Formal and Informal Communication with Stakeholders (CIA Part 3: Internal Audit Operations)
Introduction
Communication is one of the most important tools an internal audit function has. A technically excellent audit adds little value if its results are not shared with the right people, at the right time, in the right way. In CIA Part 3 (Business Knowledge for Internal Auditing, under the Internal Audit Operations domain), candidates are expected to understand how the Chief Audit Executive (CAE) and the audit team communicate with stakeholders. This covers both formal channels (structured, documented, scheduled) and informal channels (relationship-based, ongoing, often verbal). This guide explains what these channels are, why they matter, how they work in practice, and how to handle exam questions on the topic.
Why It Is Important
1. Independence and organizational standing: Regular formal reporting to the board and functional reporting lines protect the independence of internal audit. Informal contact, such as private sessions with the audit committee chair, lets the CAE raise sensitive issues without filtering by management.
2. Value delivery: The Global Internal Audit Standards (2024) stress that internal audit must understand stakeholder expectations and communicate insights, assurance and advice. Communication is how internal audit's value becomes visible.
3. Relationship building and trust: Informal communication builds rapport, reduces auditee anxiety, and encourages management to share information openly. This improves audit quality and makes it easier to get agreement on corrective action.
4. Risk awareness: Ongoing informal dialogue helps the CAE spot emerging risks, organizational changes and control weaknesses early, supporting a dynamic, risk-based audit plan.
5. Accountability and documentation: Formal communication creates an auditable record of what was found, reported and agreed. This supports accountability, follow-up and quality assurance.
6. Compliance with Standards: The Standards require specific formal communications, including the internal audit charter, the audit plan and resource requirements, final engagement results, the results of the Quality Assurance and Improvement Program (QAIP), and communication of risk acceptance where management accepts an unacceptable level of risk.
What It Is
Stakeholders of internal audit include:
- The board and audit committee
- Senior management (CEO, CFO, CRO and others)
- Operational management and auditees (process owners)
- External auditors
- Regulators
- Other assurance providers (risk management, compliance, legal, IT security)
- Employees, and sometimes customers, vendors or the public, depending on the engagement
Formal communication is structured, planned, usually written or delivered in official settings, and often documented and retained. Examples:
- The internal audit charter and its periodic review and approval
- The annual or periodic risk-based audit plan and budget presented to the board
- Engagement letters or memos (scope, objectives, timing)
- Entrance (opening) and exit (closing) conferences
- Draft and final engagement reports
- Management action plans and responses
- Periodic activity reports to the board and audit committee (plan progress, significant risk exposures, control issues, fraud risks, governance issues)
- Follow-up and monitoring reports on corrective actions
- Annual reports, overall opinions and QAIP results
- Memos escalating significant issues or risk acceptance
Informal communication is unstructured, conversational, relationship-driven, frequent and often undocumented (though key points should be recorded in workpapers when relevant). Examples:
- Hallway conversations and quick check-ins with auditees during fieldwork
- Progress updates by phone, email or chat
- Discussing preliminary observations with process owners as they arise ("no surprises")
- Regular one-on-one meetings between the CAE and the audit committee chair or senior executives
- Networking, attending management meetings as an observer, and lunch or coffee meetings
- Clarifying questions and feedback sessions
How It Works
A. Communication across the engagement life cycle
1. Planning: The CAE talks informally with senior management and the board to understand risks and expectations. Formal outputs are the approved audit plan and an engagement notification or letter to the auditee that sets out objectives, scope, timing and resources.
2. Opening (entrance) conference: A formal meeting with auditee management to confirm scope, timing, contacts, information requests and the reporting process.
3. Fieldwork: Mostly informal. Auditors interview staff, give status updates, validate facts, and discuss potential findings as they emerge. This prevents surprises and confirms accuracy. Significant or urgent issues, such as fraud indicators or serious control breakdowns, may need immediate formal escalation (an interim report) rather than waiting for the final report.
4. Closing (exit) conference: A formal meeting to discuss observations, root causes, recommendations and management's planned actions before the report is finalized.
5. Reporting: A formal draft report followed by the final report, including management responses and action plans. Communications must be accurate, objective, clear, concise, constructive, complete and timely, which are the IIA's quality criteria for communications. The final report goes to the parties who can ensure results get proper consideration.
6. Follow-up: A formal monitoring process tracks whether management implements agreed actions, with status reported to senior management and the board. Informal reminders and check-ins support it.
B. CAE communication with the board and senior management
- Formal: Scheduled audit committee meetings, written periodic reports, charter approval, plan approval, resource adequacy, QAIP results, conformance with Standards, and any impairments to independence or objectivity.
- Informal: Regular private (in-camera) sessions without management present, and ongoing dialogue with the audit committee chair and executives about emerging risks and strategic changes.
- Risk acceptance: If the CAE concludes management has accepted a level of risk that may be unacceptable, the CAE must discuss it with senior management. If unresolved, the CAE must communicate it to the board. This is a formal, documented escalation.
C. Communication with other stakeholders
- External auditors: Formal coordination meetings, sharing of reports and workpapers under agreed terms, and informal ongoing contact to avoid duplicated effort.
- Regulators: Usually formal, with due care for confidentiality and in line with organizational policy and legal advice.
- Other assurance providers: Coordination and reliance, often supported by combined assurance maps or the three lines model, using both formal and informal exchanges.
