Communicating Results to Management of the Activity Under Review: A Complete CIA Exam Guide
Overview
Communicating results to the management of the activity under review is the stage where the internal auditor shares observations, conclusions, and recommendations with the people who own and run the audited process. In the CIA syllabus this sits within Engagement Results and Monitoring. It is not just delivering a report. It is a structured, two-way process designed to make sure findings are accurate and accepted, and that they lead to corrective action.
Why It Is Important
1. Accuracy and fairness: Discussing findings with the auditee's management before finalizing them lets the auditor confirm facts. It also surfaces information the auditor may have missed and avoids misunderstandings.
2. Buy-in and ownership: Management that has helped shape the findings is far more likely to accept them. It is also more likely to commit to realistic action plans.
3. No surprises: Operating management should never first learn of a significant finding from senior management or the board. Early communication protects working relationships and the credibility of internal audit.
4. Timely remediation: Communicating serious issues promptly, including during fieldwork, allows urgent risks to be addressed before the final report.
5. Value and credibility: Constructive, well-supported communications show that internal audit improves operations rather than simply criticizing them.
6. Conformance with the Standards: The IIA Standards require engagement communications to meet defined quality criteria. They also require auditors to seek management's responses and action plans.
What It Is
It is the process of conveying engagement results to the management responsible for the area audited. Communication happens through several channels:
• Interim communications: These are informal or formal updates during fieldwork, often oral. They are especially important for significant issues needing immediate attention.
• Discussion (draft) report: This is a preliminary written version shared with auditee management for review and comment.
• Exit (closing) conference: This is a meeting at the end of fieldwork. Auditors and auditee management discuss the findings, recommendations, and proposed corrective actions.
• Management responses and action plans: These are management's written replies. Each one states whether management agrees, what action it will take, who is responsible, and by when.
• Final engagement communication: This is the formal report. It includes objectives, scope, results, conclusions or opinions, recommendations, and management's action plans.
How It Works
Step 1: Plan communications early. At the planning stage, the auditor agrees with the auditee on who will receive results, in what format, and on what timeline.
Step 2: Communicate during fieldwork. Observations are discussed with process owners as they arise. This validates the facts and prevents surprises. Significant issues, such as fraud indicators or major control failures, are escalated promptly.
Step 3: Develop findings using the elements of an observation. Each finding is typically built on five elements, often called the 5 Cs:
• Criteria: what should be (policy, standard, expectation).
• Condition: what is (the factual evidence found).
• Cause: why the gap exists (the root cause).
• Consequence or Effect: the risk or impact of the gap.
• Corrective action or Recommendation: what should be done.
Step 4: Issue a draft and hold the exit conference. Management reviews the draft and the parties discuss it.
• Factual errors are corrected.
• Disagreements are explored.
• Management begins forming action plans.
Step 5: Obtain management responses. Management states agreement or disagreement and gives action plans, owners, and target dates. If management disagrees, the auditor does not drop a well-supported finding. Instead, the report presents both the auditor's position and management's position, along with the reasons.
Step 6: Issue the final communication. The chief audit executive (CAE) is responsible for reviewing and approving the final communication and deciding on distribution. Recipients include the management of the activity and others who can ensure results get proper consideration, such as senior management and the board. Distribution outside the organization requires extra care, such as assessing risks, consulting legal counsel, and limiting distribution.
Step 7: Monitor follow-up. Internal audit tracks whether action plans are implemented. If management accepts a level of risk the CAE believes is unacceptable, the CAE discusses it with senior management. If it remains unresolved, the CAE escalates it to the board.
Quality Attributes of Communications
Under the IIA Standards, communications should be:
• Accurate: free of errors and distortions.
• Objective: fair, impartial, and unbiased.
• Clear: easily understood and logical.
• Concise: to the point, without unnecessary detail.
• Constructive: helpful and leading to improvement.
• Complete: containing everything the reader needs.
• Timely: delivered when the information can be acted upon.
A common memory aid is ACOCCC plus Timely. If a final communication contains a significant error or omission, the CAE must communicate corrected information to everyone who received the original.
Tailoring the Message
• Operating management of the activity usually receives detailed findings, root causes, and specific recommendations, because it must fix the issues.
• Senior management and the board usually receive summarized results, overall conclusions, significant risks, and themes.
• Communications should also acknowledge satisfactory performance where appropriate. This keeps reports balanced and constructive.
Exam Tips: Answering Questions on Communicating Results to Management of the Activity Under Review
1. Choose the no-surprises answer. If a question asks what the auditor should do before issuing a final report, the best answer is usually to discuss findings with the auditee's management. This typically happens through the exit conference or a draft review.
2. Know the main purpose of the exit conference. It is to confirm the accuracy of findings, clear up misunderstandings, and discuss corrective action. It is not to negotiate away valid findings or let management rewrite the report.
3. Handle disagreement correctly. When management disagrees with a well-supported finding, the auditor keeps the finding and includes management's view in the report. Wrong answers include deleting the finding, delaying the report indefinitely, or going straight to the board without discussion.
4. Remember who decides distribution. The CAE approves final communications and decides who receives them. It is not the staff auditor and not the auditee.
5. Communicate significant issues immediately. For urgent matters such as fraud, safety, or serious control breakdowns, the correct answer is usually prompt communication during fieldwork, not waiting for the final report. For suspected fraud involving management, communication goes to an appropriate level above those involved.
6. Match the quality attribute to the scenario. Expect questions like "A report omitted key information, which attribute was violated?" The answer is Complete. Other pairings:
• Unnecessary detail violates Concise.
• Biased tone violates Objective.
• A late report violates Timely.
• Jargon-filled writing violates Clear.
• An accusatory tone violates Constructive.
7. Recognize the elements of a finding. You may be asked which element explains why a problem occurred (Cause) or the risk it creates (Effect). Root cause is critical, because recommendations should address the cause, not just the symptom.
8. Separate who acts from who oversees. Operating management designs and implements corrective action. Internal audit recommends and monitors, but does not implement, because implementing would impair objectivity.
9. Distinguish risk acceptance from escalation. If management accepts a risk the CAE considers unacceptable, the sequence is: discuss with senior management first, then escalate to the board if unresolved.
10. Watch the words BEST, FIRST, and MOST. Several answer options may sound reasonable. Pick the one that follows the proper sequence, such as communicating with auditee management before senior management. Also favour the option that is collaborative, evidence-based, and consistent with the Standards.
11. Handle errors in issued reports. If a final report contains a significant error, the CAE sends corrected information to all parties who received the original.
12. Eliminate extreme options. Answers that promise the auditee full control over report content, or that skip discussion with management entirely, are almost always wrong.
Quick Summary
Communicating results to management of the activity under review is a continuous, collaborative process: interim discussions, a draft report, the exit conference, management responses, the final report, and follow-up. It ensures findings are accurate, accepted, and acted upon. For the exam, apply four principles: no surprises, objectivity, CAE responsibility for distribution, and proper escalation.
