Information and Communication Controls: The Often-Overlooked Component of Effective Internal Control
How COSO Principles 13, 14, and 15 help organizations produce reliable information, communicate responsibilities, and strengthen internal control effectiveness
An organization can establish detailed policies, implement sophisticated accounting systems, and design effective approval procedures—and still experience significant internal control failures.
Why?
Because employees may not receive the information they need, management may not communicate expectations clearly, and important problems may never reach the individuals responsible for addressing them.
This is where Information and Communication, one of the five components of the COSO Internal Control—Integrated Framework, becomes essential.
Information and Communication supports the operation of the entire internal control system. It enables management, employees, governing bodies, and external stakeholders to obtain and exchange information necessary to fulfill their responsibilities.
For internal auditors, external auditors, compliance professionals, and management, understanding this component is fundamental to evaluating whether internal controls are designed and operating effectively.
A control cannot operate effectively when the people responsible for performing it lack reliable information or do not understand their responsibilities.
1. Understanding Information and Communication in the COSO Framework
The COSO Internal Control—Integrated Framework consists of five integrated components:
Control Environment.
Risk Assessment.
Control Activities.
Information and Communication.
Monitoring Activities.
These components work together to provide reasonable assurance regarding the achievement of organizational objectives.
The Information and Communication component addresses how an organization obtains, generates, uses, and communicates information relevant to internal control.
It includes both the quality of information and the effectiveness of communication channels.
Information must be sufficiently reliable, timely, relevant, and accessible to support decisions and control activities.
Communication must ensure that individuals understand what is expected of them and can report information to the appropriate people.
For example, an accounts payable employee may understand that vendor banking changes require independent verification.
However, if the employee does not receive timely notification that a vendor's banking instructions have changed, the control may not operate as intended.
Similarly, an internal auditor may identify a significant control deficiency, but the organization may remain exposed if the finding is not communicated to individuals with authority to address it.
2. The Three COSO Principles of Information and Communication
The COSO framework identifies three principles associated with this component.
COSO principle | Description | Primary focus |
Principle 13 | Uses Relevant Information | Information quality and availability |
Principle 14 | Communicates Internally | Communication within the organization |
Principle 15 | Communicates Externally | Communication with external parties |
These principles are interconnected.
Reliable information supports effective communication, while communication enables individuals to use information appropriately.
A weakness in one principle may affect the effectiveness of the others.
3. COSO Principle 13: Uses Relevant Information
COSO Principle 13 states:
The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.
This principle addresses the information needed to operate internal controls effectively.
Organizations rely on information from accounting systems, operational applications, management reports, external sources, and manual processes.
However, the existence of information does not establish that the information is appropriate for control purposes.
Information Quality Matters
Information used in internal controls should possess characteristics appropriate to its intended purpose.
These include:
Accuracy: Information correctly represents the underlying transactions or conditions.
Completeness: Relevant transactions and data are included.
Timeliness: Information is available when needed.
Relevance: Information addresses the control objective.
Accessibility: Authorized individuals can obtain and use the information.
Reliability: Information comes from sources and processes that provide reasonable assurance of its integrity.
Consider a monthly budget-to-actual expenditure report.
The report may appear professional and contain detailed financial information.
However, if the underlying accounting data excludes transactions recorded in a subsidiary system, the report may be incomplete.
If the report is produced two months after the reporting period, it may be too late to support timely corrective action.
If the report contains inaccurate account classifications, management may reach inappropriate conclusions.
A report is not a reliable control input merely because it was generated by an accounting system.
4. Information Produced by the Entity (IPE)
Information Produced by the Entity, commonly referred to as IPE, is especially important in financial reporting and internal control testing.
IPE includes reports, spreadsheets, queries, and other information generated by an organization's systems or personnel.
Examples include:
Accounts receivable aging reports.
Accounts payable listings.
Inventory reports.
Journal-entry listings.
User access reports.
Budget-to-actual reports.
Exception reports.
Vendor master file changes.
Bank reconciliation reports.
Management may use these reports to perform control activities.
Auditors may also rely on them when testing those controls.
Example: Accounts Receivable Aging Report
Assume the credit manager reviews an accounts receivable aging report monthly to identify overdue balances.
The control is intended to identify collection problems and support the allowance for credit losses.
Before relying on the report, the organization should have a reasonable basis for believing that it is complete and accurate.
Relevant considerations include:
Does the report include the complete receivables population?
Are invoice dates and payment terms correct?
Are aging calculations accurate?
Are report parameters appropriate?
Can unauthorized users modify the report?
Does the report reconcile to the relevant accounting records?
If the report is incomplete or inaccurate, the manager's review may not identify the conditions the control is intended to detect.
