Planning Engagement Communications
5 minutes
5 Questions
Planning engagement communications is a core competency within the Certification in Risk Management Assurance (CRMA) domain of communicating risk management assurance. It refers to the deliberate, upfront design of how, when, to whom, and in what form the results of a risk management assurance engagement will be conveyed. Rather than treating reporting as an afterthought, the IIA's International Professional Practices Framework (IPPF) expects internal auditors to plan communications from the outset of the engagement, aligning them with objectives, scope, and stakeholder needs. Key elements include: first, identifying stakeholders—board members, the audit committee, senior management, process owners, and sometimes regulators—and understanding their information needs, risk appetite, and preferred level of detail. Second, defining the purpose of each communication, whether it is to provide assurance on the effectiveness of risk management processes, highlight control gaps, or offer advisory insights. Third, establishing the form and medium, such as formal written reports, executive summaries, dashboards, presentations, or interim verbal briefings. Fourth, setting the timing and frequency, including status updates during fieldwork, exit meetings, and final reporting, so that significant issues are escalated promptly rather than delayed until the end. Fifth, agreeing on the criteria and rating scales used to evaluate risk management maturity so conclusions are understood consistently. Effective planning also addresses confidentiality, distribution protocols, and the handling of sensitive findings, as well as how management responses and action plans will be captured. Auditors should anticipate potential disagreements and plan how to resolve them objectively. Ultimately, planned communications ensure results are accurate, objective, clear, concise, constructive, complete, and timely—the IIA's quality criteria. For CRMA practitioners, this means communications add value by linking risk assurance conclusions to strategic objectives, enabling the board and management to make informed decisions and strengthen the organization's governance and risk management framework.
Planning Engagement Communications – CRMA Guide (Communicating Risk Management Assurance)
1. Why Planning Engagement Communications Matters
In risk management assurance, the value of an engagement is realized only when its results are understood and acted upon. A technically brilliant assessment of an organization's enterprise risk management (ERM) framework delivers little if the audit committee cannot interpret it, management disputes it, or it arrives too late to influence decisions. This is why the IIA treats communication as something to be planned, not improvised at the end of fieldwork.
For the CRMA exam, the domain Communicating Risk Management Assurance tests whether you understand that communication begins at the planning stage. Key reasons the topic is important:
• Alignment of expectations. Agreeing with stakeholders up front on objectives, scope, criteria, timing, and format prevents the 'no surprises' principle from being violated at the end.
• Stakeholder-appropriate messaging. The board, senior management, the chief risk officer (CRO), and first-line risk owners each need different levels of detail and different emphases.
• Standards compliance. The IIA Standards require internal auditors to communicate engagement objectives, scope, and timing to relevant stakeholders during planning, and to plan how results will be communicated (including criteria, quality, dissemination, and overall opinions).
• Efficiency and credibility. Pre-planned interim communications, exit meetings, and review protocols reduce rework, disputes over facts, and delays in final reporting.
• Effective governance. Well-planned communication supports the board's oversight of risk appetite, risk culture, and the effectiveness of ERM – the ultimate purpose of risk management assurance.
2. What Planning Engagement Communications Is
Planning engagement communications is the process, performed during engagement planning, of deciding who needs to receive information about the engagement, what they need, when they need it, how it will be delivered, and why (the decision or action the communication should enable). In a risk management assurance context it typically covers:
• Communication at the start of the engagement – notifying management and risk owners of objectives, scope, criteria (e.g., the organization's risk management framework, COSO ERM, ISO 31000, a maturity model), timing, resource needs, and the people involved.
• Communication during the engagement – interim updates, status meetings, prompt escalation of significant risk exposures or control failures, and validation of facts with process owners.
• Communication at the end of the engagement – exit/closing meetings, draft and final reports, presentations to the audit committee or risk committee, and overall opinions or conclusions on risk management effectiveness.
• Communication after the engagement – follow-up on management action plans, monitoring of risk acceptance decisions, and reporting of implementation status.
A written communication plan (often embedded in the engagement work program or planning memorandum) is the tangible output. It documents stakeholders, messages, channels, frequency, responsibilities, confidentiality constraints, and escalation routes.
