The word “communication” is mentioned 185 times in The IIA’s Global Internal Audit Standards™. “Communication is embedded throughout,” says Ann Cohen, IIA executive vice president and CFO, as well as an independent board member of Niagen Bioscience. “It’s woven across everything internal audit does.”
Cohen says internal audit’s impact depends as much on how well it communicates as on the work it performs. Effective communication translates directly into value, because it enables internal audit to offer information and insights that support successful governance and decision-making.
This report examines internal audit communication with the board and audit committee, describes obstructions that can prevent good interactions, and explores the role of artificial intelligence (AI) and the value of informal updates.
Ann Cohen
Building the Relationship
The IIA’s Global Internal Audit Standards require CAEs to determine how internal audit can foster relationships and trust with key stakeholders, including the board. Under Standard 11.1, Building Relationships and Communicating with Stakeholders, CAEs are expected to promote formal and informal communication to enable mutual understanding of:
- Organizational interests and concerns.
- Approaches for identifying and managing risks and providing assurance.
- Roles and responsibilities of relevant parties and opportunities for collaboration.
- Relevant regulatory requirements.
- Significant organizational processes, including financial reporting.
Communication: The Requirements
The updated Standards, which became effective last year, guide the worldwide professional practice of internal auditing and serve as a basis for evaluating and elevating the quality of the internal audit function. They set detailed requirements for effective communications that help not only to develop relationships and trust, but also to ensure stakeholders benefit from the results of internal audit services and auditors benefit from stakeholder insights.
Sarah Francis
Overall, communication should be effective, structured, and ongoing, notes Sarah Francis, global client service partner and managing director, EY Center for Board Matters. Because of internal audit’s independence, “the CAE’s ability to really effectively separate noise from signal is important,” she says.
The Standards set forth guidelines on core topics for discussion, including the internal audit plan, internal audit’s resources and budget, any significant revisions to the internal audit charter, and impairments to independence. The frequency of formal communication is aligned with the timing of formal board or audit committee meetings, usually at least quarterly, with additional communications in between as needed.
The frequency and content of communications may depend on the organization’s maturity. A high-paced new technology company, for example, may need discussions more often than a more stable organization that is facing a narrower range of emerging risks, says Fábio Pimpão, director, internal audit at Whirlpool Corp. and director, professional certifications and exam development, on The IIA’s Global Board of Directors.
Under the Standards’ Domain III, Principle 8, Overseen by the Board, board oversight of internal audit function effectiveness “requires collaborative and interactive communication between the board and the CAE as well as the board’s support in ensuring the internal audit function obtains sufficient resources to fulfill the internal audit mandate.”
Fabio Pimpao
The Standards establish communication responsibilities for CAEs and essential conditions for senior management and board members, underscoring the importance of effective conversations between internal auditors and key stakeholders. According to Domain III, while the CAE ensures standards are met, “activities of the board and senior management are essential to the internal audit function’s ability to fulfill the Purpose of Internal Auditing.”
The Value of Candid Communication
Cohen notes that communication with the board or audit committee should extend beyond audit reports to include executive sessions where the CAE can speak openly. Informal interactions are also important. In the Directorship article, “Five Things Directors Should Know When Working With the Internal Audit Function,” Anthony Pugliese, IIA president and CEO, notes, “an effective working relationship requires an open line of communication between the chair of the audit committee and the CAE between meetings as well.”
Access to the board without senior management present is incredibly important, Francis says. Without it, CAEs may not be able to offer the board the unfiltered information it needs. “When there are risks that may not be properly resolved by management, the Standards really highlight that it is critical to have clear escalation pathways,” she says. These meetings, which can take place before official board meetings or quarterly touchpoints, can also further deepen the trusted relationship between internal audit and board or audit committee members.
At the same time, internal audit should also be sure to engage in productive, ongoing communication with senior management and other stakeholders, according to Pimpão. The C-level needs to be prepared for what internal audit is going to tell the board or audit committee and aligned with internal audit’s thinking. “Independence doesn’t mean that you’re isolated,” he says. If internal audit approaches the audit committee with a significant concern without developing a clear action plan and priorities with other key stakeholders, “it puts everyone in a bad situation,” he adds.
What Can Hinder Effective Communication?
Certain situations can make it more difficult to ensure productive dialogue.
Lack of appropriate independence. Internal audit should report to the audit committee, with a dotted line to the C-level, Pimpão notes. If internal audit is instead functionally reporting to senior management, the CAE may not be able to have frank conversations with the audit committee or board. “Internal audit independence is critical to ensure there is unrestricted, unfiltered access to the board and audit committee,” Francis says.
Failure to establish mutual expectations. In interactions with the board or audit committee, each side should understand what the other can provide and what they need from each other, according to Cohen. “If these expectations are not clearly aligned and discussed, then it becomes very transactional, and the value gets lost.”
Lack of support. It may be difficult to deliver valuable insights and ideas if the board perceives internal audit as a check-the-box requirement rather than a strategic partner, Cohen says. The board must be fully engaged in its relationship with internal audit and able to understand and, as necessary, dig deeper into the insights the CAE provides. It should also take an ongoing interest in any necessary enhancements to the internal audit team’s expertise or other resources needed to fulfill the audit mandate, Pimpão adds.
Leveraging Technology to Enhance the Dialogue
Internal auditors are using AI to maximize the value of the information they communicate. AI and automation allow internal auditors to synthesize large volumes of data and highlight key concerns.
Predictive analytics can be leveraged to identify evolving risks and provide actionable insights, Francis says. Agentic AI can be put to work in controls testing and fieldwork. AI and automation also can enable teams to develop the audit plan faster, Pimpão notes.
In addition to enhancing internal audit’s work, technology can enable internal auditors to provide board members with more timely information. Real-time dashboards make it possible to highlight emerging risk and control issues as they develop, rather than only after a reporting cycle, Cohen says. “You’re starting to be able to look more holistically, not only at the risk, but at both opportunities and mitigations.”
ERM: An Advisory Opportunity?
Some conversations with the board or audit committee will involve opportunities for internal audit to take on a greater advisory role. In thinking of new and innovative ways to do so, Pimpão suggests supporting enterprise risk management (ERM) as one possibility.
While internal audit does not own this process, it can certainly challenge senior management’s efforts in this area and provide value by verifying risk and the appropriateness of the organization’s risk appetite, he says.
Enhanced Enterprise Risk Management and Strategic Decision-Making, a publication from Baker Tilly and the Internal Audit Foundation, discusses coordinated efforts and communication with internal audit on ERM. A survey of professionals suggests two primary ways in which internal audit could preserve its independence and become involved in ERM:
- Clearly defined reporting structures can establish reporting lines and authority within the organization.
- Independently delineated functions, meaning distinct roles and responsibilities are clearly defined and focus on the individual’s or department’s responsibilities.
“ERM value is enhanced when all risk players, including internal audit, play active roles,” according to the report.
Showcasing the Value
Unlocking and showcasing the value of the internal audit function is an exciting prospect, Francis says. Effective communication can not only deliver decision-relevant insights, but also foster better relationships that enhance the productiveness of the important discussions between internal audit and the board.
Disclaimer
The IIA publishes this document for informational and educational purposes only. This material is not intended to provide definitive answers to specific individual circumstances and as such is only intended to be used as peer-informed thought leadership. It is not formal IIA Guidance. The IIA recommends seeking independent expert advice relating directly to any specific situation. The IIA accepts no responsibility for anyone placing sole reliance on this material.
Learn more with our other resources
Communicating with the Board: Turning Audit Insights into Impact
Notice of annual membership meeting
March 24, 2026