Overview
Management uses quality information to support the internal control system. Effective information and communication are vital for an entity to achieve its objectives. Entity management needs access to relevant and reliable communication related to internal as well as external events.
Principles
13.1 Management should use quality information to achieve the entity’s objectives.
Attributes
The following attributes contribute to the design, implementation, and operating effectiveness of this principle:
Identification of Information Requirements
13.2 Management designs a process that uses the entity’s objectives and related risks to identify the information requirements needed to achieve the objectives and address the risks. Information requirements consider the expectations of both internal and external users. Management defines the identified information requirements at the relevant level and requisite specificity for appropriate personnel.
13.3 Management identifies information requirements in an iterative and ongoing process that occurs throughout an effective internal control system. As change in the entity and its objectives and risks occurs, management changes information requirements as needed to meet these modified objectives and address these modified risks.
Relevant Data from Reliable Sources
13.4 Management obtains relevant data from reliable internal and external sources in a timely manner based on the identified information requirements. Relevant data have a logical connection with, or bearing upon, the identified information requirements. Reliable internal and external sources provide data that are reasonably free from error and bias and faithfully represent what they purport to represent. Management evaluates both internal and external sources of data for reliability. Sources of data can be operational, financial, or compliance related. Management obtains data on a timely basis so that they can be used for effective monitoring.
Data Processed into Quality Information
13.5 Management processes the obtained data into quality information that supports the internal control system. This involves processing data into information and then evaluating the processed information so that it is quality information. Quality information meets the identified information requirements when relevant data from reliable sources are used. Quality information is appropriate, current, complete, accurate, accessible, and provided on a timely basis. Management considers these characteristics as well as the information processing objectives in evaluating processed information and makes revisions when necessary so that the information is quality information. Management uses the quality information to make informed decisions and evaluate the entity’s performance in achieving key objectives and addressing risks.
13.6 Management processes relevant data from reliable sources into quality information within the entity’s information system. An information system is the people, processes, data, and technology that management organizes to obtain, communicate, or dispose of information.
14.1 Management should internally communicate the necessary quality information to achieve the entity’s objectives.
Attributes
The following attributes contribute to the design, implementation, and operating effectiveness of this principle:
Communication throughout the Entity
14.2 Management communicates quality information throughout the entity using established reporting lines. Quality information is communicated down, across, up, and around reporting lines to all levels of the entity.
14.3 Management communicates quality information down and across reporting lines to enable personnel to perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management assigns the internal control responsibilities for key roles.
14.4 Management receives quality information about the entity’s operational processes that flows up the reporting lines from personnel to help management achieve the entity’s objectives.
14.5 The oversight body receives quality information that flows up the reporting lines from management and personnel. Information relating to internal control communicated to the oversight body includes significant matters about adherence to, changes in, or issues arising from the internal control system. This upward communication is necessary for the effective oversight of internal control.
14.6 Personnel use separate reporting lines to go around upward reporting lines when these lines are compromised. Laws and regulations may require entities to establish separate lines of communication, such as whistleblower and ethics hotlines, for communicating confidential information. Management informs employees of these separate reporting lines, how they operate, how they are to be used, and how the information will remain confidential.
Appropriate Methods of Communication
14.7 Management selects appropriate methods to communicate internally. Management considers a variety of factors in selecting an appropriate method of communication. Some factors to consider follow:
14.8 Based on consideration of the factors, management selects appropriate methods of communication, such as a written document—in hard copy or electronic format—or a face-to-face meeting. Management periodically evaluates the entity’s methods of communication so that the organization has the appropriate tools to communicate quality information throughout the entity on a timely basis.
15.1 Management should externally communicate the necessary quality information to achieve the entity’s objectives.
Attributes
The following attributes contribute to the design, implementation, and operating effectiveness of this principle:
Communication with External Parties
15.2 Management communicates with, and obtains quality information from, external parties using established reporting lines. Open two-way external reporting lines allow for this communication. External parties include suppliers, contractors, service organizations, regulators, external auditors, government entities, and the general public.
15.3 Management communicates quality information externally through reporting lines so that external parties can help the entity achieve its objectives and address related risks. Management includes in these communications information relating to the entity’s events and activities that impact the internal control system.
15.4 Management receives information through reporting lines from external parties. Information communicated to management includes significant matters relating to risks, changes, or issues that impact the entity’s internal control system. This communication is necessary for the effective operation of internal control. Management evaluates external information received against the characteristics of quality information and information processing objectives and takes any necessary actions so that the information is quality information.
15.5 The oversight body receives information through reporting lines from external parties. Information communicated to the oversight body includes significant matters relating to risks, changes, or issues that impact the entity’s internal control system. This communication is necessary for the effective oversight of internal control.
15.6 External parties use separate reporting lines when external reporting lines are compromised. Laws and regulations may require entities to establish separate lines of communication, such as whistleblower and ethics hotlines, for communicating confidential information. Management informs external parties of these separate reporting lines, how they operate, how they are to be used, and how the information will remain confidential.
Appropriate Methods of Communication
15.7 Management selects appropriate methods to communicate externally. Management considers a variety of factors in selecting an appropriate method of communication. Some factors to consider follow:
15.8 Based on consideration of the factors, management selects appropriate methods of communication, such as a written document—in hard copy or electronic format—or a face-to-face meeting. Management periodically evaluates the entity’s methods of communication so that the organization has the appropriate tools to communicate quality information throughout and outside of the entity on a timely basis.
15.9 Government entities not only report to the head of the government, legislators, and regulators but to the general public as well. In the federal government, entities not only report to the President and Congress but also to the general public. Entities consider appropriate methods when communicating with such a broad audience.