CIA-3 - Engagement Results and Monitoring (45% of the exam) - Section D.5
Recognize the various purposes of communicating with different stakeholders, and the protocol for reporting an already-resolved finding and for correcting significant errors or omissions.
Recognise the different purposes served by communicating engagement results to management of the activity under review, senior management, the board, the risk management function, external auditors, regulators, and, in some cases, the general public. Recognise the appropriate protocol for reporting a finding that management has already resolved, and describe the chief audit executive's responsibility and protocol for correcting significant errors and omissions discovered after the final communication is issued.
Stakeholder communicationCorrecting final communication
Practice question for this objective
lock_openFree sampleEngagement Results and Monitoringmedium
At Halewood Group the chief audit executive has prepared the final engagement communication summarising significant findings. Before it goes to senior management and the board, which step reflects sound closing communication practice?
AHand the draft to the audited unit so it can rewrite the findings in its own words before issue.
BRelease it to senior management first and leave board reporting to senior management's discretion afterwards.
CPost the results on the organisation's intranet so staff across the business can review the conclusions.
DReview and approve the final communication, then communicate the results to senior management and the board as appropriate.check_circle Correct
Identify that the chief audit executive approves the final communication and reports results to senior management and the board. Sound closing practice has the chief audit executive review and approve the final communication and then communicate the results to senior management and the board, keeping the reporting line intact rather than delegating rewriting, routing, or broadcasting.
Why A is wrong: Management input on responses is appropriate, but letting the audited unit rewrite the findings surrenders control of the communication and undermines its objectivity.
Why B is wrong: Senior management is a proper recipient, which makes this tempting, but routing board reporting through senior management's discretion weakens the chief audit executive's direct reporting line to the board.
Why C is wrong: Wider awareness can seem beneficial, but open publication disregards the sensitivity of the results and the duty to direct them to appropriate recipients.
Why D is correct: The chief audit executive reviews and approves the final communication and directs it to senior management and the board, preserving the reporting line and accountability for the results.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-3 bank for this domain.
Agree to route the results through the finance director, since that office administers the function's operating budget.
errorWhy it is wrong: Administering the budget does not give the finance director control of the reporting line, and routing results through management can filter what the board sees.
Accept senior management's position as final, on the basis that they outrank the chief audit executive on business risk judgements.
errorWhy it is wrong: Tempting because senior management does own the risk decision, but treating their view as the end of the matter ignores the chief audit executive's obligation to escalate an unresolved and potentially unacceptable risk.
Overrule the operations director's decision and mandate the corrective action, because the audit team has judged the residual risk to be too high.
errorWhy it is wrong: Tempting because the chief audit executive holds a firm view, but audit advises and evaluates rather than mandates operational decisions, so overruling the director oversteps the role.