- Dissemination outside the organization: Before releasing results externally (unless required by law or regulation), the CAE must assess the potential risk, consult senior management and/or legal counsel as appropriate, and control dissemination by restricting use of the results.
D. Choosing between formal and informal communication
Consider these factors:
- Significance and sensitivity: Significant findings, fraud, and legal or regulatory matters need formal, documented communication. Routine coordination can be informal.
- Audience: The board receives formal, concise, strategic summaries. Auditees and process owners get detailed, frequent and often informal contact.
- Timing: Urgent matters need prompt communication, informal first if necessary but followed by formal documentation.
- Need for evidence or accountability: Agreed action plans, scope changes and limitations must be formalized.
- Organizational culture: Some cultures favor written, hierarchical communication. Others are collaborative and informal.
E. Balancing the two
Formal and informal communication complement each other. Informal communication builds trust and gathers intelligence. Formal communication creates accountability and fulfils Standards requirements. Key principles:
- Informal communication never replaces required formal communication.
- Findings discussed informally should not appear in the final report as a surprise. Equally, final reports should not contain issues never discussed with management.
- Significant information gathered informally should be documented in workpapers.
- Informal channels must not compromise objectivity. Friendly relationships with auditees must not soften findings.
F. Errors and omissions
If a final communication contains a significant error or omission, the CAE must formally communicate corrected information to all parties who received the original.
G. Barriers and good practices
Barriers: jargon, overly long reports, defensiveness of auditees, perceived "policing" role, poor timing, cultural or language differences, and lack of access to the board.
Good practices: tailor the message to the audience, lead with key messages and risk significance, use executive summaries and visuals, practice the "no surprises" principle, listen actively, maintain a stakeholder communication plan, and seek stakeholder feedback through surveys after engagements.
Exam Tips: Answering Questions on Formal and Informal Communication with Stakeholders
1. Know which communications must be formal. Charter, audit plan and resources, final engagement results, periodic reports to the board, QAIP results, nonconformance disclosures, risk acceptance escalation, and corrections of significant errors are formal. If an answer suggests handling these only informally, it is almost always wrong.
2. Choose the "no surprises" answer. When asked how to handle preliminary findings, the best answer usually involves discussing them with auditee management during fieldwork or at the exit conference before the final report is issued.
3. Recognize the purpose of informal communication. Look for keywords such as building relationships, gaining insight into emerging risks, validating facts, promoting cooperation, and understanding expectations. Informal communication supports formal reporting. It does not replace it.
4. Escalation hierarchy. For unresolved disagreements or risk acceptance, the sequence is: discuss with the responsible management, then senior management, then the board. Do not pick answers where the auditor goes straight to the board on a routine issue, or straight to external parties.
5. Urgent and significant issues. If fraud or a serious control failure is discovered mid-engagement, the correct answer is usually prompt communication to the appropriate level of management (or to the board if management is involved), often through an interim communication. Waiting for the final report is wrong.
6. Audience matters. The board gets strategic, summarized, risk-focused information. Operational management gets detailed findings and recommendations. Questions may ask which format or content best fits an audience.
7. Private sessions with the audit committee. These support independence. If a question asks how the CAE can raise sensitive concerns about senior management, the answer typically involves private or in-camera meetings with the audit committee or its chair.
8. External dissemination. Look for answers that include assessing risk, consulting senior management or legal counsel, and restricting use. Releasing reports to outsiders without these steps is incorrect unless it is legally required.
9. Quality attributes. Memorize the criteria: accurate, objective, clear, concise, constructive, complete, timely. Scenario questions often describe a flawed communication and ask which attribute is missing. For example, a late report lacks timeliness and a biased report lacks objectivity.
10. Documentation of informal discussions. If a significant matter is raised informally, the best practice is to document it in the workpapers and, where needed, follow up formally.
11. Watch for objectivity traps. Answers that allow informal relationships to influence report content, or that let management edit findings, are wrong. Management may provide responses and correct factual errors, but conclusions remain internal audit's.
12. Read for "BEST" or "MOST appropriate." Several options may be partly correct. Choose the one that best balances timeliness, the right level of authority, conformance with Standards, and relationship preservation.
13. Link to stakeholder expectations. The 2024 Standards emphasize understanding stakeholder expectations and building relationships. Answers reflecting proactive, ongoing engagement with stakeholders are usually preferred over passive, report-only approaches.
Quick Example Question
During fieldwork, an auditor identifies a potentially significant control weakness in the payment approval process. What is the MOST appropriate next step?
A. Wait and include it in the final report.
B. Discuss it informally with the process owner to validate the facts, document the discussion, and communicate promptly to appropriate management if confirmed.
C. Report it directly to the audit committee.
D. Notify the external auditor first.
Answer: B. It combines informal validation (no surprises, accuracy) with timely formal communication and documentation, while respecting the escalation hierarchy.
Summary
Formal communication gives internal audit structure, accountability and conformance with Standards. Informal communication gives it relationships, insight and cooperation. Effective internal audit functions use both deliberately, tailored to each stakeholder and to the significance and urgency of the matter. For the exam, remember: required items are formal, there should be no surprises, escalate through the proper hierarchy, protect independence and objectivity, and communicate with quality (accurate, objective, clear, concise, constructive, complete, timely).
