EXPOSURE DRAFT STANDARD ON INTERNAL AUDIT (SIA)

EXPOSURE DRAFT
STANDARD ON INTERNAL AUDIT (SIA)

COMMUNICATION WITH MANAGEMENT

The Committee on Internal Audit of the Institute of Chartered Accountants of
India invites comments on the Exposure Draft of the Standard on Internal Audit
(SIA), Communication with Management. Comments are most helpful if they
indicate the specific paragraph(s) to which they relate, contain a clear rationale
and, where applicable, provide a suggestion for alternative wording. Comments
should be submitted in writing to the Secretary, Committee on Internal Audit, The
Institute of Chartered Accountants of India, C-1, Sector-1, NOIDA-201 301 so as
to be received on or before November 17, 2008. Comments can also be sent
by e-mail at cia@icai.org.

Introduction
1. This Standard on Internal Audit provides an overarching framework for the
internal auditor’s communication with management and identifies some specific
matters to be communicated with the management as described in the terms of
the engagement.
2. In performing such an activity the internal auditor should :
a. Communicate clearly the responsibilities of the internal auditor, and an
overview of the planned scope and timing of the audit with the management;
b. Obtain information relevant to the internal audit from the management;
c. Provide timely observations arising from the internal audit that are significant
and relevant to their responsibility as described in the scope of the
engagement to the management; and
d. Promote effective two-way communication between the internal auditor and
the management.

Matters to be Communicated

The Internal Auditor’s Responsibilities in Relation to the Terms of
Engagement
3. The internal auditor’s responsibility for the performing the audit, in
accordance with the terms of engagement.
Planned Scope and Timing of the Audit
4. Communication regarding the planned scope and timing of the internal
audit may:
a. Assist the management to understand better the consequences of the
internal auditor’s work, to discuss issues of risk and materiality with the
internal auditor, and to identify any areas in which they may request the
auditor to undertake additional procedures; and
b. Assist the internal auditor to understand better the entity and its
environment.
5. Care is required when communicating to management about the planned
scope and timing of the audit so as not to compromise with the effectiveness of
the audit. For example, communicating the nature and timing of detailed audit
procedures may reduce the effectiveness of those procedures by making them
too predictable.
6. Matters communicated may include:
• How the internal auditor proposes to address the significant risks of material
misstatement, whether due to fraud or error.
• The internal auditor’s approach to internal control relevant to the internal
audit.
• The application of materiality in the context of an internal audit.
7. Communication with management, may assist the internal auditor to plan
the scope and timing of the audit. It does not change the internal auditor’s sole
responsibility to establish the overall audit strategy and the audit plan, including
the nature, timing and extent of procedures necessary to obtain sufficient
appropriate audit evidence.

Significant Findings from the Internal Audit

8. Paragraph 25 of the SIA – 4, “Reporting”, states:
“25. The internal audit report contains the observations and comments of
the internal auditor, presents the audit findings, and discusses
recommendations for improvements. To facilitate communication and
ensure that the recommendations presented in the final report are practical
from the point of view of implementation, the internal auditor should
discuss the draft with the entity’s management prior to issuing the final
report. The different stages of communication and discussion should be as
under:
Discussion Draft - At the conclusion of fieldwork, the internal auditor should
draft the report after thoroughly reviewing his working papers and the
discussion draft before it is presented to the entity’s management for
auditee’s comments. This discussion draft should be submitted to the entity
management for their review before the exit meeting.
Exit Meeting - The internal auditor should discuss with the management of
the entity regarding the findings, observations, recommendations, and text
of the discussion draft. At this meeting, the entity’s management should
comment on the draft and the internal audit team should work to achieve
consensus and reach an agreement on the internal audit findings.
Formal Draft - The internal auditor should then prepare a formal draft,
taking into account any revision or modification resulting from the exit
meeting and other discussions. When the changes have been reviewed by
the internal auditor and the entity management, the final report should be
issued.
Final Report - The internal auditor should submit the final report to the
appointing authority or such members of management, as directed. The
periodicity of the Report should be as agreed in the scope of the internal
audit engagement. The internal auditor should mention in the Report, the
dates of discussion draft, exit meeting, Formal Draft and Final Report.”