Audit Considerations
Auditors should determine whether information used in a control is sufficiently reliable for the intended purpose.
Depending on the circumstances, this may involve testing the information directly or evaluating relevant controls over its preparation and maintenance.
For PCAOB audits, AS 1105, Audit Evidence, establishes requirements relevant to evaluating information produced by the company when it is used as audit evidence.
The effectiveness of a review control depends partly on the reliability of the information being reviewed.
5. Principle 13 and Information Technology General Controls
Information quality frequently depends on information technology.
Organizations use enterprise resource planning systems, accounting applications, databases, cloud services, and automated reporting tools to process transactions and produce information.
Information Technology General Controls (ITGCs) help support the reliability of these systems.
Relevant ITGC categories include:
ITGC area | Information reliability objective |
Logical access | Restrict unauthorized access to systems and data |
Change management | Prevent unauthorized or inappropriate system changes |
IT operations | Support reliable processing and system availability |
Interfaces | Help ensure data transfers are complete and accurate |
Backup and recovery | Support availability and recovery of information |
For example, a company may use an automated report to identify payments exceeding approved purchasing limits.
If unauthorized users can modify the report's parameters, the control may fail to identify relevant transactions.
Likewise, if data interfaces omit certain transactions, the report may be incomplete.
Auditors should understand how relevant IT controls support the information used in important business processes.
6. COSO Principle 14: Communicates Internally
COSO Principle 14 states:
The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
Internal communication enables employees and management to understand organizational objectives, policies, risks, and control responsibilities.
Effective communication must operate across departments and organizational levels.
It should also permit information to move upward, downward, and across the organization.
Downward Communication
Management communicates expectations, policies, procedures, and responsibilities to employees.
Examples include:
Code of conduct requirements.
Delegations of authority.
Approval limits.
Information security policies.
Fraud reporting procedures.
Financial reporting deadlines.
Changes in internal controls.
Upward Communication
Employees communicate concerns, problems, and exceptions to management or appropriate oversight personnel.
Examples include:
Suspected fraud.
Control failures.
Unauthorized transactions.
Data security incidents.
Compliance violations.
Significant accounting errors.
Cross-Functional Communication
Departments exchange information necessary to coordinate business activities and controls.
For example, Human Resources should communicate employee terminations promptly to
Information Technology so system access can be disabled.
Procurement and Accounts Payable should coordinate vendor onboarding and changes to banking information.
Accounting and Operations should exchange information about inventory movements, contractual obligations, and significant transactions.
A control weakness can arise when information exists in one department but never reaches the department responsible for acting on it.
7. Example: Employee Termination and System Access
Consider an employee who leaves an organization on Friday.
Human Resources processes the termination.
However, IT does not receive notification until the following Wednesday.
During the intervening period, the former employee's system access remains active.
The organization may have a well-designed access termination policy, but the communication process has failed.
The weakness could expose the organization to unauthorized access, data theft, or inappropriate transactions.
An effective process would establish:
Responsibility for initiating termination notifications.
Required communication channels.
Timeframes for disabling access.
Confirmation that access was removed.
Escalation procedures for exceptions.
Monitoring of overdue access terminations.
This example demonstrates that communication is not merely an administrative function.
It can be a critical element of control design and operating effectiveness.
8. Communicating Internal Control Responsibilities
Employees cannot consistently perform controls they do not understand.
Organizations should communicate:
What the control is intended to accomplish.
Who is responsible for performing it.
When the control must be performed.
What information must be reviewed.
What constitutes an exception.
How exceptions must be documented.
When issues must be escalated.
Who has authority to resolve them.
For example, a policy requiring supervisory approval of vendor payments may be insufficient if supervisors do not understand what they are expected to review.
Does approval mean confirming that the invoice exists?
Or must the supervisor verify the purchase authorization, receipt of goods or services, vendor identity, and accuracy of the amount?
The effectiveness of the control depends on the nature of the required review.
Clear communication helps ensure that employees perform the control as designed.
9. Whistleblower and Fraud Reporting Channels
Internal communication also includes mechanisms for reporting suspected misconduct.
Organizations may establish:
Ethics hotlines.
Confidential reporting channels.
Direct reporting to compliance personnel.
Escalation to internal audit.
Reporting to the audit committee.
Procedures for handling allegations involving senior management.
These mechanisms are particularly important when normal management reporting relationships may be compromised.
For example, an employee who suspects that a supervisor is manipulating financial results may be reluctant to report the concern directly to that supervisor.
An alternative reporting channel can help ensure the information reaches an appropriate independent party.
The organization should also establish procedures for protecting confidentiality, addressing retaliation concerns, investigating allegations, and communicating significant matters to those charged with governance.