3. How It Works – Core Elements
3.1 Identify stakeholders and their needs
Typical stakeholders in a risk management assurance engagement include:
• Board / audit committee / risk committee – want an overall conclusion on whether ERM is effective, whether significant risks are within appetite, and whether governance is sound. They prefer concise, high-level, decision-oriented summaries.
• Senior management (CEO, CFO, CRO) – want to know where risk processes are weak, the root causes, and what they need to resource or change.
• Risk owners / first-line management – need detailed, actionable findings about specific risks, controls, and process gaps.
• Second-line functions (risk management, compliance) – need to understand how their framework was evaluated and where coordination can improve.
• External parties (regulators, external auditors) – may receive results subject to the CAE's judgment and legal review.
3.2 Define communication objectives
Every communication should enable a specific outcome: a decision, an approval, an action plan, or acceptance of a risk. Planning asks: 'What do we want this audience to know, feel, and do after receiving this message?'
3.3 Agree on criteria and rating scales
Because risk management assurance frequently uses maturity models, heat maps, risk ratings, and assurance opinions, the auditor should agree during planning on the criteria and scales that will appear in communications. Agreeing the yardstick in advance avoids end-of-engagement disputes about whether a 'Level 3 – Defined' maturity rating is fair.
3.4 Decide format and channel
Options include formal written reports, executive summaries, dashboards, visual risk maps, oral presentations, memos, and interim emails. The format should match audience sophistication, the urgency of the message, and organizational culture. Visuals (heat maps, maturity spider charts) are powerful for boards; detailed appendices suit operational managers.
3.5 Set timing and frequency
Plan an opening meeting, periodic status updates, immediate escalation protocols for significant issues (do not wait for the final report), an exit meeting, draft report review windows, and final issuance deadlines aligned with board or risk committee meeting dates.
3.6 Build in quality attributes
Plan to ensure communications are accurate, objective, clear, concise, constructive, complete, and timely. This includes planning review steps, fact validation with auditees, and supervisory review.
3.7 Plan for sensitive matters and confidentiality
Decide in advance how sensitive findings (fraud indicators, legal exposure, regulatory breaches) will be routed, who sees what, and whether legal counsel should be involved. Distribution lists should be agreed with the CAE.
3.8 Plan for disagreement and risk acceptance
If management may disagree with findings or elect to accept a risk, the plan should specify how disagreements are documented, how both views are presented, and how unresolved significant residual risk is escalated to the board.
3.9 Plan follow-up communications
Define how action plans will be tracked and how implementation status will be reported to senior management and the board.
4. Relevant Standards Concepts
Exam questions draw on the IIA's Standards. Concepts you should recognize:
• Communicating engagement objectives, scope, timing, and expectations to stakeholders during planning.
• Criteria for communicating results: objectives, scope, conclusions, recommendations, and action plans; overall opinions must be supported by sufficient, reliable, relevant, and useful information.
• Quality of communications (accurate, objective, clear, concise, constructive, complete, timely) and correction of errors and omissions.
• Disseminating results: the CAE communicates to appropriate parties and assesses risk before releasing results outside the organization.
• Overall opinions on risk management effectiveness consider the expectations of senior management and the board and must be supported by appropriate evidence.
• Communicating acceptance of risk: when the CAE concludes management has accepted a level of risk that may be unacceptable to the organization, the matter is discussed with senior management and, if unresolved, communicated to the board.
• Communication skills and relationship building as core competencies for internal auditors.
5. How Planning Communications Applies Specifically to Risk Management Assurance
Risk management assurance engagements have special features:
• Results are often expressed as a conclusion on ERM effectiveness or a maturity rating, so the basis for the conclusion must be communicated clearly and agreed in advance.
• Findings often relate to governance and culture (e.g., risk appetite not defined, tone at the top weak), which are sensitive and require careful framing for the board.
• Communications should link risks to strategic objectives and risk appetite, showing which risks exceed tolerance.
• Coordination with the second line (risk function) is essential; planning should clarify what internal audit will report versus what the CRO reports, to avoid confusion over assurance roles.
• The audit committee may expect an annual opinion on risk management, so individual engagement communications should be planned to feed into that aggregated view.
