18.3 Selecting Appropriate Stakeholders for Engagement Communication

Who hears the message is as testable as what you say

C2c asks you to determine appropriate stakeholders for engagement communication. Method (Section 18.1) and escalation (Section 18.2) fail if the right words go to the wrong inbox. GIAS Standard 13.1 centers ongoing communication with management of the activity under review. The CAE is responsible for disseminating final engagement communications to appropriate parties — board, senior management, and those who will own action plans (Standard 15.1). Part 2 still requires you, during the job, to know who must hear a kickoff, a status slip, a scope limitation, a draft observation, or a suspected illegal act.

Use three screens on every message:

Role. What decision or confirmation do you need from this person? Need-to-know. Does this person need the information to do their job or to discharge a governance duty, or are they being copied for politics and CYA? Confidentiality. Could this content harm an investigation, a person, or the organization if it travels? When the three screens conflict, confidentiality and need-to-know win over convenience.

The stakeholder map

Process owner (management of the activity under review). Default audience for initial communication of objectives, scope, and timing; for status; for most fact confirmation; and for the closing meeting. They can correct errors, explain compensating controls, and start fixing issues while you are still in the field. They are not the first audience when they appear implicated in fraud or an illegal act, and they are not a substitute for telling your supervisor about an impairment.

Senior management. In-flight communication goes here when the issue exceeds the process owner’s span of control, when the owner is the problem, or when residual risk or a limitation will matter at an enterprise level. You still go through the engagement supervisor and CAE rather than cold-emailing the COO with a draft finding. Senior management is also who the CAE will often brief when access is refused at the activity level.

CAE. Must hear scope limitations, access refusals, suspected fraud or illegal acts, residual risk that may be unacceptable, independence impairments, and any disagreement that the supervisor cannot unstick. The CAE is not a weekly status distribution list for routine open items, but the CAE must never be the last person to learn of a red flag. Staff auditors brief the CAE through supervision unless the supervisor is implicated.

Legal and compliance. Enter when the content is a suspected illegal act, a likely regulatory notification, attorney-client or investigation privilege, sanctions, privacy law, or a need to preserve evidence. They are not a dumping ground for every control exception. Copying legal on a routine duplicate-payment draft does not make the communication more “complete.” Omitting legal when you have a bribery red flag does not make the communication more “constructive.”

Board (usually the audit committee). The board is not an in-flight fact-checking audience. Draft observations do not go to the board so the team can “be transparent.” The board must hear what the CAE determines it must hear: significant impairments to independence or to the engagement (including a serious scope limitation), suspected fraud involving senior management, and residual risk the CAE believes may be unacceptable. Those board communications are largely Part 3 / Domain III and Standard 11.5 territory in their finished form. On Part 2, the testable move is: get the issue to the CAE with the right confidentiality, and do not bypass the CAE with a staff briefing to directors.

Need-to-know and confidentiality

Need-to-know is narrower than “people who would find this interesting.” A draft observation that user-access reviews in finance are weak belongs to the finance process owner (and your supervisor). It does not belong on the all-staff list, the IT newsletter, or a shared drive open to the business unit’s 200 employees. Broadcasting a draft:

• violates confidentiality and can defame if facts are still in motion,
• can tip a person who should not be warned,
• creates unofficial “final” copies that outrun the CAE’s issuance, and
• confuses fact-checking with public reporting.

Trap the exam loves: copying the whole company — or the whole activity — on a draft finding “for transparency” or “so the closing meeting has no surprises.” Transparency is achieved by the right people hearing timely, accurate information, not by maximizing the CC line. Constructive communication (Standard 11.2) is helpful to the engagement client; it is not a press release.

Consulting engagements can have a tighter client-defined audience than assurance engagements, but need-to-know still applies. Significant governance, risk, or control issues identified on a consulting job that matter to the organization still have to reach the people GIAS requires — including senior management and the board when significance warrants — through the CAE’s methodology. That is not a license for the staff auditor to freelance a company-wide note.

External parties (regulators, external auditors, customers) are almost never the staff auditor’s in-flight audience. If a regulator must be notified, legal and the CAE own the channel. If external auditors need a scope limitation or a fraud indicator, the CAE coordinates. Do not “cc the partner” on a draft observation to be helpful.

Who must hear a scope limitation

A scope limitation is a restriction that keeps the engagement from achieving its objectives as planned: denied records, excluded locations, unavailable key people, or a management-imposed cut to related-party testing. Standard 13.1 requires timely communication of changes to management of the activity. That is necessary but not sufficient.

Minimum in-flight audience for a scope limitation: the process owner (unless implicated or the one imposing a bad-faith cut), the engagement supervisor, and the CAE. Senior management hears it when they imposed it or must remove it. The board hears it when the limitation impairs independence or the engagement — for example senior management forbids testing of related-party transactions that were in the approved plan, or access remains blocked after the CAE has escalated inside management. A clerk who pulls samples is not an adequate audience. A company-wide draft-finding email is the wrong audience.

Write the limitation down: what was requested, what was refused, which objectives are affected, and who was told. Oral-only notice of a material limitation fails the evidence filter in Section 18.1 and leaves the CAE unable to brief anyone accurately.

Worked scenarios

Ordinary draft. Weak quarterly user-access reviews in finance. Send a tight draft to the finance process owner and copy the engagement supervisor. Do not copy all finance staff, HR, or the board. Ask the owner to confirm dates, system names, and compensating detective controls. That is stakeholder selection plus accurate, timely communication.

Imposed limitation. Senior management says related-party transactions are “out of scope for this quarter.” Tell the owner what you can still cover, and take the limitation to the supervisor and CAE the same day. Do not honor the cut quietly and hope the final communication can stay silent. Do not email the company that “management blocked related-party testing.”

Illegal act with the owner in the picture. Expense-report patterns suggest the process owner approved personal charges as business. Stakeholders are the supervisor, CAE, and legal/compliance per protocol — not the owner, not the owner’s department, not the intern study group, and not the board by a staff side-channel. The CAE and legal decide if and when directors are informed.

If you remember only one C2c discriminator: draft findings travel to the people who own the facts or the investigation; they do not travel to everyone who might have an opinion.