Information is necessary for the entity to carry out internal control responsibilities to support the achievement of its objectives. Management obtains or generates and uses relevant and quality information from both internal and external sources to support the functioning of internal control. Communication is the continual, iterative process of providing, sharing, and obtaining necessary information. Internal communication is the means by which information is disseminated throughout the organization, flowing up, down, and across the entity. It enables personnel to receive a clear message from senior management that control responsibilities must be taken seriously. External communication is twofold: it enables inbound communication of relevant external information and provides information to external parties in response to requirements and expectations.
1 Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal Control – Integrated Framework (Executive Summary, May 2013), pg. 5.
13. Generate and use relevant information
14. Communicate internally
15. Communicate externally