6. Step-by-Step: Building a Communication Plan
1. Review the engagement objectives and scope.
2. List all stakeholders and classify them (decision-makers, information recipients, contributors).
3. For each stakeholder, define needs, preferred format, level of detail, and frequency.
4. Agree criteria, rating definitions, and report template with management and the CAE.
5. Schedule opening meeting, status updates, exit meeting, draft review, and final issuance dates aligned with governance calendars.
6. Define escalation triggers for significant issues and the route for sensitive matters.
7. Define the draft-review and fact-validation process and the method for recording management responses and disagreements.
8. Document distribution lists and confidentiality constraints.
9. Set follow-up and implementation reporting expectations.
10. Obtain CAE (or delegate) approval of the plan as part of engagement planning documentation.
7. Common Pitfalls
• Waiting until the final report to inform management of significant issues.
• Using one report format for all audiences.
• Failing to agree criteria and rating scales up front, leading to disputes.
• Over-technical language for the board; vague language for operational owners.
• Ignoring confidentiality or releasing information externally without CAE assessment.
• Omitting management's response or failing to present both views when disagreements exist.
• No plan for follow-up, so findings are never closed.
8. Exam Tips: Answering Questions on Planning Engagement Communications
Tip 1 – Identify the engagement phase. Questions often hinge on when an action should occur. If the stem describes planning, the best answer usually involves agreeing objectives, scope, criteria, timing, and communication protocols with stakeholders before fieldwork. Answers that delay communication to the end are typically wrong.
Tip 2 – Apply the 'no surprises' principle. When a scenario describes a significant risk exposure discovered mid-engagement, the correct answer is to communicate it promptly to appropriate management rather than wait for the final report.
Tip 3 – Match the message to the audience. If the question asks what the board or audit committee should receive, favor concise, high-level, conclusion-oriented options (overall opinion, significant risks relative to appetite). If the audience is a process or risk owner, favor detailed, actionable findings and root causes.
Tip 4 – Know who communicates what. The CAE is responsible for communicating results to senior management and the board, assessing risks before external release, and escalating unacceptable risk acceptance. Engagement supervisors and auditors handle operational communications with management.
Tip 5 – Remember the quality attributes. Accurate, objective, clear, concise, constructive, complete, timely. Distractors often describe communications that are biased, overly long, speculative, or late. Eliminate them.
Tip 6 – Look for 'agreed criteria' language. In risk management assurance, the best answer frequently involves establishing or agreeing the evaluation criteria (framework, maturity model, risk appetite statements) with management during planning so that conclusions are accepted later.
Tip 7 – Handle disagreement and risk acceptance correctly. If management disagrees or accepts a risk, the correct sequence is: document both positions, discuss with senior management, and if the matter is significant and unresolved, communicate to the board. Answers that simply drop the finding or unilaterally override management are wrong.
Tip 8 – Be careful with external dissemination. Any option involving release to regulators, external auditors, or third parties should include the CAE assessing potential risk, consulting senior management or legal counsel as appropriate, and controlling the use of results.
Tip 9 – Favor the most comprehensive, standards-based answer. When two options seem right, choose the one that is complete (covers objectives, scope, conclusions, recommendations, action plans) over the one that covers only part of the picture.
Tip 10 – Watch for absolute words. Options containing 'always', 'never', or 'only' are often distractors. Planning communications requires professional judgment tailored to the organization.
Tip 11 – Think about purpose. Ask yourself: 'What decision does this communication enable?' The answer that best supports governance decision-making by the appropriate stakeholder is usually correct.
Tip 12 – Practice with scenario questions. Example: 'During planning for an assurance engagement over the ERM framework, the internal auditor is deciding how to present results to the audit committee. Which approach is most appropriate?' The best answer emphasizes agreeing in advance with the CAE and committee on an overall conclusion format, supported by a maturity assessment against agreed criteria, with significant risks linked to risk appetite – not a lengthy list of every control test performed.
9. Quick Revision Summary
• Communication is planned during engagement planning, not after fieldwork.
• Identify stakeholders; tailor content, format, timing, and detail to each.
• Agree objectives, scope, criteria, rating scales, and timing up front.
• Plan interim communications and escalation of significant matters.
• Ensure communications are accurate, objective, clear, concise, constructive, complete, and timely.
• The CAE controls dissemination, external release, and escalation of unacceptable risk acceptance to the board.
• Plan follow-up and implementation reporting.
