Requirement
The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
Points of Focus
Communicates Internal Control Information
Requirement: A process is in place to communicate required information to enable all personnel to understand and carry out their internal control responsibilities.
Communicates With the Board of Directors
Requirement: Communication exists between management and the board of directors so that both have information needed to fulfill their roles with respect to the entity’s objectives.
Provides Separate Communication Lines
Requirement: Separate communication channels, such as whistle-blower hotlines, are in place and serve as fail-safe mechanisms to enable anonymous or confidential communication when normal channels are inoperative or ineffective.
Selects Relevant Method of Communication
Requirement: The method of communication considers the timing, audience, and nature of the information.
Communicates Responsibilities
Requirement: Entity personnel with responsibility for designing, developing, implementing, operating, maintaining, or monitoring system controls receive communications about their responsibilities, including changes in their responsibilities, and have the information necessary to carry out those responsibilities.
Communicates Information on Reporting Failures, Incidents, Concerns, and Other Matters
Requirement: Entity personnel are provided with information on how to report systems failures, incidents, concerns, and other complaints.
Communicates Objectives and Changes to Objectives
Requirement: The entity communicates its objectives and changes to those objectives to personnel in a timely manner.
Communicates Information to Improve Security Knowledge and Awareness
Requirement: The entity communicates information to improve security knowledge and awareness and to model appropriate security behaviors to personnel through a security awareness training program.
[P] Communicates Information to Improve Privacy Knowledge and Awareness
Requirement: The entity communicates information to improve privacy knowledge and awareness and to model appropriate behaviors to personnel through a privacy awareness training program.
[P] Communicates Incident Reporting Methods
Requirement: The entity has communicated to employees and others within the entity the process used to report a suspected privacy incident.
[System] Communicates Information About System Operation and Boundaries
Requirement: The entity prepares and communicates information about the design and operation of the system and its boundaries to authorized personnel to enable them to understand their role in the system and the results of system operation.
[System] Communicates System Objectives
Requirement: The entity communicates its objectives to personnel to enable them to carry out their responsibilities.
[System] Communicates System Changes
Requirement: System changes that affect responsibilities or the achievement of the entity's objectives are communicated in a timely manner.
Explanation
Employees must be told, clearly and on time, what the organization's objectives are, what their own control and security responsibilities involve, and how to report failures, incidents, and concerns — including through anonymous channels such as whistle-blower hotlines. Auditors care because people cannot carry out responsibilities they were never informed of.
