Section D is nearly half the exam. It covers the entire back half of an engagement: communicating results effectively (D.1–D.4), assessing residual risk (D.5), handling management's acceptance of risk (D.6), monitoring action plans (D.7), and escalating when things go wrong (D.8). The governing standards are 11.2–11.5, 13.1 (the closing communication), 14.3–14.5, and 15.1–15.2. Read this chapter as a timeline: report the results well, conclude on residual risk, deal with risk acceptance, follow up, and escalate if needed.
4.1 Attributes of effective communication (D.1)
Definitions (D.1.a)
Standard 11.2 requires the CAE to "establish and implement methodologies to promote accurate, objective, clear, concise, constructive, complete, and timely internal audit communications"[1]. The seven attributes are defined with unusual care — memorize each:
- Accurate — "free from errors and distortions and faithful to the underlying facts," using "precise terms and descriptions, supported by information gathered"[1].
- Objective — "impartial, unbiased, and the result of a fair and balanced assessment of all relevant facts and circumstances," avoiding "terms that may be perceived as biased"[1].
- Clear — "logical and easily understood by relevant stakeholders, avoiding unnecessary technical language," consistent with the organization's terminology[1].
- Concise — "succinct and free from unnecessary detail and wordiness," excluding "information that is unnecessary, insignificant, or unrelated to the engagement or service"[1].
- Constructive — "helpful to stakeholders and the organization and enabling improvement where needed," expressed with "a cooperative and helpful tone that facilitates collaboration"[1].
- Complete — "relevant, reliable, and sufficient information and evidence to support the results," enabling "the reader to reach the same conclusions as those reached by internal auditors"[1].
- Timely — "appropriately timed, according to the significance of the issue, allowing management to take corrective action"[1].
Application in engagements (D.1.b)
The exam tests application by giving a flawed communication and asking which attribute it violates: a report padded with irrelevant background violates concise; a report using loaded language like "reckless disregard" violates objective; a report that omits the evidence behind its conclusions violates complete; a report so technical the board cannot follow it violates clear. Work through each scenario by matching the flaw to the definition above.
Methodologies that promote effective communication (D.1.c)
The CAE's methodologies "may include policies, criteria, style guides, and procedures to guide the internal audit function's communications and achieve consistency," should "consider the expectations of the board, senior management, and other relevant stakeholders," and may include "communications training to internal auditors, such as training in writing or preparing presentations of final communications"[1]. Supervisory reviews are part of the methodology — they "should enhance the degree to which engagement communications are" accurate, objective, and so on[1]. On the exam, when asked how the CAE ensures communication quality, the answer is this methodology package: style guides, stakeholder-aware standards, training, and supervisory review.
4.2 Communicating engagement results effectively (D.2)
Components of the final engagement communication (D.2.a)
Standard 15.1 states the requirement directly: "for each engagement, internal auditors must develop a final communication that includes the engagement's objectives, scope, recommendations and/or action plans if applicable, and conclusions." For assurance engagements, the communication "also must include" three more items: "the findings and their significance and prioritization," "an explanation of scope limitations, if any," and "a conclusion regarding the effectiveness of the governance, risk management, and control processes of the activity reviewed."[1] Two further requirements attach: the communication "must specify the individuals responsible for addressing the findings and the planned date by which the actions should be completed," and it must be "reviewed and approved by the chief audit executive before it is issued"[1].
Beyond the requirements, "when issued as a report, the final communication may include the following components": "title," "background (brief synopsis of the activity under review)," "recognition (positive aspects of activity under review and/or appreciation of cooperation)," and "distribution list"[1]. The exam distinguishes must from may: objectives, scope, conclusions, and recommendations are required; a title page and background section are customary but not required. Note also that "multiple versions of a final communication may be issued, with formats, content, and level of detail customized to address specific audiences"[1] — the board's version and the process owner's version may legitimately differ.
Stating conformance with the Standards (D.2.b)
"A statement that the engagement is conducted in conformance with the Global Internal Audit Standards should be included in the final engagement communication. Indicating that the internal audit engagement conformed with the Standards is appropriate only if supported by the results of engagement supervision and the quality assurance and improvement program."[1] The exam's trap is the engagement that had known nonconformance (or no supervision, or a failing QAIP) but carries the conformance statement anyway. The statement is earned by supervision and QAIP results — not by default.
Scope limitations (D.2.c)
The final communication must include "an explanation of scope limitations, if any"[1]. Scope limitations also trigger the plan-level duty from Chapter 2: the CAE must communicate "limitations on scope or restrictions on access to information" timely to the board and senior management[1]. The exam scenario: auditors were denied access to key records. The correct answer always includes documenting and communicating the limitation — both in the engagement communication and upward — never silently working around it.
4.3 Recommendations and action plans (D.3)
Protocol when auditors and management disagree (D.3.a)
Recommendations are developed collaboratively: "when developing recommendations, internal auditors must discuss the recommendations with the management of the activity under review." When agreement fails, there is a prescribed path: "if internal auditors and management disagree about the engagement recommendations and/or action plans, internal auditors must follow an established methodology to allow both parties to express their positions and rationale and to determine a resolution"[1]. The exam's wrong answers are the two extremes — auditors imposing recommendations unilaterally, or dropping them because management objected. The right answer is the methodology: both positions expressed, rationale recorded, resolution determined through the established process.