• In exam questions, choose the option that is proactive, stakeholder-focused, standards-based, and complete.
In risk management assurance, the value of an engagement is realized only when its results are understood and acted upon. A technically brilliant assessment of an organization's enterprise risk management (ERM) framework delivers little if the audit committee cannot interpret it, management disputes it, or it arrives too late to influence decisions. This is why the IIA treats communication as something to be planned, not improvised at the end of fieldwork.
For the CRMA exam, the domain Communicating Risk Management Assurance tests whether you understand that communication begins at the planning stage. Key reasons the topic is important:
• Alignment of expectations. Agreeing with stakeholders up front on objectives, scope, criteria, timing, and format prevents the 'no surprises' principle from being violated at the end.
• Stakeholder-appropriate messaging. The board, senior management, the chief risk officer (CRO), and first-line risk owners each need different levels of detail and different emphases.
• Standards compliance. The IIA Standards require internal auditors to communicate engagement objectives, scope, and timing to relevant stakeholders during planning, and to plan how results will be communicated (including criteria, quality, dissemination, and overall opinions).
• Efficiency and credibility. Pre-planned interim communications, exit meetings, and review protocols reduce rework, disputes over facts, and delays in final reporting.
• Effective governance. Well-planned communication supports the board's oversight of risk appetite, risk culture, and the effectiveness of ERM – the ultimate purpose of risk management assurance.
2. What Planning Engagement Communications Is
Planning engagement communications is the process, performed during engagement planning, of deciding who needs to receive information about the engagement, what they need, when they need it, how it will be delivered, and why (the decision or action the communication should enable). In a risk management assurance context it typically covers:
• Communication at the start of the engagement – notifying management and risk owners of objectives, scope, criteria (e.g., the organization's risk management framework, COSO ERM, ISO 31000, a maturity model), timing, resource needs, and the people involved.
• Communication during the engagement – interim updates, status meetings, prompt escalation of significant risk exposures or control failures, and validation of facts with process owners.
• Communication at the end of the engagement – exit/closing meetings, draft and final reports, presentations to the audit committee or risk committee, and overall opinions or conclusions on risk management effectiveness.
• Communication after the engagement – follow-up on management action plans, monitoring of risk acceptance decisions, and reporting of implementation status.
A written communication plan (often embedded in the engagement work program or planning memorandum) is the tangible output. It documents stakeholders, messages, channels, frequency, responsibilities, confidentiality constraints, and escalation routes.
3. How It Works – Core Elements
3.1 Identify stakeholders and their needs
Typical stakeholders in a risk management assurance engagement include:
• Board / audit committee / risk committee – want an overall conclusion on whether ERM is effective, whether significant risks are within appetite, and whether governance is sound. They prefer concise, high-level, decision-oriented summaries.
• Senior management (CEO, CFO, CRO) – want to know where risk processes are weak, the root causes, and what they need to resource or change.
• Risk owners / first-line management – need detailed, actionable findings about specific risks, controls, and process gaps.
• Second-line functions (risk management, compliance) – need to understand how their framework was evaluated and where coordination can improve.
• External parties (regulators, external auditors) – may receive results subject to the CAE's judgment and legal review.
3.2 Define communication objectives
Every communication should enable a specific outcome: a decision, an approval, an action plan, or acceptance of a risk. Planning asks: 'What do we want this audience to know, feel, and do after receiving this message?'
3.3 Agree on criteria and rating scales
Because risk management assurance frequently uses maturity models, heat maps, risk ratings, and assurance opinions, the auditor should agree during planning on the criteria and scales that will appear in communications. Agreeing the yardstick in advance avoids end-of-engagement disputes about whether a 'Level 3 – Defined' maturity rating is fair.
3.4 Decide format and channel
Options include formal written reports, executive summaries, dashboards, visual risk maps, oral presentations, memos, and interim emails. The format should match audience sophistication, the urgency of the message, and organizational culture. Visuals (heat maps, maturity spider charts) are powerful for boards; detailed appendices suit operational managers.
3.5 Set timing and frequency
Plan an opening meeting, periodic status updates, immediate escalation protocols for significant issues (do not wait for the final report), an exit meeting, draft report review windows, and final issuance deadlines aligned with board or risk committee meeting dates.
