Applying Communication Attributes to Engagement Results: A Complete CIA Exam Guide
Introduction
Every internal audit engagement ends with a communication. A strong engagement loses its value if the results are communicated poorly. The IIA's Global Internal Audit Standards (Principle 11, Standard 11.2 Effective Communication) and the earlier Standard 2420 (Quality of Communications) require engagement communications to have specific quality attributes. CIA candidates are regularly tested on recognizing, applying and distinguishing these attributes in practical scenarios.
Why It Is Important
1. Credibility of internal audit: Reports with errors, bias or vague wording damage the reputation and independence of the internal audit activity.
2. Driving action: Management can only fix problems they understand. Clear, constructive and timely communications lead to faster and better corrective action.
3. Supporting governance: The board and senior management rely on audit communications to oversee risk and control. Incomplete or late information weakens oversight.
4. Professional conformance: Communicating with these attributes is a mandatory requirement. Failing to do so is a nonconformance with the Standards.
5. Relationship building: Objective and constructive communications build trust with engagement clients, so they are more likely to accept recommendations.
What It Is: The Seven Communication Attributes
A useful memory aid is ACCCCOT, or simply remember Accurate, Objective, Clear, Concise, Constructive, Complete, Timely.
1. Accurate - Free from errors and distortions and faithful to the underlying facts. Figures, names, dates and descriptions must be supported by sufficient, reliable evidence in the workpapers.
Example of violation: The report states losses of $500,000 when the evidence supports $50,000.
2. Objective - Fair, impartial and unbiased, the result of a balanced assessment of all relevant facts and circumstances. Auditors avoid emotional, inflammatory or blaming language and acknowledge satisfactory performance where appropriate.
Example of violation: Describing a manager as careless or incompetent, or reporting only negatives while ignoring strong controls observed.
3. Clear - Easily understood and logical. Avoids unnecessary technical jargon, defines terms when needed, and presents information in a logical structure the audience can follow.
Example of violation: A board-level summary full of IT acronyms with no explanation.
4. Concise - To the point; avoids unnecessary elaboration, redundancy, superfluous detail and wordiness. Concise does not mean short at any cost; it means every word adds value.
Example of violation: A 60-page report repeating the same finding in several sections with long narratives of routine procedures.
5. Constructive - Helpful to the engagement client and the organization, leading to improvements where needed. Tone is collaborative and recommendations are practical and actionable.
Example of violation: Listing problems without recommendations, or using a fault-finding tone.
6. Complete - Lacks nothing essential to the target audience and includes all significant and relevant information and observations to support conclusions and recommendations.
Example of violation: Omitting the cause or the effect of a finding, or leaving out a significant issue to avoid upsetting management.
7. Timely - Opportune and expedient, depending on the significance of the issue, allowing management to take appropriate corrective action. Urgent matters (e.g., fraud indications, serious control failures) may require interim communication before the final report.
Example of violation: Waiting three months after fieldwork to report a critical security weakness.
How It Works in Practice
Step 1 - Plan the communication: During engagement planning, identify audience(s), format, distribution and expected timing. Different audiences (board, senior management, process owners) need different levels of detail.
Step 2 - Develop findings with all elements: A complete finding normally includes criteria (what should be), condition (what is), cause (why it happened), effect/risk (consequence or potential impact), and recommendation or management action plan. Missing elements point to a completeness problem.
Step 3 - Verify against evidence: Trace every statement to workpapers to ensure accuracy. Supervisory review checks that conclusions are supported.
Step 4 - Edit for clarity, conciseness and objectivity: Remove jargon, repetition and loaded words. Use executive summaries, ratings and headings to make significant issues stand out.
Step 5 - Discuss with management: Exit or closing meetings allow management to confirm facts (supporting accuracy and objectivity), present their views and agree on action plans (supporting constructiveness).
Step 6 - Issue on time: Issue interim communications for urgent issues and the final communication promptly after the engagement.
Step 7 - Correct errors and omissions: If a final communication contains a significant error or omission, the chief audit executive must communicate corrected information to all parties who received the original communication (Standard 11.4; formerly 2421).
Related Concepts Often Tested
- Overall conclusions/opinions must be supported by sufficient evidence and consider the expectations of stakeholders.
- Acknowledging satisfactory performance supports objectivity and balance.
- Disclosure of nonconformance with the Standards when it affects a specific engagement.
- Communicating risk acceptance: if management accepts a risk the CAE believes exceeds risk appetite, the CAE discusses it with senior management and, if unresolved, with the board.
- Dissemination: the CAE determines distribution, and communications outside the organization require appropriate consideration of confidentiality and legal advice where needed.
Exam Tips: Answering Questions on Applying Communication Attributes to Engagement Results
1. Memorize the official definitions. Many questions quote a definition and ask which attribute it describes. Keywords: free from errors = Accurate; fair, impartial, unbiased = Objective; easily understood, logical = Clear; avoids unnecessary elaboration = Concise; helpful, leads to improvement = Constructive; lacks nothing essential = Complete; opportune, expedient = Timely.
2. Distinguish commonly confused pairs.
- Concise vs Complete: Extra, repetitive detail violates conciseness; missing essential information violates completeness.
- Accurate vs Objective: Wrong facts or numbers = accuracy; correct facts presented in a biased or one-sided way = objectivity.
- Clear vs Concise: Jargon and confusing structure = clarity; wordiness and redundancy = conciseness.
- Objective vs Constructive: Blaming individuals is mainly an objectivity issue; a report that offers no path to improvement is mainly a constructiveness issue.
3. Look for the dominant flaw in scenarios. Questions often ask which attribute is most clearly violated. Pick the one that best matches the core problem rather than one that is loosely related.
4. Timely does not mean rushed. Timeliness depends on the significance of the issue. Releasing an unreviewed or unsupported report quickly is not the right answer; issuing an interim communication for an urgent matter usually is.
5. Know the errors and omissions rule. If a significant error is found after issuance, the correct answer is that the CAE communicates corrected information to all original recipients, not just the engagement client and not by quietly updating the workpapers.
6. Remember the elements of a finding. If an option omits cause or effect, or a recommendation lacks a link to the root cause, suspect a completeness or constructiveness problem.
7. Tailor to the audience. Answers that adjust detail and language to the reader (summary for the board, detail for process owners) are usually correct because they serve clarity, conciseness and completeness together.
8. Watch out for distractors. Options such as removing an issue because management disagrees, softening a significant finding to preserve relationships, or delaying a report until all disagreements are resolved typically violate completeness, objectivity or timeliness. Management disagreement should be documented, not used to omit findings.
9. Practice sample reasoning.
Q: An audit report describes a supervisor's actions as reckless and negligent. Which attribute is most likely lacking? Answer: Objective (emotional and biased language).
Q: A report includes three pages describing standard audit procedures that add no insight. Which attribute is lacking? Answer: Concise.
Q: A report identifies weaknesses but provides no recommendations or action plans. Which attribute is lacking? Answer: Constructive.
Q: Fieldwork ended in January, but a report on a critical fraud risk was issued in June. Answer: Timely.
10. Read every option. Several options may sound reasonable; the best answer aligns precisely with the Standards' wording and the most significant issue in the scenario.
Summary
Applying communication attributes means ensuring every engagement communication is accurate, objective, clear, concise, constructive, complete and timely. These qualities make audit results credible and actionable and support good governance. For the exam, master the definitions, learn to distinguish similar attributes, identify the dominant flaw in scenarios, and remember related rules such as interim reporting and correcting errors and omissions.