The existence of an ethics hotline alone does not establish that the reporting process is effective.
Management and auditors should consider whether reports are received, evaluated, escalated, and resolved appropriately.
10. COSO Principle 15: Communicates Externally
COSO Principle 15 states:
The organization communicates with external parties regarding matters affecting the functioning of internal control.
External communication includes both information the organization provides to outside parties and information received from them.
Relevant external parties may include:
Customers.
Vendors.
Regulators.
External auditors.
Shareholders and investors.
Lenders.
Government agencies.
Business partners.
Service organizations.
Effective external communication helps organizations identify risks, meet legal obligations, and respond to changing conditions.
Example: Vendor Banking Information
A vendor sends an email requesting a change to its bank account.
The organization must determine whether the request is legitimate.
If employees rely solely on the email, they may become victims of business email compromise.
An effective control may require independent verification using previously established contact information.
This involves external communication with the vendor through a trusted channel.
The verification process should be documented.
The example illustrates how external communication supports fraud prevention and payment integrity.
11. External Communication With Regulators and Auditors
Organizations subject to regulatory requirements must provide information to external parties.
Examples include:
Regulatory filings.
Financial statements.
Compliance reports.
Required incident notifications.
Responses to examination findings.
Communications with external auditors.
Information provided externally should be accurate, complete, timely, and consistent with applicable requirements.
For example, a financial institution may be required to submit regulatory reports containing information derived from multiple accounting and operational systems.
The organization should establish controls over data collection, preparation, review, approval, and submission.
A failure in any of these processes can result in inaccurate reporting or regulatory noncompliance.
External communication should not be viewed simply as sending a completed report.
It is a controlled process involving information quality, accountability, and appropriate authorization.
12. Information and Communication in Financial Reporting
Information and Communication plays a critical role in Internal Control over Financial Reporting (ICFR).
Financial reporting depends on information flowing from operational systems and departments into accounting records and financial statements.
Examples include:
Sales communicating contract terms to Accounting.
Operations reporting inventory quantities.
Human Resources providing compensation information.
Legal communicating litigation and contingencies.
Treasury reporting debt and financing arrangements.
Tax providing information about income tax positions.
A breakdown in these communications can cause financial statement misstatements.
Example: Unrecorded Contractual Obligation
Assume the Legal Department negotiates a significant settlement agreement before year-end.
Accounting does not receive the agreement until after the financial statements are prepared.
The organization may fail to record or disclose an appropriate liability.
The issue may not result from an incorrect accounting calculation.
It may result from a failure to communicate relevant information.
This is why organizations should establish formal communication processes between departments involved in financial reporting.
13. Information and Communication Controls Matrix
The following table illustrates common controls associated with COSO Principles 13, 14, and 15.
Control objective | Example control | COSO principle |
Ensure report accuracy | Reconcile management reports to source records | 13 |
Ensure report completeness | Validate report populations and parameters | 13 |
Protect information integrity | Restrict unauthorized changes to reporting systems | 13 |
Communicate responsibilities | Provide documented policies and role-specific training | 14 |
Escalate control failures | Require timely reporting of significant exceptions | 14 |
Remove terminated-user access | Coordinate HR and IT termination notifications | 14 |
Report suspected misconduct | Maintain confidential reporting and escalation channels | 14 |
Validate vendor changes | Independently verify banking changes with vendors | 15 |
Support regulatory reporting | Review and approve external regulatory submissions | 15 |
Respond to external concerns | Track and resolve relevant customer and vendor complaints | 15 |
These are illustrative controls.
The appropriate design depends on the organization's objectives, risks, systems, and regulatory obligations.
14. How Internal Auditors Should Evaluate Information and Communication
Internal auditors should evaluate whether information and communication processes support the organization's control objectives.
An effective assessment should go beyond confirming that policies and reporting systems exist.
Evaluate Information Quality
Determine whether information used in key controls is complete, accurate, relevant, and timely.
Consider how information is generated, processed, maintained, and protected.
Evaluate Communication Responsibilities
Determine whether employees understand their responsibilities and whether important changes are communicated appropriately.
Evaluate Escalation Procedures
Determine whether significant exceptions and control failures are communicated to individuals with authority to address them.
Evaluate Cross-Functional Coordination
Determine whether information moves effectively between departments.
Evaluate External Communications
Determine whether communications with regulators, vendors, customers, and other external parties are controlled appropriately.
Evaluate Evidence of Operation
Inspect evidence demonstrating that communication processes actually operated.
For example, an auditor testing access termination controls may compare termination dates with IT notification records and access removal timestamps.
The objective is to determine whether the process operated effectively—not merely whether a written procedure exists.