3.6 Build in quality attributes
Plan to ensure communications are accurate, objective, clear, concise, constructive, complete, and timely. This includes planning review steps, fact validation with auditees, and supervisory review.
3.7 Plan for sensitive matters and confidentiality
Decide in advance how sensitive findings (fraud indicators, legal exposure, regulatory breaches) will be routed, who sees what, and whether legal counsel should be involved. Distribution lists should be agreed with the CAE.
3.8 Plan for disagreement and risk acceptance
If management may disagree with findings or elect to accept a risk, the plan should specify how disagreements are documented, how both views are presented, and how unresolved significant residual risk is escalated to the board.
3.9 Plan follow-up communications
Define how action plans will be tracked and how implementation status will be reported to senior management and the board.
4. Relevant Standards Concepts
Exam questions draw on the IIA's Standards. Concepts you should recognize:
• Communicating engagement objectives, scope, timing, and expectations to stakeholders during planning.
• Criteria for communicating results: objectives, scope, conclusions, recommendations, and action plans; overall opinions must be supported by sufficient, reliable, relevant, and useful information.
• Quality of communications (accurate, objective, clear, concise, constructive, complete, timely) and correction of errors and omissions.
• Disseminating results: the CAE communicates to appropriate parties and assesses risk before releasing results outside the organization.
• Overall opinions on risk management effectiveness consider the expectations of senior management and the board and must be supported by appropriate evidence.
• Communicating acceptance of risk: when the CAE concludes management has accepted a level of risk that may be unacceptable to the organization, the matter is discussed with senior management and, if unresolved, communicated to the board.
• Communication skills and relationship building as core competencies for internal auditors.
5. How Planning Communications Applies Specifically to Risk Management Assurance
Risk management assurance engagements have special features:
• Results are often expressed as a conclusion on ERM effectiveness or a maturity rating, so the basis for the conclusion must be communicated clearly and agreed in advance.
• Findings often relate to governance and culture (e.g., risk appetite not defined, tone at the top weak), which are sensitive and require careful framing for the board.
• Communications should link risks to strategic objectives and risk appetite, showing which risks exceed tolerance.
• Coordination with the second line (risk function) is essential; planning should clarify what internal audit will report versus what the CRO reports, to avoid confusion over assurance roles.
• The audit committee may expect an annual opinion on risk management, so individual engagement communications should be planned to feed into that aggregated view.
6. Step-by-Step: Building a Communication Plan
1. Review the engagement objectives and scope.
2. List all stakeholders and classify them (decision-makers, information recipients, contributors).
3. For each stakeholder, define needs, preferred format, level of detail, and frequency.
4. Agree criteria, rating definitions, and report template with management and the CAE.
5. Schedule opening meeting, status updates, exit meeting, draft review, and final issuance dates aligned with governance calendars.
6. Define escalation triggers for significant issues and the route for sensitive matters.
7. Define the draft-review and fact-validation process and the method for recording management responses and disagreements.
8. Document distribution lists and confidentiality constraints.
9. Set follow-up and implementation reporting expectations.
10. Obtain CAE (or delegate) approval of the plan as part of engagement planning documentation.
7. Common Pitfalls
• Waiting until the final report to inform management of significant issues.
• Using one report format for all audiences.
• Failing to agree criteria and rating scales up front, leading to disputes.
• Over-technical language for the board; vague language for operational owners.
• Ignoring confidentiality or releasing information externally without CAE assessment.
• Omitting management's response or failing to present both views when disagreements exist.
• No plan for follow-up, so findings are never closed.
8. Exam Tips: Answering Questions on Planning Engagement Communications
Tip 1 – Identify the engagement phase. Questions often hinge on when an action should occur. If the stem describes planning, the best answer usually involves agreeing objectives, scope, criteria, timing, and communication protocols with stakeholders before fieldwork. Answers that delay communication to the end are typically wrong.
Tip 2 – Apply the 'no surprises' principle. When a scenario describes a significant risk exposure discovered mid-engagement, the correct answer is to communicate it promptly to appropriate management rather than wait for the final report.
Tip 3 – Match the message to the audience. If the question asks what the board or audit committee should receive, favor concise, high-level, conclusion-oriented options (overall opinion, significant risks relative to appetite). If the audience is a process or risk owner, favor detailed, actionable findings and root causes.
