STANDARD ON INTERNAL AUDIT (SIA) 9
COMMUNICATION WITH MANAGEMENT*
Contents
Paragraph(s)
Introduction ............................................................................... 1-2
Matters to be Communicated ...............................................3-8
The Internal Auditor's Responsibilities in
Relation to the Terms of Engagement ............................... 3
Planned Scope and Timing of the
Internal Audit .................................................................4-7
Significant Findings from the Internal Audit ....................... 8
The Communication Process ............................................. 9-15
Establishing the Communication Process..................... 9-10
Forms of Communication........................................... 11-12
Timing of Communications ............................................. 13
Adequacy of the Communication Process .................. 14-15
Documentation ..................................................................... 16
Effective Date....................................................................... 17
The following is the text of the Standard on Internal Audit
(SIA) 9, Communication with Management , issued by the
Council of the Institute of Chartered Accountants of India.
These Standards should be read in conjunction with the
Preface to the Standards on Internal Audit, issued by the
Institute.
In terms of the decision of the Council of the Institute of
Chartered Accountants of India taken at its 260 th meeting held
in June 2006, the following Standard on Internal Audit shall be
recommendatory in nature in the initial period. The Standards
shall become mandatory from such date as notified by the
Council.
* Published in the January, 2009 issue of The Chartered Accountant .
Standard on Internal Audit (SIA) 9
Introduction
1. This Standard on Internal Audit provides a framework for the internal
auditor's communication with management and identifies some specific
matters to be communicated with the management as described in the
terms of the engagement.
2. The internal auditor while performing audit should :
a. Communicate clearly the responsibilities of the internal auditor,
and an overview of the planned scope and timing of the audit
with the management;
b. Obtain information relevant to the internal audit from the
management;
c. Provide timely observations arising from the internal audit that
are significant and relevant to their responsibility as described
in the scope of the engagement to the management; and
d. Promote effective two-way communication between the internal
auditor and the management.
Matters to be Communicated
The Internal Auditor's Responsibilities in Relation to the Terms of
Engagement
3. The internal auditor is responsible for performing the internal audit in
accordance with the terms of engagement.
Planned Scope and Timing of the Internal Audit
4. Communication regarding the planned scope and timing of the internal
audit may:
a. Assist the management:
to understand better the objectives of the internal auditor's
work;
2
Communication with Management
to discuss issues of risk and materiality with the internal auditor;
and
to identify any areas in which they may request the internal
auditor to undertake additional procedures;
b. Assist the internal auditor to understand better the entity and its
environment.
5. When communicating to management about planned scope and timing of
the internal audit, the internal auditor would need to ensure that such
communication does not reduce the effectiveness of internal audit. For
example, communicating the nature and timing of detailed audit
procedures may make those procedures predictable.
6. Matters communicated may include:
How the internal auditor proposes to address the significant risks of
material misstatement, whether due to fraud or error.
The internal auditor's approach to internal control relevant to the
internal audit.
The application of materiality in the context of an internal audit.
7. Communication with management may assist the internal auditor to plan
the scope and timing of the internal audit. It does not, however, change
the internal auditor's sole responsibility to establish the overall internal
audit strategy and the internal audit plan, including the nature, timing and
extent of procedures necessary to obtain sufficient appropriate audit
evidence.
Significant Findings from the Internal Audit
8. Paragraph 25 of the Standard on Internal Audit (SIA) 4, "Reporting", states:
"25. The internal audit report contains the observations and comments of
the internal auditor, presents the audit findings, and discusses
recommendations for improvements. To facilitate communication and
ensure that the recommendations presented in the final report are practical
from the point of view of implementation, the internal auditor should
3
Standard on Internal Audit (SIA) 9
discuss the draft with the entity's management prior to issuing the final
report. The different stages of communication and discussion should
be as under:
Discussion Draft - At the conclusion of fieldwork, the internal auditor
should draft the report after thoroughly reviewing his working papers
and the discussion draft before it is presented to the entity's
management for auditee's comments. This discussion draft should be
submitted to the entity management for their review before the exit
meeting.
Exit Meeting - The internal auditor should discuss with the
management of the entity regarding the findings, observations,
recommendations, and text of the discussion draft. At this meeting,
the entity's management should comment on the draft and the
internal audit team should work to achieve consensus and reach an
agreement on the internal audit findings.
Formal Draft - The internal auditor should then prepare a formal draft,
taking into account any revision or modification resulting from the
exit meeting and other discussions. When the changes have been
reviewed by the internal auditor and the entity management, the final
report should be issued.
