auditor to plan the scope and timing of the internal audit. It does not, however, change the internal auditor’s sole responsibility to establish the overall internal audit strategy and the internal audit plan, including the nature, timing and extent of procedures necessary to obtain sufficient appropriate audit evidence.

Significant Findings from the Internal Audit

8. Paragraph 25 of the Standard on Internal Audit(SIA) 4, “Reporting”, states:

“25. The internal audit report contains the observations and comments of the internal auditor, presents the audit findings, and discusses recommendations for improvements. To facilitate communication and ensure that the recommendations presented in the final report are practical from the point of view of implementation, the internal auditor should discuss the draft with the entity’s management prior to issuing the final report. The different stages of communication and discussion should be as under:

Discussion Draft – At the conclusion of fieldwork, the internal auditor should draft the report after thoroughly reviewing his working papers and the discussion draft before it is presented to the entity’s management for auditee’s comments. This discussion draft should be submitted to the entity management for their review before the exit meeting.

Exit Meeting – The internal auditor should discuss with the management of the entity regarding the findings, observations, recommendations, and text of the discussion draft. At this meeting, the entity’s management should comment on the draft and the internal audit team should work to achieve consensus and reach an agreement on the internal audit findings.

Formal Draft – The internal auditor should then prepare a formal draft, taking into account any revision or modification resulting from the exit meeting and other discussions. When the changes have been reviewed by the internal auditor and the entity management, the final report should be issued.

Final Report – The internal auditor should submit the final report to the appointing authority or such members of management, as directed. The periodicity of the Report should be as agreed in the scope of the internal audit engagement. The internal auditor should mention in the Report, the dates of discussion draft, exit meeting, Formal Draft and Final Report.”

The Communication Process

Establishing the Communication Process

9. Clear communication of the internal auditor’s responsibilities, the planned scope and timing of the internal audit, and the expected general content of communications helps establishing the basis for effective two-way communication.

10. Matters that contribute to effective two-way communication include:

• Clarity in the purpose of communications which makes the internal auditor and the management better placed to have a mutual understanding of relevant issues and the expected actions arising from the communication process.
• Clarity in the form in which communications will be made.
• Identifying the person(s) in the internal audit team and the management who will be responsible for communicating particular matters.
• The internal auditor’s expectation that communication will be two-way, and that the management will communicate with the internal auditor, matters they consider relevant to the internal audit, for example, strategic decisions that may significantly affect the nature, timing and extent of internal audit procedures, the suspicion or the detection of fraud, and concerns with the integrity or competence of senior management.
• The process for taking action and reporting back on matters communicated by the internal auditor and the management.

Forms of Communication

11. Effective communication may involve structured presentations and written reports as well as less structured communications, including discussions. The internal auditor may communicate matters other than those described in the terms of engagement, either orally or in writing.

12. In addition to the significance of a particular matter, the form of communication (e.g., whether to communicate orally or in writing, the extent of detail or summarization in the communication, and whether to communicate in a structured or unstructured manner) may be affected by such factors as:

a. Whether the matter has been satisfactorily resolved.

b. Whether management has previously communicated the matter.

c. The size, operating structure, control environment, and legal structure of the entity.

d. In the case of an internal audit of a specific aspect of an operation, whether the internal auditor also audits the entire operation or the entity.

e. The expectations of the management, including arrangements made for periodic meetings or communications with the auditor.

f. The amount of ongoing contact and dialogue the internal auditor has
with the management.

g. Whether there have been significant changes in the membership of a governing body.

Timing of Communications

13.The appropriate timing for communications will vary with the circumstances of the engagement. Relevant circumstances include the significance and nature of the matter, and the action expected to be taken by the management. For example:

• Communications regarding planning matters may often be made early in the audit engagement.
• It may be appropriate to communicate a significant difficulty encountered during the internal audit as soon as practicable.
• Similarly, it may be appropriate to communicate material weaknesses in the design, implementation or operating effectiveness of internal control that have come to the internal auditor’s attention as soon as practicable.
• Communications regarding independence may be appropriate whenever significant judgments are made about threats to independence and related safeguards.
• The exit meeting may also be an appropriate time to communicate findings from the internal audit.

Adequacy of the Communication Process

14. The internal auditor need not design specific procedures to support the evaluation of the two-way communication with the management, rather, that evaluation may be based on observations resulting from audit procedures performed for other purposes. Such observations may include:

• The appropriateness and timeliness of actions taken by the management in response to matters raised by the internal auditor. Where significant matters raised in previous communications have not been dealt with effectively, it may be appropriate for the internal auditor to inquire as to why appropriate action has not been taken, and to consider raising the point again. This avoids the risk of giving an impression that the internal auditor is satisfied that the matter has been adequately addressed or is no longer significant.
• The apparent openness of the management in their communications with the internal auditor.
• The apparent ability of the management to fully comprehend matters raised by the internal auditor, for example, the extent to which the management probes issues and questions recommendations made to them.
• Difficulty in establishing the management, a mutual understanding of the form, timing and expected general content of communications.
• Whether the two-way communication between the internal auditor and the management meets applicable legal and regulatory requirements.

15. Inadequate two-way communication may indicate an unsatisfactory control environment and influence the internal auditor’s assessment of the risks of material misstatements. There is also a risk that the internal auditor may not have obtained sufficient appropriate internal audit evidence to support his findings or opinion.

Documentation

16. Where matters required by this SIA to be communicated are communicated orally, the internal auditor shall document them, and when and to whom they were communicated. Where matters have been communicated in writing, the auditor shall retain a copy of the communication as part of the internal audit documentation.

Effective Date

17. This Standard on Internal Audit is effective for all internal audits beginning on or after ………. Earlier application of the Standard is encouraged.

Note:

* Published in the January, 2009 issue of The Chartered Accountant.

Source- ICAI