Purpose of recommendations, including cost versus benefit (D.3.b)
Recommendations and action plans exist to "resolve the differences between the established criteria and the existing condition," "mitigate identified risks to an acceptable level," "address the root cause of the finding," and "enhance or improve the activity under review"[1]. On feasibility, the Standards direct auditors to weigh costs against benefits: "discussing the feasibility of internal auditors' recommendations or management's action plans may include weighing the costs, such as the severity of the risk compared to the benefits of implementing the recommendations or action plans"[1]. A recommendation whose cost dwarfs the risk it mitigates fails the feasibility test — and the exam will offer exactly that scenario.
Root cause analysis (D.3.c)
Findings must go deeper than symptoms. The evaluation standard requires that "when evaluating potential engagement findings, internal auditors must collaborate with management to identify the root causes when possible, determine the potential effects, and evaluate the significance of the issue"[1]. The considerations add that "to the extent feasible, internal auditors should determine the root cause, which is an underlying or deeper issue that contributed to the condition," often "a control deficiency" and "a direct reason the condition exists"[1]. Recommendations then address "the root cause of the finding"[1]. The exam pattern: a finding is fixed at the symptom level (retraining one clerk) while the systemic cause (no segregation of duties) remains. The correct recommendation targets the root cause.
4.4 Closing communication (D.4)
The exit conference (D.4.a)
"Depending on the type of engagement, internal auditors may have a closing communication (also called an 'exit conference'), which is an opportunity for internal auditors, the management of the activity under review, and relevant staff to finalize the engagement results before issuing a final communication. The closing communication provides an opportunity for management and internal auditors to discuss any differences or disagreements about the engagement results with a goal of reaching agreement."[1] Three parties, one purpose: finalize results and resolve differences before the final communication is issued. Note that "management action plans may not be fully developed before the closing communication, but management may have ideas about the actions it will take" — the conference can proceed with ideas and confirm plans afterward[1].
Distribution of the final communication (D.4.b)
"The chief audit executive must disseminate the final communication to parties who can ensure that the results are given due consideration"[1]. The CAE "must review and approve final engagement communications, which include engagement conclusions, and decide to whom and how they will be disseminated before they are issued" — and "if these duties are delegated to other internal auditors, the chief audit executive retains overall responsibility"[1]. Distribution is a CAE decision guided by one criterion: who can ensure the results get due consideration.
Stakeholders' purposes (D.4.c)
Different audiences use the communication differently, which is why "multiple versions of a final communication may be issued, with formats, content, and level of detail customized to address specific audiences, based upon how much they know about the activity under review, how the findings and conclusions affect them, and how they plan to use the information"[1]. The board needs conclusions and themes for oversight; the process owner needs findings and action plans for remediation; senior management needs both for decision-making. The exam tests whether the auditor tailors content, format, and detail to the audience's knowledge and use.
Communicating resolved findings (D.4.d)
Findings that management corrects during fieldwork do not vanish from the record. The Standards require that "when internal auditors become aware that management has initiated or completed actions to address a finding before the final communication, the actions must be acknowledged in the communication"[1]. The closing communication exists to "finalize the engagement results" with management before issuance[1]. Resolved findings are therefore reflected — with management's corrective actions acknowledged — rather than silently omitted, because the conclusions must be supported by the work performed and the results clearly stated.
Correcting errors and omissions (D.4.e)
"If a final engagement communication contains a significant error or omission, the chief audit executive must communicate corrected information promptly to all parties who received the original communication," and "significance is determined according to criteria agreed upon with the board"[1]. To judge significance, the CAE evaluates "whether the mistaken or omitted information could have legal or regulatory consequences or change the findings, conclusions, recommendations, or management's action plans"[1]. The CAE should also "identify the cause of the error or omission and take corrective action to prevent a similar situation from occurring in the future"[1]. The exam's key details: all original recipients get the correction, significance is judged against board-agreed criteria, and the process ends with root-cause correction — not just a reissued page.
4.5 Assessing controls and residual risk (D.5)
Assessing control design and operating effectiveness (D.5.a)
To determine the significance of a finding, "internal auditors identify and evaluate existing controls for design adequacy and effectiveness, then determine the level of residual risk, which is the risk that remains despite having controls in place"[1]. Design adequacy asks whether the control, as designed, would address the risk; effectiveness asks whether it does in practice. A well-designed control that nobody follows is an effectiveness failure — the exam tests this distinction constantly. Findings are then prioritized: "internal auditors must prioritize each engagement finding based on its significance, using methodologies established by the chief audit executive"[1].
Residual risk is "the portion of inherent risk that remains after management actions are implemented"[1]. It is what is left after controls do their work — and it is the quantity the engagement ultimately concludes on.
Aggregating and prioritizing risk exposures (D.5.b)
Individual findings become an engagement conclusion through aggregation: "the findings and conclusions of multiple engagements, when viewed holistically, may reveal patterns or trends," and the CAE communicates "conclusions at the level of the business unit or organization"[1]. Within an engagement, auditors weigh findings collectively — the engagement conclusion is the auditors' "professional judgment about engagement findings when viewed collectively"[1]. The exam scenario: three minor findings in the same process that together indicate systemic failure. The correct conclusion reflects the aggregate, not the largest single finding.
Rating scales (D.5.c)
The chief audit executive's methodologies for the internal audit function "may provide a rating scale indicating whether reasonable assurance exists regarding the effectiveness of controls. For example, a scale may indicate satisfactory, partially satisfactory, needs improvement, or unsatisfactory depending on the internal auditors' assessments."[1] Note may: the rating scale is a methodology choice, not a Standards mandate. The exam tests that the scale expresses reasonable assurance on control effectiveness — not a grade on management's cooperation or the auditors' effort.
Sources cited in this excerpt
- Global Internal Audit Standards. The Institute of Internal Auditors. https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/