Let’s Review the IIA’s Guidance on Communicating Audit Results

Key Takeaways

• Guide stresses stakeholder needs but misapplies risk‑based opinion.
• Standard 15.1 forces activity opinion, not risk focus.
• Effective communication requires timely, actionable findings for board.
• Prioritization methodology should be agreed with management early.
• Audit tool examples lack linkage to enterprise objective impact.

Summary

The Institute of Internal Auditors (IIA) released a new Global Practice Guide on communicating audit results, updating the 2009 guide. The author praises the emphasis on stakeholder needs but criticizes the guide’s requirement to conclude on governance, risk management, and control effectiveness for each activity, arguing it conflicts with risk‑based auditing. He also highlights vague “satisfactory” language, insufficient linkage of findings to enterprise objectives, and a need for more flexible, timely communication. Recommendations include focusing on reasonable assurance of significant risks and tailoring reports to stakeholder needs.

Pulse Analysis

Risk‑based internal auditing has become the benchmark for modern assurance functions, shifting the focus from blanket activity reviews to targeted risk assessments. The IIA’s new guide attempts to codify best‑practice communication, yet it retains language that obliges auditors to issue blanket conclusions on governance and control effectiveness. This creates tension with the principle that auditors should only opine on the specific risks they audit, potentially diluting the relevance of their findings and confusing stakeholders about the true risk landscape.

A recurring pain point highlighted by practitioners is the use of generic terms such as “satisfactory” or “needs improvement” without quantifying impact on enterprise objectives. Boards and senior executives require actionable intelligence—how a control weakness could affect financial performance, regulatory compliance, or strategic initiatives. By tying each finding to measurable risk exposure and expected outcomes, audit reports become decision‑enabling tools rather than compliance checklists. Moreover, aligning the prioritization framework with management’s risk appetite before report issuance fosters consistency and reduces surprise, strengthening the audit‑management partnership.

The guide’s recommendations for flexible reporting and in‑person communication echo broader governance trends emphasizing agility and stakeholder‑centricity. Tailoring report structure to the audience’s needs, eliminating redundant sections, and focusing on the assurance that significant risks are managed within tolerances can shorten remediation cycles and enhance risk visibility. Organizations that adopt these practices are better positioned to demonstrate proactive risk oversight, satisfy regulatory expectations, and ultimately protect shareholder value.