Communicating Results to Different Stakeholders: A Complete CIA Exam Guide
Introduction
Communicating engagement results is one of the most visible outputs of the internal audit activity. Fieldwork, testing and analysis only create value when the results reach the right people, in the right form, at the right time. The CIA exam tests whether you can tailor communications to different stakeholders while keeping them accurate, objective, clear, concise, constructive, complete and timely. These are the seven qualities of communication in the IIA guidance.
Why It Is Important
1. Drives action: Findings that are poorly communicated, or sent to the wrong audience, are rarely acted upon. Effective communication makes sure the people with authority to fix problems understand them.
2. Supports governance: The board and senior management depend on internal audit for assurance about risk management, control and governance processes. Communication must give them the level of insight they need to oversee the organization.
3. Builds credibility: Communications that are tailored, balanced and well supported strengthen the reputation and independence of the internal audit activity.
4. Meets the Standards: The IIA Standards (the 2017 Standards in the 2400 series; the Global Internal Audit Standards, Domain V, Principle 11 and Standards 14.1 to 14.6) require internal auditors to communicate results. These communications must include the engagement objectives, scope, conclusions, recommendations and/or action plans.
5. Manages risk exposure: Sensitive or confidential information must be shared only with appropriate parties. Mishandling it can create legal, reputational or regulatory risk.
What It Is
Communicating results to different stakeholders means adapting the content, level of detail, format, tone and timing of audit results to each audience. All versions must still rest on the same factual findings and conclusions.
Key stakeholder groups and their typical needs:
Board / Audit Committee: High-level, strategic and risk-focused summaries. They want significant risk exposures, control issues, fraud risks, governance issues and overall conclusions. Detail is minimal and the focus is on themes, trends and whether management has accepted risk.
Senior Management: Executive summaries with the key findings, root causes, business impact and the status of corrective actions. They are interested in accountability and the allocation of resources.
Operational / Engagement Client Management: Detailed findings, criteria, condition, cause, effect, specific recommendations and action plans with owners and dates. These are the people who implement the fixes.
External Auditors: May receive reports to coordinate coverage and reduce duplication. Sharing is usually governed by policy and approved by the CAE.
Regulators and Other External Parties: Disclosure outside the organization requires special care (see below).
Audit Staff / Internal Audit Team: Lessons learned and quality improvement points.
Elements of an engagement communication (the 5 Cs of a finding):
Criteria: What should be (standards, policies, expectations).
Condition: What is (the factual evidence found).
Cause: Why the gap exists (root cause).
Consequence / Effect: The risk or impact of the gap.
Corrective action: The recommendation or management action plan.
How It Works
Step 1: Identify the stakeholders. At the planning stage, determine who will receive the results. The CAE is responsible for communicating final results to parties who can ensure the results receive due consideration.
Step 2: Hold interim and exit communications. Discuss findings with engagement client management as they arise and in a closing (exit) meeting. This validates facts, prevents surprises and lets management prepare responses and action plans.
Step 3: Draft the communication. Prepare a draft report. Share it with management for review of factual accuracy and so they can provide responses. Management's views may be included, but the auditor's conclusions remain the auditor's.
Step 4: Tailor the outputs.
- Detailed report for operating management.
- Executive summary for senior management.
- Summary or periodic report for the board, often aggregated across engagements, with emphasis on significant issues.
Step 5: Apply quality criteria. Every version must be:
- Accurate: free from errors and distortions.
- Objective: fair, impartial and unbiased.
- Clear: easily understood and logical.
- Concise: no unnecessary elaboration.
- Constructive: helpful and leads to improvement.
- Complete: nothing essential is missing.
- Timely: opportune and expedient.
Step 6: Use overall opinions and ratings where appropriate. When an engagement or overall opinion is issued, it must consider the expectations of senior management, the board and other stakeholders. It must be supported by sufficient, reliable, relevant and useful information.
Step 7: Acknowledge satisfactory performance. Communications are encouraged to recognize good performance, which supports balance and objectivity.
Step 8: Correct errors and disclose nonconformance.
- If a final communication contains a significant error or omission, the CAE must send corrected information to all parties who received the original.
- If nonconformance with the Standards affects a specific engagement, the communication must disclose the principle or standard not conformed with, the reasons and the impact.
