Principle 15 - Communicate Externally

15.01 Management should communicate relevant and quality information with appropriate external parties regarding matters impacting the functioning of the internal control system.

Communication with External Parties

15.02 Management communicates with, and obtains relevant and quality information from, appropriate external parties using established reporting lines. Open two-way external reporting lines allow for this communication. External parties may include service organizations, suppliers, contractors, regulators, regulated entities, external auditors, federal entities, state and local governments, grantees, and the public.

15.03 Management communicates relevant and quality information externally through reporting lines so that appropriate external parties can help the entity achieve its objectives, address related risks, and support its internal control system. Information communicated by management includes significant matters relating to the entity’s events and activities that impact its internal control system. For instance, information communicated to service organizations may include information on the entity’s objectives and ethical values, identified risks, internal control practices to consider, and performance metrics. Information communicated for the entity to achieve program-related objectives may include information on eligibility, reporting, and audit requirements for recipients of federal financial assistance and legal and regulatory requirements to regulated entities.

15.04 Management obtains information through reporting lines from external parties. Information communicated to management includes significant matters relating to risks, changes, or issues that impact the entity’s internal control system. Communication may also include information for the entity to achieve program-related objectives. These communications are necessary for the effective operation of internal control. Management evaluates external information obtained against the characteristics of quality information and information processing objectives and takes any necessary actions so that the information is quality information.

15.05 The oversight body obtains information through reporting lines from external parties. Information communicated to the oversight body includes significant matters relating to risks, changes, and issues that impact the entity’s internal control system. This communication is necessary for the effective oversight of internal control.

15.06 External parties use separate reporting lines when external reporting lines are compromised. Laws and regulations may require entities to establish separate lines of communication, such as whistleblower and ethics hotlines, for communicating confidential information. Management informs external parties of these separate reporting lines, how they operate, how they are to be used, and how the information will remain confidential.

Appropriate Methods of Communication

15.07 Management selects appropriate methods for communicating externally. Management considers a variety of factors in selecting an appropriate method of communication. Some factors to consider follow:

• Audience - The intended recipients of the communication.

• Nature of information - The purpose and type of information being

   communicated.

• Availability - Information readily available to the audience when

   needed.

• Cost - The resources used to communicate the information.

• Legal or regulatory requirements - Requirements in laws and

   regulations that may impact communication.

15.08 Based on consideration of the factors, management selects appropriate methods of communication. Management evaluates the entity’s methods of communication on a periodic and ongoing basis so that the organization has the appropriate tools to communicate quality information throughout and outside of the entity on a timely basis.

15.09 Government entities not only report to the head of the government, legislators, and regulators but to the public as well. In the federal government, entities not only report to the President and Congress but also to the public. Entities consider appropriate methods for communicating with such a broad audience.