Communicating Nonconformance to Senior Management and the Board

Communicating Nonconformance to Senior Management and the Board: A Complete CIA Part 3 Guide

Introduction
An internal audit function's credibility depends on doing its work in line with The IIA's professional requirements. Sometimes it falls short. A staffing shortage, a scope restriction, an overdue external quality assessment (EQA) or a legal constraint can all cause nonconformance. When that happens, the Chief Audit Executive (CAE) cannot quietly carry on. The CAE must tell senior management and the board.

This guide covers:

• why this communication matters
• what it is
• how it works in practice
• how to answer exam questions on it

1. Why Communicating Nonconformance Is Important
Protects stakeholder reliance. The board, senior management, external auditors and regulators rely on internal audit's assurance. If the work did not follow the Standards, its reliability may be reduced. Stakeholders need to know this so they can adjust how much they rely on it.

Preserves integrity and honesty. The Code of Ethics (now Domain II, Ethics and Professionalism, under the Global Internal Audit Standards) requires honesty and transparency. Hiding nonconformance would be misleading.

Supports board oversight. The board oversees the internal audit function. It cannot approve resources, change the mandate or fix structural problems that it does not know about.

Prevents false claims of conformance. Internal audit may only say its work conforms with the Standards when quality assessment results support that statement. Disclosing nonconformance keeps public and internal claims accurate.

Drives improvement. Disclosure normally comes with an action plan. This turns a weakness into an improvement agenda that the board can track.

Protects the CAE and the profession. Transparent disclosure shows the CAE acted responsibly. It also upholds trust in the internal audit profession as a whole.

2. What It Is
Nonconformance means the internal audit function, or an individual engagement, did not meet one or more requirements of The IIA's Standards or ethical principles.

Under the legacy IPPF (Standards 1300 series and 2431), still widely tested in study materials:

• Standard 1320, Reporting on the QAIP: the CAE must communicate the results of the Quality Assurance and Improvement Program to senior management and the board.
• Standard 1321, Use of 'Conforms with the International Standards': internal audit may state that it conforms only if the QAIP results support that statement.
• Standard 1322, Disclosure of Nonconformance: when nonconformance with the Code of Ethics or the Standards impacts the overall scope or operation of the internal audit activity, the CAE must disclose the nonconformance and its impact to senior management and the board.
• Standard 2431, Engagement Disclosure of Nonconformance: when nonconformance affects a specific engagement, the communication of results must disclose:
  • the principle, rule of conduct or Standard not fully met
  • the reason(s) for the nonconformance
  • the impact on the engagement and on the communicated results

Under the 2024 Global Internal Audit Standards (GIAS):

• Standard 4.1, Conformance with the Global Internal Audit Standards:
  • If laws or regulations prevent conformance with part of the Standards, internal audit must still conform with all other parts and make appropriate disclosures.
  • When internal auditors cannot conform with a requirement, the CAE documents and communicates the circumstances, any alternative actions taken, their impact and the rationale.
• Principle 8 and Standard 8.3, Quality: the CAE communicates QAIP results to the board and senior management, including conformance with the Standards and achievement of performance objectives.
• Standard 8.4, External Quality Assessment: an EQA must be performed at least once every five years. Results, including any nonconformance, are reported to the board and senior management.
• Principle 12 and Standard 12.1, Internal Quality Assessment: ongoing monitoring and periodic self-assessments identify nonconformance. Their results are reported upward.
• Standard 15.1, Final Engagement Communication: engagement-level nonconformance is disclosed within the final engagement communication.

Related but distinct concept: impairment to independence or objectivity (legacy Standard 1130; GIAS Standard 7.1 and Principle 2). An impairment must be disclosed to appropriate parties. It is not automatically the same thing as Standards nonconformance, although an unresolved impairment can lead to nonconformance.

3. How It Works
Step 1: Identify the nonconformance. Common sources:

• ongoing monitoring, such as engagement supervision, review checklists and key performance indicators
• periodic internal self-assessments
• external quality assessments
• regulatory reviews or complaints

Step 2: Evaluate significance. The CAE asks two questions:

• Is it isolated or systemic?
• Does it affect the overall scope or operation of the function, or only a single engagement?

Examples of significant, function-wide nonconformance:

• no EQA within five years
• a CAE who reports to someone who impairs independence
• a lack of an approved charter or mandate
• chronic under-resourcing that prevents coverage of key risks
• widespread failure to document engagement work

Step 3: Determine the audience and level of communication.

• Function-level nonconformance: disclose to senior management and the board. This is often done at an audit committee meeting and recorded in the minutes.
• Engagement-level nonconformance: disclose in the final engagement communication to its recipients. Escalate to the board if it reveals a broader problem.

