Principle 14 - Communicate Internally

14.01 Management should internally communicate relevant and quality information, including objectives and responsibilities for internal control, necessary to support the functioning of the internal control system.

Communication Throughout the Entity

14.02 Management communicates relevant and quality information throughout the entity using established reporting lines. Communication is the continual, iterative process of providing, sharing, and obtaining necessary information. Quality information is communicated down, across, up, and around reporting lines to all levels of the entity.

14.03 Management communicates relevant and quality information down and across reporting lines to enable personnel to understand and perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management assigns the internal control responsibilities for key roles. Communications support the functioning of all five components of internal control and the achievement of the entity’s objectives. Communications may include legal and regulatory requirements, ethical values, the entity’s objectives, identified risks, policies and procedures that support personnel in performing their internal control responsibilities, and the results of monitoring activities that may include corrective actions to remediate internal control deficiencies.

14.04 Management obtains relevant and quality information about the entity’s business processes that flows up the reporting lines from personnel to help management achieve the entity’s objectives. Information communicated by personnel may include internal control issues; this communication helps management identify internal control deficiencies and take corrective action.

14.05 The oversight body obtains relevant and quality information that flows up the reporting lines from management and other personnel. Information relating to internal control communicated to the oversight body includes significant matters about adherence to, changes in, or issues arising from the internal control system. This upward communication is necessary for the effective oversight of internal control.

14.06 Personnel use separate reporting lines to go around upward reporting lines when these lines are compromised. Laws and regulations may require entities to establish separate lines of communication, such as whistleblower and ethics hotlines, for communicating confidential information. Management informs employees of these separate reporting lines, how they operate, how they are to be used, and how the information will remain confidential.

Appropriate Methods of Communication

14.07 Management selects appropriate methods for communicating internally. Management considers a variety of factors in selecting an appropriate method of communication. Some factors to consider follow:

• Audience - The intended recipients of the communication.

• Nature of information - The purpose and type of information being

   communicated.

• Availability - Information readily available to the audience when

   needed.

• Cost - The resources used to communicate the information.

• Legal or regulatory requirements - Requirements in laws and

   regulations that may impact communication.

14.08 Based on consideration of the factors, management selects appropriate methods of communication. Management evaluates the entity’s methods of communication on a periodic and ongoing basis so that the organization has the appropriate tools to communicate quality information throughout the entity on a timely basis.