Principle 14 - Communicate Internally: Difference between revisions
No edit summary |
No edit summary |
||
| Line 2: | Line 2: | ||
[https://guides.gaoinnovations.gov/greenbook/2025/principle-14-communicate-internally/ External Link to US GAO Green Book Principle 14] | [https://guides.gaoinnovations.gov/greenbook/2025/principle-14-communicate-internally/ External Link to US GAO Green Book Principle 14] | ||
'''14.01''' | ==== '''14.01''' ==== | ||
Management should internally communicate relevant and quality information, including objectives and responsibilities for internal control, necessary to support the functioning of the internal control system. | |||
=== 14.1 Communication Throughout the Entity === | === 14.1 Communication Throughout the Entity === | ||
'''14. | ==== '''14.02''' ==== | ||
Management communicates relevant and quality information throughout the entity using established reporting lines. Communication is the continual, iterative process of providing, sharing, and obtaining necessary information. Quality information is communicated down, across, up, and around reporting lines to all levels of the entity. | |||
'''Management | ==== '''14.03''' ==== | ||
Management communicates relevant and quality information down and across reporting lines to enable personnel to understand and perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management assigns the internal control responsibilities for key roles. Communications support the functioning of all five components of internal control and the achievement of the entity’s objectives. Communications may include legal and regulatory requirements, ethical values, the entity’s objectives, identified risks, policies and procedures that support personnel in performing their internal control responsibilities, and the results of monitoring activities that may include corrective actions to remediate internal control deficiencies. | |||
'''14. | ==== '''14.04''' ==== | ||
Management obtains relevant and quality information about the entity’s business processes that flows up the reporting lines from personnel to help management achieve the entity’s objectives. Information communicated by personnel may include internal control issues; this communication helps management identify internal control deficiencies and take corrective action. | |||
'''The oversight body obtains relevant and quality information that flows up the reporting lines from management and other personnel. | ==== '''14.05''' ==== | ||
The oversight body obtains relevant and quality information that flows up the reporting lines from management and other personnel. Information relating to internal control communicated to the oversight body includes significant matters about adherence to, changes in, or issues arising from the internal control system. This upward communication is necessary for the effective oversight of internal control. | |||
'''14.06''' | ==== '''14.06''' ==== | ||
Personnel use separate reporting lines to go around upward reporting lines when these lines are compromised. Laws and regulations may require entities to establish separate lines of communication, such as whistleblower and ethics hotlines, for communicating confidential information. Management informs employees of these separate reporting lines, how they operate, how they are to be used, and how the information will remain confidential. | |||
=== 14.2 Appropriate Methods of Communication === | === 14.2 Appropriate Methods of Communication === | ||
'''Management selects appropriate methods for communicating internally. Management considers a variety of factors in selecting an appropriate method of communication. | ==== '''14.07''' ==== | ||
Management selects appropriate methods for communicating internally. Management considers a variety of factors in selecting an appropriate method of communication. | |||
Some factors to consider follow: | Some factors to consider follow: | ||
| Line 40: | Line 35: | ||
* '''Legal or regulatory requirements''' - Requirements in laws and regulations that may impact communication. | * '''Legal or regulatory requirements''' - Requirements in laws and regulations that may impact communication. | ||
'''14.08''' | ==== '''14.08''' ==== | ||
Based on consideration of the factors, management selects appropriate methods of communication. Management evaluates the entity’s methods of communication on a periodic and ongoing basis so that the organization has the appropriate tools to communicate quality information throughout the entity on a timely basis.{{Principles}} | |||
== Related Story Events == | == Related Story Events == | ||
| Line 48: | Line 42: | ||
* [[2001: The Journey Begins|❓ 2001: The Journey Begins]] | * [[2001: The Journey Begins|❓ 2001: The Journey Begins]] | ||
* [[December 2024: Gaining Support|📋 December 2024: Resolution Submission]] | * [[December 2024: Gaining Support|📋 December 2024: Resolution Submission]] | ||
Revision as of 22:17, 13 August 2026
14.0 Communicate Internally
External Link to US GAO Green Book Principle 14
14.01
Management should internally communicate relevant and quality information, including objectives and responsibilities for internal control, necessary to support the functioning of the internal control system.
14.1 Communication Throughout the Entity
14.02
Management communicates relevant and quality information throughout the entity using established reporting lines. Communication is the continual, iterative process of providing, sharing, and obtaining necessary information. Quality information is communicated down, across, up, and around reporting lines to all levels of the entity.
14.03
Management communicates relevant and quality information down and across reporting lines to enable personnel to understand and perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management assigns the internal control responsibilities for key roles. Communications support the functioning of all five components of internal control and the achievement of the entity’s objectives. Communications may include legal and regulatory requirements, ethical values, the entity’s objectives, identified risks, policies and procedures that support personnel in performing their internal control responsibilities, and the results of monitoring activities that may include corrective actions to remediate internal control deficiencies.
14.04
Management obtains relevant and quality information about the entity’s business processes that flows up the reporting lines from personnel to help management achieve the entity’s objectives. Information communicated by personnel may include internal control issues; this communication helps management identify internal control deficiencies and take corrective action.