Step 9: Disseminate to external parties carefully. Before releasing results outside the organization, the CAE must:
- assess the potential risk to the organization;
- consult with senior management and/or legal counsel as appropriate;
- control dissemination by restricting the use of the results.
Step 10: Handle consulting engagements appropriately. The form and content of consulting communications vary with the nature of the engagement and the client's needs. However, if significant governance, risk or control issues are identified, they must be communicated to senior management and the board.
Step 11: Monitor and follow up. The CAE establishes a process to monitor whether management has taken action or accepted the risk. If management accepts a level of risk the CAE believes is unacceptable, the CAE must first discuss it with senior management. If it remains unresolved, the CAE must communicate the matter to the board.
Tailoring Considerations
Level of detail: Detail decreases as you move up the hierarchy.
Language: Technical terms suit process owners. Business and risk language suits executives and the board.
Format: Written reports, dashboards, heat maps, presentations, memos or verbal briefings.
Timing: Urgent issues such as fraud, illegal acts or imminent loss may require immediate verbal communication to the appropriate level, followed by written communication.
Sensitivity: Fraud involving senior management should go to the board or audit committee rather than to the implicated managers.
Consistency: Tailoring changes presentation, never substance. All audiences must receive a consistent message about conclusions.
Exam Tips: Answering Questions on Communicating Results to Different Stakeholders
Tip 1: Match the audience to the detail. If a question asks what the board should receive, choose the answer emphasizing significant, summarized, risk-focused information. Avoid answers listing every minor finding.
Tip 2: The CAE owns final distribution. Questions about who decides recipients, or who communicates outside the organization, almost always point to the CAE. Answers naming the staff auditor or engagement client are usually wrong.
Tip 3: Remember the three steps for external dissemination. Assess risk, consult senior management/legal counsel, and restrict use. Any answer that releases reports externally without these steps is likely wrong.
Tip 4: Know the order for errors. If a final report has a significant error, the corrected information goes to all original recipients, not just the board or the engagement client.
Tip 5: Watch for conflicts of interest in fraud scenarios. If senior management is involved, report to the board or audit committee. Never report to the person implicated.
Tip 6: Management responses do not change auditor conclusions. Management may disagree. The report can include both views, but the auditor does not remove a supported finding simply because management objects.
Tip 7: Recognize the escalation path for risk acceptance. Discuss with senior management first, then the board. The CAE does not resolve the risk acceptance; the CAE communicates it.
Tip 8: Distinguish assurance and consulting. Consulting communications are flexible and client-driven. However, significant governance, risk or control issues found during consulting must still reach senior management and the board.
Tip 9: Use the quality criteria to eliminate options. If an option sacrifices accuracy or objectivity for brevity, it is wrong. Concise does not mean incomplete.
Tip 10: Look for the most effective, not just a valid, answer. CIA questions often have several plausible options. Choose the one that best ensures the right stakeholder can take action. Examples include an exit meeting before the final report, or an executive summary for executives.
Tip 11: Timeliness beats formality for urgent matters. When significant risk or fraud is discovered, immediate communication to the appropriate level is preferred over waiting for the final report.
Tip 12: Watch keywords. Words like must, should, always, first and most appropriate signal the logic being tested. A question asking what the auditor should do first often points to discussing findings with engagement client management or validating facts.
Sample Question Walkthrough
An internal auditor has completed an audit of procurement and identified twelve findings, two of which are significant. Which is the most appropriate communication to the audit committee?
A. The full detailed report with all twelve findings.
B. A summary highlighting the two significant findings, their risk impact and management's action plans.
C. Verbal briefing only, with no written record.
D. Only the findings management agreed with.
Answer: B. The audit committee needs concise, risk-focused information on significant issues. A is excessive detail. C lacks documentation. D compromises objectivity.
Summary
Communicating results to different stakeholders means delivering one consistent, well-supported set of conclusions in forms suited to each audience. Operating management gets detail and action plans, senior management gets summaries and accountability, and the board gets strategic, significant-risk insight. For the exam, remember five rules:
- the CAE controls distribution;
- external release requires risk assessment, consultation and restrictions;
- errors are corrected to all recipients;
- unacceptable risk acceptance is escalated to the board;
- every communication must meet the seven quality criteria.