Final Report - The internal auditor should submit the final report to
the appointing authority or such members of management, as
directed. The periodicity of the Report should be as agreed in the
scope of the internal audit engagement. The internal auditor should
mention in the Report, the dates of discussion draft, exit meeting,
Formal Draft and Final Report."
The Communication Process
Establishing the Communication Process
9. Clear communication of the internal auditor's responsibilities, the planned
scope and timing of the internal audit, and the expected general content of
communications helps establishing the basis for effective two-way
communication.
4
Communication with Management
10. Matters that contribute to effective two-way communication include:
Clarity in the purpose of communications which makes the internal
auditor and the management better placed to have a mutual
understanding of relevant issues and the expected actions arising
from the communication process.
Clarity in the form in which communications will be made.
Identifying the person(s) in the internal audit team and the
management who will be responsible for communicating particular
matters.
The internal auditor's expectation that communication will be two-way,
and that the management will communicate with the internal auditor,
matters they consider relevant to the internal audit, for example,
strategic decisions that may significantly affect the nature, timing and
extent of internal audit procedures, the suspicion or the detection of
fraud, and concerns with the integrity or competence of senior
management.
The process for taking action and reporting back on matters
communicated by the internal auditor and the management.
Forms of Communication
11. Effective communication may involve structured presentations and written
reports as well as less structured communications, including discussions.
The internal auditor may communicate matters other than those described
in the terms of engagement, either orally or in writing.
12. In addition to the significance of a particular matter, the form of
communication (e.g., whether to communicate orally or in writing, the
extent of detail or summarization in the communication, and whether to
communicate in a structured or unstructured manner) may be affected by
such factors as:
a. Whether the matter has been satisfactorily resolved.
b. Whether management has previously communicated the matter.
5
Standard on Internal Audit (SIA) 9
c. The size, operating structure, control environment, and legal structure
of the entity.
d. In the case of an internal audit of a specific aspect of an operation,
whether the internal auditor also audits the entire operation or the
entity.
e. The expectations of the management, including arrangements made
for periodic meetings or communications with the auditor.
f. The amount of ongoing contact and dialogue the internal auditor has
with the management.
g. Whether there have been significant changes in the membership of a
governing body.
Timing of Communications
13. The appropriate timing for communications will vary with the
circumstances of the engagement. Relevant circumstances include the
significance and nature of the matter, and the action expected to be taken
by the management. For example:
Communications regarding planning matters may often be made early
in the audit engagement.
It may be appropriate to communicate a significant difficulty
encountered during the internal audit as soon as practicable.
Similarly, it may be appropriate to communicate material weaknesses
in the design, implementation or operating effectiveness of internal
control that have come to the internal auditor's attention as soon as
practicable.
Communications regarding independence may be appropriate
whenever significant judgments are made about threats to
independence and related safeguards.
The exit meeting may also be an appropriate time to communicate
findings from the internal audit.
6
Communication with Management
Adequacy of the Communication Process
14. The internal auditor need not design specific procedures to support the
evaluation of the two-way communication with the management, rather,
that evaluation may be based on observations resulting from audit
procedures performed for other purposes. Such observations may include:
The appropriateness and timeliness of actions taken by the
management in response to matters raised by the internal auditor.
Where significant matters raised in previous communications have
not been dealt with effectively, it may be appropriate for the internal
auditor to inquire as to why appropriate action has not been taken,
and to consider raising the point again. This avoids the risk of giving
an impression that the internal auditor is satisfied that the matter has
been adequately addressed or is no longer significant.
The apparent openness of the management in their communications
with the internal auditor.
The apparent ability of the management to fully comprehend matters
raised by the internal auditor, for example, the extent to which the
management probes issues and questions recommendations made to
them.
Difficulty in establishing the management, a mutual understanding of
the form, timing and expected general content of communications.
Whether the two-way communication between the internal auditor and
the management meets applicable legal and regulatory requirements.
15. Inadequate two-way communication may indicate an unsatisfactory control
environment and influence the internal auditor's assessment of the risks of
material misstatements. There is also a risk that the internal auditor may
not have obtained sufficient appropriate internal audit evidence to support
his findings or opinion.
Documentation
16. Where matters required by this SIA to be communicated are
communicated orally, the internal auditor shall document them, and when
7
Standard on Internal Audit (SIA) 9
and to whom they were communicated. Where matters have been
communicated in writing, the auditor shall retain a copy of the
communication as part of the internal audit documentation.
Effective Date
17. This Standard on Internal Audit is effective for all internal audits beginning
on or after _____________. Earlier application of the Standard is
encouraged.
8
|
