Requirement
The entity communicates with external parties regarding matters affecting the functioning of internal control.
Points of Focus
Communicates to External Parties
Requirement: Processes are in place to communicate relevant and timely information to external parties, including shareholders, partners, owners, regulators, customers, financial analysts, and other external parties.
Enables Inbound Communications
Requirement: Open communication channels allow input from customers, consumers, suppliers, external auditors, regulators, financial analysts, and others, providing management and the board of directors with relevant information.
Communicates With the Board of Directors
Requirement: Relevant information resulting from assessments conducted by external parties is communicated to the board of directors.
Provides Separate Communication Lines
Requirement: Separate communication channels, such as whistle-blower hotlines, are in place and serve as fail-safe mechanisms to enable anonymous or confidential communication when normal channels are inoperative or ineffective.
Selects Relevant Method of Communication
Requirement: The method of communication considers the timing, audience, and nature of the communication and legal, regulatory, and fiduciary requirements and expectations.
[C] Communicates Objectives Related to Confidentiality and Changes to Those Objectives
Requirement: The entity communicates, to external users, vendors, business partners, and others whose products or services, or both, are part of the system, the entity’s objectives related to confidentiality and the protection of confidential information, as well as changes to those objectives.
[P] Communicates Objectives Related to Privacy and Changes to Those Objectives
Requirement: The entity communicates, to external users, vendors, business partners, and others whose products or services, or both, are part of the system, the entity’s objectives related to privacy and the protection of personal information, as well as changes to those objectives.
[P] Communicates Incident Reporting Methods
Requirement: The entity communicates to user entities, third parties, data subjects, and others the process used to report a suspected privacy incident.
[System] Communicates Information About System Operation and Boundaries
Requirement: The entity prepares and communicates information about the design and operation of the system and its boundaries to authorized external users to permit users to understand their role in the system and the results of system operation.
[System] Communicates System Objectives
Requirement: The entity communicates its system objectives to appropriate external users.
[System] Communicates System Responsibilities
Requirement: External users with responsibility for designing, developing, implementing, operating, maintaining, and monitoring system controls receive information about such responsibilities and have the information necessary to carry out such responsibilities.
[System] Communicates Information on Reporting System Failures, Incidents, Concerns, and Other Matters
Requirement: External users are provided with information on how to report systems failures, incidents, concerns, and other complaints to appropriate entity personnel.
Explanation
The organization must exchange relevant information with outsiders — customers, vendors, regulators, and external users — covering system boundaries, objectives, changes, and how to report problems or suspected incidents. Auditors care because customers and partners rely on these communications to use the system safely and to fulfill their own responsibilities.