The Communication Process

Establishing the Communication Process

9. Clear communication of the internal auditor’s responsibilities, the planned
scope and timing of the internal audit, and the expected general content of
communications helps establishing the basis for effective two-way
communication.
10. Matters that contribute to effective two-way communication include:
• The purpose of communications should be clear, which make the internal
auditor and the management better placed to have a mutual understanding
of relevant issues and the expected actions arising from the communication
process.
• The form in which communications will be made.
• The person(s) in the internal audit team and the representative of the
management, will communicate regarding particular matters.
• The internal auditor’s expectation that communication will be two-way, and
that the management will communicate with the internal auditor, matters
they consider relevant to the internal audit, for example, strategic decisions
that may significantly affect the nature, timing and extent of internal audit
procedures, the suspicion or the detection of fraud, and concerns with the
integrity or competence of senior management.
• The process for taking action and reporting back on matters communicated
by the auditor and the management.
Forms of Communication
11. Effective communication may involve structured presentations and written
reports as well as less structured communications, including discussions. The
internal auditor may communicate matters other than those described in the
terms of engagement, either orally or in writing.
12. In addition to the significance of a particular matter, the form of
communication (e.g., whether to communicate orally or in writing, the extent of
detail or summarization in the communication, and whether to communicate in a
structured or unstructured manner) may be affected by such factors as:
a. Whether the matter has been satisfactorily resolved.
b. Whether management has previously communicated the matter.
c. The size, operating structure, control environment, and legal structure of the
entity.
d. In the case of an internal audit of a specific aspect of an operation, whether
the internal auditor also audits the entire operation or the entity.
e. The expectations of those charged with governance, including arrangements
made for periodic meetings or communications with the auditor.
f. The amount of ongoing contact and dialogue the internal auditor has with
those charged with governance.
g. Whether there have been significant changes in the membership of a
governing body.



Timing of Communications

13. The appropriate timing for communications will vary with the circumstances
of the engagement. Relevant circumstances include the significance and nature
of the matter, and the action expected to be taken by those charged with
governance. For example:
• Communications regarding planning matters may often be made early in
the audit engagement
• It may be appropriate to communicate a significant difficulty encountered
during the audit as soon as practicable.
• Similarly, it may be appropriate to communicate material weaknesses in the
design, implementation or operating effectiveness of internal control that
have come to the auditor’s attention as soon as practicable.
• Communications regarding independence may be appropriate whenever
significant judgments are made about threats to independence and related
safeguards.
• The exit meeting may also be an appropriate time to communicate findings
from the audit.

Adequacy of the Communication Process

14. The internal auditor need not design specific procedures to support the
evaluation of the two-way communication with the management, rather, that
evaluation may be based on observations resulting from audit procedures
performed for other purposes. Such observations may include:
• The appropriateness and timeliness of actions taken by the management in
response to matters raised by the internal auditor. Where significant
matters raised in previous communications have not been dealt with
effectively, it may be appropriate for the internal auditor to inquire as to why
appropriate action has not been taken, and to consider raising the point
again. This avoids the risk of giving an impression that the internal auditor
is satisfied that the matter has been adequately addressed or is no longer
significant.
• The apparent openness of the management in their communications with
the internal auditor.
• The apparent ability of the management to fully comprehend matters raised
by the internal auditor, for example, the extent to which the management
probes issues and questions recommendations made to them.
• Difficulty in establishing with those charged with governance, a mutual
understanding of the form, timing and expected general content of
communications.
• Whether the two-way communication between the internal auditor and
those charged with governance meets applicable legal and regulatory
requirements.
15. Inadequate two-way communication may indicate an unsatisfactory control
environment and influence the internal auditor’s assessment of the risks of
material misstatements. There is also a risk that the internal auditor may not
have obtained sufficient appropriate audit evidence to support his findings or
opinion.

Documentation

16. Where matters required by this SIA to be communicated are
communicated orally, the internal auditor shall document them, and when and to
whom they were communicated. Where matters have been communicated in
writing, the auditor shall retain a copy of the communication as part of the
internal audit documentation.

Effective Date

17. This SIA is effective for all internal audits undertaken on or after