Summary

Information is necessary for the entity to carry out internal control responsibilities to support the achievement of its objectives. Management obtains or generates and uses relevant and quality information from both internal and external sources to support the functioning of other components of internal control. Communication is the continual, iterative process of providing, sharing, and obtaining necessary information. Internal communication is the means by which information is disseminated throughout the organization, flowing up, down, and across the entity. It enables personnel to receive a clear message from senior management that control responsibilities must be taken seriously. External communication is twofold: it enables inbound communication of relevant external information and provides information to external parties in response to requirements and expectations.

The Information and Communication component of the Framework supports the functioning of all components of internal control. In combination with the other components, information and communication supports the achievement of the entity’s objectives, including objectives relevant to internal and external reporting. Controls within Information and Communication support the organization’s ability to use the right information within the system of internal control and to carry out internal control responsibilities.

Information is the data that is combined and summarized based on relevance to information requirements. Information requirements are determined by the ongoing functioning of the other internal control components, taking into consideration the expectations of all users, both internal and external. Information systems support informed decision making and the functioning of the other components of internal control by processing relevant, timely, and quality information from internal and external sources.

Communication enables the organization to share relevant and quality information internally and externally. Management communicates information internally to enable personnel to understand the entity’s objectives and the importance of their control responsibilities. Internal communication facilitates the functioning of other components of internal control by sharing information up, down, and across the entity. External communication enables management to obtain and share information between the entity and external parties about risks, regulatory matters, changes in circumstances, customer satisfaction, and other information relevant to the functioning of the other components of internal control.

An information system is the set of activities, involving people, processes, data and/or technology, which enable the organization to obtain, generate, use, and communicate transactions and information to maintain accountability and measure and review the entity’s performance or progress toward achievement of objectives.

The Framework distinguishes this component from the internal reporting category of objectives. Information and Communication is only one component of the Framework. Controls within this component help to provide relevant, quality information to support all components of internal control. On the other hand, an organization seeking reasonable assurance regarding a specified reporting objective is achieved through all five components of internal control being present and functioning, and operating together.

Communication relates to sharing information used in designing, implementing, or conducting internal control, or in assessing its effectiveness. Communication can appear broad at times (e.g., information communicated about external trends or events), but when it is used in the context of the Framework, this communication may enable a user to carry out controls within Risk Assessment.

Principles relating to the Information & Communication component

13. The organization obtains or generates and uses relevant, quality information to support the functioning of other components of internal control.


14. The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of other components of internal control. 


15. The organization communicates with external parties regarding  matters affecting the functioning of other components of internal control.

Uses Relevant Information

Principle 13: The organization obtains or generates and uses relevant, quality information to support the functioning of other components of internal control.

Points of Focus

The following points of focus may assist management in determining whether this principle is present and functioning:

• Identifies Information Requirements—A process is in place to identify the information required and expected to support the functioning of the other components of internal control and the achievement of the entity’s objectives.
• Captures Internal and External Sources of Data—Information systems capture internal and external sources of data.
• Processes Relevant Data into Information—Information systems process and transform relevant data into information.
• Maintains Quality throughout Processing—Information systems produce information that is timely, current, accurate, complete, accessible, protected, and verifiable and retained. Information is reviewed to assess its relevance in supporting the internal control components.
• Considers Costs and Benefits—The nature, quantity, and precision of information communicated are commensurate with and support the achievement of objectives.

Communicates Internally

Principle 14: The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of other components of internal control.

Points of Focus

The following points of focus may assist management in determining whether this principle is present and functioning:

• Communicates Internal Control Information—A process is in place to communicate required information to enable all personnel to understand and carry out their internal control responsibilities.
• Communicates with the Board of Directors—Communication exists between management and the board of directors so that both have information needed to fulfill their roles with respect to the entity’s objectives.
• Provides Separate Communication Lines—Separate communication channels, such as whistle-blower hotlines, are in place and serve as fail-safe mechanisms to enable anonymous or confidential communication when normal channels are inoperative or ineffective.
• Selects Relevant Method of Communication—The method of communication considers the timing, audience, and nature of the information.

Communicates Externally

Principle 15: The organization communicates with external parties regarding matters affecting the functioning of other components of internal control.

Points of Focus

The following points of focus may assist management in determining whether this principle is present and functioning:

• Communicates to External Parties—Processes are in place to communicate relevant and timely information to external parties including shareholders, partners, owners, regulators, customers, and financial analysts and other external parties.
• Enables Inbound Communications—Open communication channels allow input from customers, consumers, suppliers, external auditors, regulators, financial analysts, and others, providing management and the board of directors with relevant information.
• Communicates with the Board of Directors—Relevant information resulting from assessments conducted by external parties is communicated to the board of directors.
• Provides Separate Communication Lines—Separate communication channels, such as whistle-blower hotlines, are in place and serve as fail-safe mechanisms to enable anonymous or confidential communication when normal channels are inoperative or ineffective.
• Selects Relevant Method of Communication—The method of communication considers the timing, audience, and nature of the communication and legal, regulatory, and fiduciary requirements and expectations.