• Chapter 6

• Information and Communication

Assuming employees and stakeholders do not want to become forensic investigators to perform their
responsibilities and tasks, it is important for the entity to provide the information needed to:

• Serve the purpose of the recipient.

• Avoid flooding the communication lines with data that numbs the senses and obscures rather than
reveals.

• Make decisions based on reliable and timely information.

The auditing literature1 describes the necessary elements of an information system for financial reporting,
which include the methods and records that:

• Identify and record all valid transactions.

• Describe on a timely basis the transactions in sufficient detail to permit proper classification of
transactions for financial reporting.

• Measure the value of transactions in a manner that permits recording of their proper monetary
value in the financial statements.

• Determine the time period in which transactions occurred to permit recording of transactions in
the proper accounting period.

• Present properly the transactions and related disclosures in the financial statements

• PRINCIPLE 13: GENERATES RELEVANT INFORMATION

The points of focus for this principle are for the entity to:

• Identify information requirements.

• Capture internal and external data.

• Process relevant data into information.

• Maintain quality throughout processing.

• Consider costs and benefits

• Simple Questions during the walk-throughs can provide evidence that the owner of the control
assess that he or she receives the necessary information.

• How does the entity ensure that individuals are receiving the information they want and need?

• What process does management use to identify relevant and irrelevant or unnecessary
information?
 • What information does management say it needs to perform its management functions?

• What controls are present to ensure employees are not given sensitive information that by law or
intellectual property rights or competitive concerns cannot be shared? A

• Are segregation of duties issues considered when approving information requests?

Timing is important. It is not enough to capture and communicate information

The communication must be done in a timely manner that allows it to be useful in controlling the entity’s
activities and reporting financial results.

While there may be trade-offs among cost, timing, and absolute accuracy, these trade-offs need to be
prioritized and accepted

The information system captures relevant data from internal and external sources with implications for
financial, operational, and regulatory issues that impact the entity and particularly any accruals and
disclosures.

The information needed to prepare reliable financial reports and to manage a business is not limited to
financial information; nonfinancial information also is important.

Information received from external sources may indicate control weaknesses.

Information from blogs, analyst reports, trade publications, and other sources may not always directly
relate to the entity but can provide input regarding industry issues and a perspective on future directs that
can shape shareholder and potential shareholder views.

An entity’s information system is not limited to merely capturing the company’s recurring, routine
transactions and events but also must include a means for identifying, capturing, and communicating
information that is outside the normal course of business.

• PRINCIPLE 14: COMMUNICATES INTERNALLY

Various forms of communication including e-mail, posters in common facilities, group meetings, and
phone conversations can make up a complicated set of communication vehicles.

Depending on the communication, these vehicles may not be appropriate alternatives for effective
communication.

Simple etiquette today dictates that text messages may not be appropriate in certain circumstances.

Important issues need to be documented to better ensure understanding and establish follow-up
responsibility.

The points of focus for Principle 14 are for the entity to:

• Communicate internal control information.

• Communicate with governance.

 • Provide separate communication lines.

• Select relevant methods of communication.

Ineffective communications are a good cover for hiding information that could be used to identify issues,
problems, and fraud

Monitoring is particularly reliant on effective communication.

The two- and three-way communication channels among management, governance, and employees need
to be assessed to ensure that effective financial and business communications are achieved.

The entity’s information and communication systems should be closely integrated with its control
activities to support their proper functioning and the need to identify anomalies and problems as early as
practical

In order for control activities to be effective, any controls-related issues must be communicated clearly to
individuals who perform management and control functions:

• Specific control activity–related duties (including monitoring).

• Relevant aspects of the internal control system, how they work, and each person’s role and
responsibility in the system.

• How their activities relate to the work of others. This knowledge will help employees recognize a
problem or help motivate them to determine its cause and propose a corrective action.

• Expected behavior: what is acceptable and unacceptable.

• The notion that whenever the unexpected occurs, attention should be given not only to the event
itself but also to its cause.

• PRINCIPLE 15: COMMUNICATES EXTERNALLY

External communications include financial reporting and disclosures. As with internal communications,
there may be formal and informal aspects to the communication, but an assessment of the formal
mechanisms between the entity and customers, vendors, regulators, taxing authorities, shareholders, and
the general public is expected.

Many of the financial reporting responsibilities are well defined for public companies.

Nonpublic companies may look toward loan agreements and agreements with private equity providers
and others for periodic reports on operations.

The points of focus for Principle 15 are for the entity to:

• Communicate with external parties.

• Enable inbound communications.

 • Communicate with governance.

• Provide separate communication lines.

• Select relevant methods of communication

Traditional business practices maintain records of complaints regarding billing, shipments, business
practices, and other issues. These can be a significant external source of information regarding internal
issues that should be addressed.

Regulatory agency or internal auditor reports citing deficiencies in practices or controls may not
automatically be transmitted to the governance group

Independent auditors are expected to inquire regarding any such reports and ensure they are appropriately
communicated

Better that an internal process be in place to ensure this on a regular basis than have it appear on an
auditor deficiency list.

In public companies, prosecution and penalties can be imposed against individuals and the entity by the
SEC for revealing information that is not “public”.

In some situations, external communication is not a good thing.

• Transitioning to the New Framework

The 2006 COSO guidance identified four specific attributes that could be used for classifying the
component:

1. Financial reporting information is identified, captured, used, and distributed.

2. Internal control information is identified, captured, used, and distributed.

3. Internal communication supports the execution of internal control.

4. Matters affecting the achievement of the objectives are communicated

These attributes have now been collapsed into three principles and the underlying points of focus, control
objectives and/or assertions may be the most reliable way to link the previous structure to the 2013
Framework, as a simple matching of the 2006 attributes and principles is difficult. While inherent in the
attributes discussed, the specification of relevance (Principle 13) as a principle may create more focus on
this issue. Note that in transition, you may identify some previously unaddressed control points that now
need to be addressed going forward.