16.4 Closing Communications, Distribution & Reporting Resolved Findings
Key Takeaways
- The closing communication (exit conference) validates factual accuracy, confirms management action plans, and surfaces disagreements before the final engagement communication is issued, not after.
- Under Standard 15.1, the chief audit executive is responsible for distributing the final engagement communication to the appropriate parties and for reporting results to stakeholders.
- A finding that management resolved before report issuance is still reported when the condition was significant during the audit period; internal audit validates the remediation and states that it was verified as complete.
- Each stakeholder audience receives the results for a different purpose: operational management to act, senior management to allocate resources, and the board to discharge governance oversight.
- Standard 11.4 requires the chief audit executive to communicate corrected information to every party who received the original communication when a significant error or omission is later discovered.
16.4 Closing Communications, Distribution & Reporting Resolved Findings
[!NOTE] Professional Standards Foundation: Under the Global Internal Audit Standards (GIAS), Domain V (Performing Internal Audit Services), Principle 15 (Communicate Engagement Results and Monitor Action Plans), and Standard 15.1 (Final Engagement Communication), the chief audit executive (CAE) is responsible for the release and distribution of engagement results. Standard 11.4 (Errors and Omissions) governs post-issuance corrections.
The closing communication is the last controlled opportunity to correct a factual error before an audit report acquires an institutional life of its own. Once distributed, a report is quoted in board minutes, cited by regulators, and relied on by external auditors. Part 3 tests whether candidates understand the sequence, the participants, and the CAE's non-delegable distribution duties.
The Closing Communication (Exit Conference)
Purpose
The exit conference is a structured, pre-issuance meeting between the engagement team and the management of the activity under review. Its objectives are to:
- Validate factual accuracy — confirm that conditions, quantities, dates, and system references are correct.
- Confirm the significance rating — ensure management understands how each finding was rated and why.
- Secure management action plans — obtain named owners and committed target dates.
- Surface disagreements early — identify unresolved disputes so they can be escalated or documented before issuance rather than after.
- Eliminate surprises — no finding should reach the audit committee that management is seeing for the first time.
Participants
| Party | Role at the Closing Communication |
|---|---|
| Engagement lead / auditor-in-charge | Presents conditions, criteria, cause, and effect; defends the evidentiary basis |
| Management of the activity under review | Confirms factual accuracy; commits to action plans and owners |
| Internal audit management / CAE | Attends when findings are severe, contested, or systemic |
| Senior management | Attends when findings cross business units or involve significant residual risk |
| Subject-matter specialists | Attend where technical conclusions require corroboration |
[!IMPORTANT] The exit conference does not require management agreement. Internal audit does not need management's consent to issue a finding. Where a factual dispute is genuine, it is resolved against the evidence; where a judgment dispute persists, the CAE issues the report and documents management's position alongside the finding.
Distribution: The CAE's Responsibility
Under Standard 15.1, the CAE — not the engagement lead — is accountable for determining who receives the final communication and for reporting results to stakeholders. Distribution is a risk decision, not clerical routing:
- Sufficiency: every party who needs the information to act, oversee, or rely must receive it.
- Restraint: reports contain sensitive information; distribution beyond those with a legitimate need can breach confidentiality obligations under Principle 5.
- Regulatory and legal constraints: some jurisdictions and contracts compel or restrict disclosure to specific parties.
Audience-Specific Reporting Purposes
| Recipient | Purpose of the Communication |
|---|---|
| Management of the activity under review | Execute corrective action; owns the action plan |
| Senior management | Allocate resources, resolve cross-functional causes, accept or reject residual risk |
| The board / audit committee | Discharge governance oversight; evaluate whether risk is managed within appetite |
| Risk management function | Update the enterprise risk register with validated control performance data |
| External auditors | Support coordination and potential reliance on internal audit work |
| Regulators | Provide evidence of control monitoring, where required by law or supervisory expectation |
| The general public | Only where a statutory transparency regime (common in public-sector bodies) mandates publication |
Reporting a Finding Management Has Already Resolved
This is a discrete blueprint topic and a reliable exam discriminator. A control failure is discovered during fieldwork; by the time the report is drafted, management has already fixed it. Should the finding be reported?
Yes — when the condition was significant during the audit period. The reasoning is governance, not bookkeeping:
- The control failure actually occurred. Remediation changes the current state; it does not erase the exposure the organization carried, sometimes for years.
- The root cause may survive the fix. A quick correction often addresses the symptom while the systemic cause — inadequate supervision, a broken change process, unclear ownership — remains live elsewhere.
- The board needs an accurate risk picture. Suppressing resolved findings systematically understates how often controls fail and inflates apparent control health.
- Prompt remediation deserves acknowledgment. Reporting it is not punitive; the constructive communication attribute is satisfied by crediting management's responsiveness.
The Protocol
- Report the condition as it existed during the audit period, with its criteria, cause, and effect.
- Validate the remediation through independent testing. Internal audit does not accept an assertion that the fix works — it verifies it.
- State the verified status explicitly — for example, "management implemented the reconciliation control on 14 August 2026; internal audit tested the redesigned control and confirmed it operating effectively."
- Close the item at issuance where validation is complete, so it does not enter the follow-up tracking population.
- Do not downgrade the significance rating merely because the fix arrived early; the rating reflects the risk the condition created.
[!WARNING] Exam trap: Answer options that instruct the auditor to omit the finding because management corrected it are incorrect. Equally incorrect are options that require the finding to remain open in the follow-up population after internal audit has independently validated the remediation.
Correcting Significant Errors and Omissions After Issuance
Standard 11.4 (Errors and Omissions) governs the situation where a material defect is discovered after distribution. The CAE must:
- Determine whether the error or omission is significant — that is, whether it changes a finding, a conclusion, a rating, or a decision a reasonable recipient would make.
- Correct the information and issue the corrected communication.
- Communicate the correction to every party who received the original, without exception — narrowing the corrected distribution list is itself a breach.
- Record the event in the quality assurance and improvement program so the drafting or review weakness that produced it is addressed.
Immaterial defects — a typographical error in an appendix, a formatting inconsistency — are corrected in the archived file and logged, without reissuance.
Sequence Discipline
Part 3 scenarios frequently scramble the order of operations. The defensible sequence is:
Fieldwork complete → draft findings validated with process owners → closing communication (exit conference) → management action plans obtained → CAE review and approval → distribution per the CAE's determination → follow-up tracking begins → post-issuance corrections under Standard 11.4 if needed.
Options that place board escalation before management discussion, or distribution before CAE approval, violate this sequence.
During fieldwork, internal audit identifies that privileged database accounts for terminated employees remained active for an average of 94 days over the past two years. Before the report is drafted, management removes all dormant accounts and implements an automated deprovisioning job. Internal audit tests the new job and confirms it operates effectively. How should the final engagement communication treat this matter?
Three weeks after a final engagement communication was distributed to operational management, the chief financial officer, the audit committee, and the external auditors, the chief audit executive discovers that a finding misattributed a control failure to the wrong subsidiary, changing the conclusion for both entities. What is the required action?
At the closing communication for an engagement over procurement, the business unit director refuses to accept a finding on split purchase orders, asserting that the practice is an approved efficiency measure. The engagement team has documentary evidence that no such approval exists. What is the appropriate course of action?