Communicating Engagement Results

Introduction
Communicating engagement results is the stage of an internal audit engagement where the auditor's work turns into value for the organization. Fieldwork, testing and analysis matter only when the findings, conclusions and recommendations reach the right people in the right form at the right time. In the CIA Challenge Exam, which is aligned with the IIA's Global Internal Audit Standards and the International Professional Practices Framework (IPPF), this topic sits within the domain covering engagement results and monitoring. It is a frequent source of scenario-based questions.

Why Communicating Engagement Results Is Important
Internal auditing exists to enhance and protect organizational value by providing risk-based, objective assurance, advice and insight. Good communication delivers this in several ways:

1. It drives action. Management cannot fix control weaknesses it does not understand. Clear communication prompts corrective action and process improvement.
2. It supports governance. The board and senior management rely on internal audit reports to oversee risk management, control and governance.
3. It establishes accountability. Documented results, management responses and action plans create a record that can be monitored and followed up.
4. It builds credibility. Accurate, objective and timely reports raise trust in the internal audit function. Poor communication damages its reputation even when the underlying work is sound.
5. It meets professional requirements. The Standards explicitly require internal auditors to communicate engagement results, including specific elements and quality characteristics.

What Communicating Engagement Results Is
Communicating engagement results is the formal and informal process of conveying:
- the engagement's objectives, scope and results;
- findings (also called observations);
- conclusions or overall opinions;
- recommendations and/or management's action plans.

Communication happens throughout the engagement, not only at the end. It includes:
- interim communications during fieldwork;
- exit or closing conferences;
- draft reports;
- final reports;
- the distribution of results.

Key Elements of an Engagement Finding
A well-developed finding is often described with five attributes. Many trainers use the mnemonic Criteria, Condition, Cause, Consequence (Effect), Corrective Action (Recommendation), the 5 Cs:

- Criteria: what should exist, such as policies, procedures, laws, standards or targets.
- Condition: what actually exists, as found by the auditor.
- Cause: why the gap between criteria and condition exists. This is the root cause.
- Effect (Consequence): the risk or exposure resulting from the gap, ideally quantified.
- Recommendation: the action needed to correct the condition and address the root cause.

Quality Characteristics of Communications
Communications must be:

- Accurate: free from errors and distortions, and faithful to the underlying facts.
- Objective: fair, impartial, unbiased, and based on a balanced assessment of all relevant facts.
- Clear: logical and easily understood, avoiding unnecessary technical language.
- Concise: to the point, without unnecessary detail, wordiness or redundancy.
- Constructive: helpful to the engagement client and the organization, leading to improvements where needed.
- Complete: lacking nothing essential to the target audience, with all significant and relevant information.
- Timely: well-timed and expedient, so management can take appropriate corrective action.

A useful memory aid is ACCCCOT: Accurate, Clear, Complete, Concise, Constructive, Objective, Timely.

How Communicating Engagement Results Works

Step 1: Interim Communications
Auditors often share issues as they arise during fieldwork, especially significant ones such as suspected fraud or critical control failures. This avoids surprises, lets management start remediation early, and helps confirm facts. Interim communications do not replace the final report.

Step 2: Validating Findings
Before reporting, auditors discuss findings with the appropriate level of management. This confirms accuracy, completes the auditor's understanding of root causes, and gathers management's perspective.

Step 3: The Exit (Closing) Conference
The exit conference is a meeting between the audit team and engagement client management. Its purposes are to:
- review findings and recommendations;
- clear up misunderstandings;
- obtain management's responses and planned corrective actions, with owners and target dates.
It promotes the no surprises principle.

Step 4: Draft Report
A draft is often circulated to management for review and response. Management's comments, action plans and timelines may be included in the final report. Management can correct factual errors, but cannot force the removal of valid findings.

Step 5: Final Engagement Communication
The final communication normally includes:
- the engagement objectives and scope;
- applicable conclusions;
- recommendations and/or action plans;
- where appropriate, the internal auditor's overall opinion or conclusion.

Reports may also:
- recognize satisfactory performance;
- include management's responses;
- provide an executive summary for senior readers.

Step 6: Overall Opinions and Ratings
When an overall opinion is issued, it must consider the expectations of senior management, the board and other stakeholders. It must also be supported by sufficient, reliable, relevant and useful information. Findings are often rated by significance (for example high, medium or low) to help readers prioritize.

Step 7: Disclosure of Nonconformance
If nonconformance with the Standards affects a specific engagement, the communication must disclose:
- the principle or standard not conformed with;
- the reasons for the nonconformance;
- its impact on the engagement and the communicated results.

Reports may state that the engagement was conducted in conformance with the Standards only when the results of the quality assurance and improvement program support that statement.

Step 8: Distribution of Results
The Chief Audit Executive (CAE) is responsible for communicating final results to parties who can ensure the results receive due consideration. Releasing results to parties outside the organization requires the CAE to:
- assess the potential risk to the organization;
- consult with senior management and/or legal counsel, as appropriate;
- control dissemination by restricting the use of the results.

