Requirement
The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.
Points of Focus
Assesses Results
Requirement: Management and the board of directors, as appropriate, assess results of ongoing and separate evaluations.
Communicates Deficiencies
Requirement: Deficiencies are communicated to parties responsible for taking corrective action and to senior management and the board of directors, as appropriate.
Monitors Corrective Action
Requirement: Management tracks whether deficiencies are remedied on a timely basis.
Explanation
When monitoring uncovers a control weakness, the finding must reach the people who can fix it — including senior management and the board when serious — and remediation must be tracked to completion. Auditors care because unreported or unresolved deficiencies mean the whole internal control system cannot be trusted.