15. Common Information and Communication Control Deficiencies
Deficiency 1: Reports Are Incomplete or Inaccurate
Management relies on reports without verifying the completeness or accuracy of the underlying information.
Potential consequence: Decisions and control activities may be based on incorrect information.
Deficiency 2: Employees Do Not Understand Control Responsibilities
Policies exist, but employees have not received adequate instructions or training.
Potential consequence: Controls may be performed inconsistently or incorrectly.
Deficiency 3: Significant Exceptions Are Not Escalated
Employees identify problems but do not report them to the appropriate management level.
Potential consequence: Control failures may continue without timely corrective action.
Deficiency 4: Departments Operate in Isolation
Critical information is not communicated between departments.
Potential consequence: Transactions may be processed incorrectly, access may remain
active, or financial information may be incomplete.
Deficiency 5: External Information Is Not Validated
The organization accepts vendor, customer, or third-party information without appropriate verification.
Potential consequence: Fraud, errors, or unauthorized changes may occur.
Deficiency 6: Management Reporting Is Untimely
Important reports are prepared too late to support effective monitoring or decision-making.
Potential consequence: Problems may remain unresolved until they become more
significant.
16. Using Artificial Intelligence to Improve Information and Communication Controls
Artificial intelligence can assist organizations in identifying information gaps, monitoring communication processes, and improving the distribution of relevant information.
Potential applications include:
Identifying missing or inconsistent data in management reports.
Summarizing significant control exceptions.
Monitoring overdue approvals and escalations.
Comparing policies with documented procedures.
Analyzing patterns in employee complaints.
Reviewing vendor communications for suspicious changes.
Identifying inconsistencies between departmental reports.
Supporting the preparation of management dashboards.
Example: AI-Assisted Exception Reporting
An organization processes thousands of vendor master file changes annually.
AI-assisted analytics may identify:
Unusual changes to vendor banking information.
Multiple vendors sharing the same bank account.
Changes occurring outside normal business hours.
Repeated changes involving the same employee.
Exceptions that were not resolved within required timeframes.
The results could be communicated to appropriate control owners for investigation.
However, AI-generated information must itself be evaluated for reliability.
Organizations should consider data completeness, accuracy, access controls, model limitations, confidentiality, and human review.
AI may improve the speed of information processing, but it does not eliminate management's responsibility for information quality and effective communication.
17. Information and Communication: Practical Audit Checklist
Auditors and management can use the following questions to evaluate this COSO component.
Assessment question | COSO principle |
Does management identify the information needed to support key controls? | 13 |
Are important reports complete and accurate? | 13 |
Are relevant information systems appropriately controlled? | 13 |
Is information available when control activities must be performed? | 13 |
Are internal control responsibilities clearly communicated? | 14 |
Do employees understand how to report control failures? | 14 |
Are significant issues escalated to appropriate personnel? | 14 |
Do departments exchange information needed for financial reporting? | 14 |
Are external communications appropriately authorized and reviewed? | 15 |
Are relevant external complaints and concerns evaluated? | 15 |
Are vendor changes independently verified when appropriate? | 15 |
Are regulatory reporting responsibilities clearly established? | 15 |
The checklist is a practical assessment tool, not a substitute for a complete COSO evaluation.
18. Final Thoughts: Internal Controls Depend on Information That People Can Trust
Information and Communication is sometimes treated as a supporting administrative function rather than a fundamental component of internal control.
That is a mistake.
An organization may design an effective approval control, but the control can fail when employees receive incomplete information.
Management may establish a comprehensive risk management program, but significant risks may remain unaddressed when information is not communicated to decision-makers.
An internal audit department may identify serious control deficiencies, but those deficiencies may persist when management does not receive, understand, or act on the findings.
COSO Principles 13, 14, and 15 establish the importance of reliable information and effective internal and external communication.
Together, these principles help organizations ensure that information reaches the people who need it, when they need it, in a form they can use.
For auditors, the essential questions are:
Is the information reliable?
Does it reach the appropriate people?
Do those people understand their responsibilities?
Is significant information acted upon?
These questions are central to evaluating whether internal controls are functioning effectively.
An organization cannot maintain an effective internal control system if important information is inaccurate, unavailable, misunderstood, or never communicated.
Authoritative References
About Corporate Compliance Seminars
Corporate Compliance Seminars (CCS) provides Continuing Professional Education (CPE) programs for internal auditors, external auditors, accounting professionals, compliance personnel, and information technology professionals.
Our programs address the COSO Internal Control—Integrated Framework, internal control assessments, SOX compliance, entity-level controls, risk management, information technology general controls, and practical applications of artificial intelligence in auditing.
Explore upcoming CPE events at www.compliance-seminars.com.
Comments