Step 4: Content of the disclosure. A good disclosure includes:

• the specific requirement not met
• the reason or root cause
• the impact on the function's operations or on engagement results and reliance
• any alternative procedures performed
• a corrective action plan with responsible parties and timelines

Step 5: Adjust conformance statements. Internal audit must stop using, or must qualify, the statement that it 'conforms with the Standards' until the QAIP supports it. EQA results use a rating scale: Generally Conforms (the top rating), Partially Conforms and Does Not Conform. A 'Does Not Conform' or significant 'Partially Conforms' rating must be reported.

Step 6: Follow up. The CAE reports progress on corrective actions to the board periodically, typically in the annual QAIP report. The board may need to act, for example by approving resources, amending the charter or changing reporting lines.

Illustrative scenarios:

• Overdue EQA. The function has not had an EQA in six years. This is function-level nonconformance. The CAE discloses it to senior management and the board, stops claiming conformance and schedules an EQA.
• Unsupervised fieldwork. One engagement's fieldwork was not supervised because of staff departures. This is engagement-level nonconformance. The final report discloses the requirement not met, the reason and the impact on results.
• Legal restriction. Local law forbids sharing certain reports with the board. Internal audit conforms with all other requirements and discloses the legal limitation.

4. Exam Tips: Answering Questions on Communicating Nonconformance to Senior Management and the Board
Tip 1: Identify the level first. Ask whether the nonconformance affects the overall scope or operation of the function or a single engagement.

• Function-level: disclose to senior management and the board (legacy 1322; GIAS 4.1 and 8.3).
• Engagement-level: disclose in the final engagement communication (legacy 2431; GIAS 15.1).

Tip 2: Know who is responsible. The CAE is responsible for disclosing function-level nonconformance. Be wary of options that assign this to:

• the external assessor alone
• the external auditor
• individual staff auditors
• management

Tip 3: Know the audience. The correct answer almost always names both senior management and the board. Distractors often name only one, or name external parties such as regulators or shareholders, as the required recipients.

Tip 4: Remember the required content.

• Engagement disclosures need three elements: the requirement not met, the reason(s) and the impact on the engagement and its results.
• Function-level disclosures need the nonconformance and its impact.
• Answers that mention only that a nonconformance exists, without its impact, are usually incomplete.

Tip 5: Conformance claims must be supported. If an exam scenario shows no EQA in the last five years, or a QAIP that does not support conformance, internal audit cannot state that it conforms with the Standards.

Tip 6: Watch for 'conceal' or 'delay' traps. These options are always wrong:

• correcting the problem first and disclosing only if it is not fixed
• disclosing only to the audit committee chair informally
• omitting it from reports to avoid alarming stakeholders

Transparency and timeliness are the guiding principles.

Tip 7: Separate impairment from nonconformance. If the scenario concerns independence or objectivity, such as auditing an area the auditor recently managed, the issue is disclosure of impairment to appropriate parties. Choose nonconformance only if the question frames it as failing to meet the Standards.

Tip 8: Legal or regulatory conflicts. When law prevents conformance with part of the Standards, the right answer is to conform with all other parts and disclose the limitation. It is not to abandon the Standards altogether.

Tip 9: Link to the QAIP. Many questions test the chain: internal and external assessments identify the issue, the CAE communicates the results, the board oversees, and the action plan is followed up. Pick answers that reflect this full cycle.

Tip 10: Read 'most appropriate' or 'first' carefully.

• If asked what the CAE should do first after discovering significant nonconformance, evaluating its impact and then disclosing to senior management and the board usually beats unilateral corrective action.
• If asked for the best long-term response, disclosure combined with a corrective action plan is strongest.

Tip 11: Know the terminology for both frameworks. Exams and study materials may use legacy numbers (1320, 1321, 1322, 2431) or GIAS references (Principles 4, 8 and 12; Standards 4.1, 8.3, 8.4, 12.1 and 15.1). Focus on the concepts, which are consistent across both:

• assess
• disclose to the right parties
• explain the impact
• do not overstate conformance
• remediate

Quick Recap

• Why: to maintain trust, enable board oversight, ensure honest conformance claims and drive improvement.
• What: the CAE discloses nonconformance with the Standards or ethics, and its impact, to senior management and the board. Engagement-level issues are disclosed in engagement communications.
• How: identify through the QAIP, evaluate significance, disclose the specifics and impact, adjust conformance statements, and track corrective actions.
• Exam: determine the level, the CAE as communicator, both senior management and the board as recipients, complete disclosure content, and no concealment.