Step 9: Errors and Omissions
If a final communication contains a significant error or omission, the CAE must send corrected information to everyone who received the original communication.

Step 10: Communicating Acceptance of Risk
If the CAE concludes that management has accepted a level of risk that may be unacceptable to the organization, the CAE must first discuss the matter with senior management. If the matter is not resolved, the CAE must communicate it to the board. The CAE does not resolve the risk personally. The responsibility is to escalate and communicate.

Step 11: Monitoring and Follow-Up
Communicating results connects directly to monitoring progress. The CAE must establish and maintain a system to monitor how results communicated to management have been disposed of. This includes follow-up procedures to confirm that management actions were effectively implemented, or that senior management accepted the risk of not acting.

Consulting Engagements
For advisory (consulting) engagements, the form and content of communication vary according to the nature of the engagement and the client's needs, as agreed during planning. If governance, risk management or control issues arise that are significant to the organization, they must be communicated to senior management and the board.

Common Pitfalls in Communicating Results
- Using an accusatory or emotional tone instead of an objective one.
- Reporting symptoms rather than root causes.
- Making vague recommendations that cannot be acted upon.
- Delaying reports so long that findings become stale.
- Removing valid findings because management disagrees.
- Distributing reports outside the organization without the proper assessment and consultation.

Exam Tips: Answering Questions on Communicating Engagement Results

1. Memorize the quality characteristics and their definitions. Exams often describe a report flaw and ask which characteristic was violated. Examples:
- A report padded with irrelevant detail is not concise.
- A report that omits a significant finding is not complete.
- A report that blames individuals with loaded language is not objective or constructive.
- A report issued months after fieldwork is not timely.

2. Know the elements of a finding. Expect questions asking which attribute a statement represents. For example, The policy requires dual approval is the criteria. Three of 25 payments lacked a second approval is the condition. Staff were not trained is the cause. Unauthorized payments could occur is the effect. Root cause is the most frequently tested attribute, because recommendations must address it.

3. Remember who does what.
- The CAE is responsible for final communication and distribution, and for escalating risk acceptance.
- Management owns corrective action.
- The board receives significant issues and unresolved risk acceptance.
Distractors often give management or auditors responsibilities that belong to the CAE.

4. Apply the escalation sequence for risk acceptance. The correct order is to discuss with senior management first and then, if unresolved, communicate to the board. Wrong answers include going directly to the board, going to regulators, or forcing management to act.

5. Distinguish interim and final communications. Interim communications are useful for urgent matters but never replace the final report. If a question asks what to do about a serious issue found mid-engagement, communicating promptly to appropriate management is usually correct.

6. Handle disagreements correctly. If management disagrees with a finding, the auditor should:
- verify the facts;
- consider management's view;
- if still convinced, report the finding, possibly including management's position.
Auditors do not delete valid findings to keep the peace. They do correct genuine factual errors.

7. Watch for external distribution scenarios. The correct response involves assessing risk, consulting senior management and/or legal counsel, and limiting use. Releasing the report freely or refusing outright are usually wrong.

8. Errors after issuance. Corrected information goes to all original recipients. It does not go only to the board, and the report is not simply reissued without notice.

9. Conformance statements and nonconformance disclosure. Claiming conformance requires support from the quality assurance and improvement program. Disclosing nonconformance requires identifying the standard, the reasons and the impact.

10. Look for the most constructive and objective answer. When two options seem plausible, CIA questions usually favor the one that:
- adds value;
- addresses root cause;
- is balanced and acknowledges positive performance;
- supports timely action.

11. Mind qualifier words. Words like must, should, may, best, most and first matter. Questions asking what the auditor should do first often point to validating facts or discussing with management before reporting or escalating.

12. Link communication to follow-up. Communication is not the end of the engagement. Monitoring management's actions is a CAE responsibility, and exam questions may test this connection.

13. Tailor communications to the audience. The board typically needs summarized, high-level, risk-focused information. Operational management needs detailed findings and action steps. Answers that send overly detailed reports to the board, or omit significant issues from it, are usually incorrect.

Quick Review Summary
- Communication occurs throughout the engagement and culminates in a final report.
- Final communications include objectives, scope, conclusions, recommendations and action plans, plus an overall opinion where appropriate.
- Quality characteristics: accurate, objective, clear, concise, constructive, complete, timely.
- Findings are built from criteria, condition, cause, effect and recommendation.
- The CAE controls distribution, corrects significant errors, handles external release carefully, and escalates unacceptable risk acceptance (senior management first, then the board).
- Monitoring and follow-up confirm that communicated results lead to action.

Master these principles and practice applying them to scenarios, and you will be well prepared for questions on Communicating Engagement Results in the CIA Challenge Exam.