CIA-3 - Engagement Results and Monitoring - Section D.5

Recognize the various purposes of communicating with different stakeholders, and the protocol for reporting an already-resolved finding and for correcting significant errors or omissions.

Recognise the different purposes served by communicating engagement results to management of the activity under review, senior management, the board, the risk management function, external auditors, regulators, and, in some cases, the general public. Recognise the appropriate protocol for reporting a finding that management has already resolved, and describe the chief audit executive's responsibility and protocol for correcting significant errors and omissions discovered after the final communication is issued.

Stakeholder communicationCorrecting final communication

Practice question for this objective

Free sampleEngagement Results and Monitoringmedium

At Halewood Group the chief audit executive has prepared the final engagement communication summarising significant findings. Before it goes to senior management and the board, which step reflects sound closing communication practice?

  • AHand the draft to the audited unit so it can rewrite the findings in its own words before issue.
  • BRelease it to senior management first and leave board reporting to senior management's discretion afterwards.
  • CPost the results on the organisation's intranet so staff across the business can review the conclusions.
  • DReview and approve the final communication, then communicate the results to senior management and the board as appropriate. Correct
Identify that the chief audit executive approves the final communication and reports results to senior management and the board. Sound closing practice has the chief audit executive review and approve the final communication and then communicate the results to senior management and the board, keeping the reporting line intact rather than delegating rewriting, routing, or broadcasting.

Why A is wrong: Management input on responses is appropriate, but letting the audited unit rewrite the findings surrenders control of the communication and undermines its objectivity.

Why B is wrong: Senior management is a proper recipient, which makes this tempting, but routing board reporting through senior management's discretion weakens the chief audit executive's direct reporting line to the board.

Why C is wrong: Wider awareness can seem beneficial, but open publication disregards the sensitivity of the results and the duty to direct them to appropriate recipients.

Why D is correct: The chief audit executive reviews and approves the final communication and directs it to senior management and the board, preserving the reporting line and accountability for the results.

See more CIA-3 practice questions, answers explained.

More in this domain

Back to all Engagement Results and Monitoring objectives, or the CIA-3 cert hub.

Examworthy is not affiliated with or endorsed by The Institute of Internal Auditors. Original, blueprint-aligned practice material only.