Tip 4 – Know who communicates what. The CAE is responsible for communicating results to senior management and the board, assessing risks before external release, and escalating unacceptable risk acceptance. Engagement supervisors and auditors handle operational communications with management.
Tip 5 – Remember the quality attributes. Accurate, objective, clear, concise, constructive, complete, timely. Distractors often describe communications that are biased, overly long, speculative, or late. Eliminate them.
Tip 6 – Look for 'agreed criteria' language. In risk management assurance, the best answer frequently involves establishing or agreeing the evaluation criteria (framework, maturity model, risk appetite statements) with management during planning so that conclusions are accepted later.
Tip 7 – Handle disagreement and risk acceptance correctly. If management disagrees or accepts a risk, the correct sequence is: document both positions, discuss with senior management, and if the matter is significant and unresolved, communicate to the board. Answers that simply drop the finding or unilaterally override management are wrong.
Tip 8 – Be careful with external dissemination. Any option involving release to regulators, external auditors, or third parties should include the CAE assessing potential risk, consulting senior management or legal counsel as appropriate, and controlling the use of results.
Tip 9 – Favor the most comprehensive, standards-based answer. When two options seem right, choose the one that is complete (covers objectives, scope, conclusions, recommendations, action plans) over the one that covers only part of the picture.
Tip 10 – Watch for absolute words. Options containing 'always', 'never', or 'only' are often distractors. Planning communications requires professional judgment tailored to the organization.
Tip 11 – Think about purpose. Ask yourself: 'What decision does this communication enable?' The answer that best supports governance decision-making by the appropriate stakeholder is usually correct.
Tip 12 – Practice with scenario questions. Example: 'During planning for an assurance engagement over the ERM framework, the internal auditor is deciding how to present results to the audit committee. Which approach is most appropriate?' The best answer emphasizes agreeing in advance with the CAE and committee on an overall conclusion format, supported by a maturity assessment against agreed criteria, with significant risks linked to risk appetite – not a lengthy list of every control test performed.
9. Quick Revision Summary
• Communication is planned during engagement planning, not after fieldwork.
• Identify stakeholders; tailor content, format, timing, and detail to each.
• Agree objectives, scope, criteria, rating scales, and timing up front.
• Plan interim communications and escalation of significant matters.
• Ensure communications are accurate, objective, clear, concise, constructive, complete, and timely.
• The CAE controls dissemination, external release, and escalation of unacceptable risk acceptance to the board.
• Plan follow-up and implementation reporting.
• In exam questions, choose the option that is proactive, stakeholder-focused, standards-based, and complete.
Test mode:
CRMA - Planning Engagement Communications Example Questions
Test your knowledge of Planning Engagement Communications
Question 1
An internal auditor is planning an assurance engagement over a subsidiary's risk management process. The subsidiary manager asks that all observations be held until the exit conference so the team can "hear everything once." Prior engagements found several risks operating above appetite, and the audit committee expects results within the quarter. Which approach to engagement communications should the auditor BEST include in the engagement plan?
Question 2
An internal auditor is planning an assurance engagement over a business unit's risk management process. The draft communication plan lists only who will receive the final report and when it will be issued. The engagement supervisor returns the plan as incomplete. Which omission from the plan is MOST significant?
Question 3
During planning of an assurance engagement over a division's risk management process, the division head says she wants only a verbal briefing at the end. The chief risk officer separately asks to review and approve draft findings before management sees them. The internal audit charter requires engagement results on significant risks to be reported to senior management and the board. Which action is MOST appropriate when planning engagement communications?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Planning Engagement Communications questions
19 questions (total)
Other Communicating Risk Management Assurance concepts
Communicating Emerging Risks to Senior ManagementCommunicating Risk Management EffectivenessCriteria, Condition, Cause, and Effect in FindingsDeveloping the Engagement ReportEscalating Risk Acceptance to the BoardEvaluating Management Responses to Key RisksManagement Acceptance of Unacceptable RiskMonitoring and Follow-Up of Engagement ResultsObtaining Management Responses and Action PlansOverall Opinions on Risk ManagementReporting to the Audit Committee on RiskTailoring Risk Communications to AudiencesThe Exit Conference