14.05
The oversight body obtains relevant and quality information that flows up the reporting lines from management and other personnel. Information relating to internal control communicated to the oversight body includes significant matters about adherence to, changes in, or issues arising from the internal control system. This upward communication is necessary for the effective oversight of internal control.
14.06
Personnel use separate reporting lines to go around upward reporting lines when these lines are compromised. Laws and regulations may require entities to establish separate lines of communication, such as whistleblower and ethics hotlines, for communicating confidential information. Management informs employees of these separate reporting lines, how they operate, how they are to be used, and how the information will remain confidential.
14.2 Appropriate Methods of Communication
14.07
Management selects appropriate methods for communicating internally. Management considers a variety of factors in selecting an appropriate method of communication.
Some factors to consider follow:
- Audience - The intended recipients of the communication.
- Nature of information - The purpose and type of information being communicated.
- Availability - Information readily available to the audience when needed.
- Cost - The resources used to communicate the information.
- Legal or regulatory requirements - Requirements in laws and regulations that may impact communication.
14.08
Based on consideration of the factors, management selects appropriate methods of communication. Management evaluates the entity’s methods of communication on a periodic and ongoing basis so that the organization has the appropriate tools to communicate quality information throughout the entity on a timely basis.=== Assessment Observations Compared to Green Book Components, Principles, & Attributes ===
Control Environment
Component: Control Environment - The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives.
- Principle 1 - Demonstrate Commitment to Integrity and Ethical Values
- Principle 2 - Exercise Oversight Responsibility
- Principle 3 - Establish Structure, Responsibility, and Authority
- Attributes (3.01, 3.02, 3.03, 3.04, 3.05, 3.06, 3.07, 3.08, 3.09, 3.10, 3.11, 3.12)
- Principle 4 - Demonstrate Commitment to Competence
- Attributes (4.01, 4.02, 4.03, 4.04, 4.05, 4.06, 4.07, 4.08)
- Principle 5 - Enforce Accountability
- Attributes (5.01, 5.02, 5.03, 5.04, 5.05, 5.06, 5.07, 5.08)
Risk Assessment
Component: Risk Assessment - The identification and analysis of risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses.
- Principle 6 - Define Objectives and Risk Tolerances
- Attributes (6.01, 6.02, 6.03, 6.04, 6.05, 6.06, 6.07, 6.08, 6.09, 6.10)
- Principle 7 - Identify, Analyze, and Respond to Risks
- Attributes (7.01, 7.02, 7.03, 7.04, 7.05, 7.06, 7.07, 7.08, 7.09, 7.10, 7.11, 7.12, 7.13, 7.14, 7.15)
- Principle 8 - Assess Fraud, Improper Payment, and Information
- Attributes (8.01, 8.02, 8.03, 8.04, 8.05, 8.06, 8.07, 8.08, 8.09, 8.10, 8.11, 8.12, 8.13, 8.14, 8.15, 8.16, 8.17, 8.18, 8.19, 8.20)
- Principle 9 - Identify, Analyze, and Respond to Change
- Attributes (9.01, 9.02, 9.03, 9.04, 9.05, 9.06, 9.07, 9.08, 9.09, 9.10, 9.11, 9.12, 9.13)
Control Activities
Component: Control Activities - The actions management establishes through policies and procedures to mitigate risks to achieving the entity's objectives to acceptable levels.
- Principle 10 - Design Control Activities
- Attributes (10.01, 10.02, 10.03, 10.04, 10.05, 10.06, 10.07, 10.08, 10.09, 10.10, 10.11, 10.12, 10.13, 10.14, 10.15, 10.16, 10.17, 10.18, 10.19, 10.20, 10.21, 10.22, 10.23)
- Principle 11 - Design General Control Activities over Information
- Attributes (11.01, 11.02, 11.03, 11.04, 11.05, 11.06, 11.07, 11.08, 11.09, 11.10, 11.11, 11.12, 11.13, 11.14, 11.15, 11.16, 11.17)
- Principle 12 - Implement Control Activities
- Attributes (12.01, 12.02, 12.03, 12.04, 12.05)
Information and Communication
Component: Information and Communication - The quality information management and other personnel communicate and use to support the internal control system.
- Principle 13 - Use Quality Information
- Attributes (13.01, 13.02, 13.03, 13.04, 13.05, 13.06, 13.07)
- Principle 14 - Communicate Internally
- Attributes (14.01, 14.02, 14.03, 14.04, 14.05, 14.06, 14.07, 14.08)
- Principle 15 - Communicate Externally
- Attributes (15.01, 15.02, 15.03, 15.04, 15.05, 15.06, 15.07, 15.08, 15.09)
Monitoring
Component: Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews.
- Principle 16 - Perform Monitoring Activities
- Attributes (16.01, 16.02, 16.03, 16.04, 16.05, 16.06, 16.07, 16.08, 16.09, 16.10)
- Principle 17 - Evaluate Issues and Remediate Deficiencies
- Attributes (17.01, 17.02, 17.03, 17.04, 17.05, 17.06, 17.07, 17.08)
