ISO 19011:2018 Clause 6.4.4 Communicating during audit

During the audit, it may be necessary to make formal arrangements for communication within the audit team, as well as with the auditee, the audit client and potentially with external interested parties (e.g. regulators), especially where statutory and regulatory requirements require mandatory reporting of nonconformities. The audit team should confer periodically to exchange information, assess audit progress and reassign work between the audit team members, as needed.
During the audit, the audit team leader should periodically communicate the progress, any significant findings and any concerns to the auditee and audit client, as appropriate. Evidence collected during the audit that suggests an immediate and significant risk should be reported without delay to the auditee and, as appropriate, to the audit client. Any concern about an issue outside the audit scope should be noted and reported to the audit team leader, for possible communication to the audit client and auditee.
Where the available audit evidence indicates that the audit objectives are unattainable, the audit team leader should report the reasons to the audit client and the auditee to determine appropriate action.
Such action may include changes to audit planning, the audit objectives or audit scope, or termination of the audit.
Any need for changes to the audit plan which may become apparent as auditing activities progress should be reviewed and accepted, as appropriate, by both the individual(s) managing the audit programme and the audit client, and presented to the auditee.

During the audit, it may be necessary to make formal arrangements for communication within the audit team, as well as with the auditee, the audit client and potentially with external interested parties (e.g. regulators), especially where statutory and regulatory requirements require mandatory reporting of nonconformities. Formal arrangements for communication within the audit team and with various stakeholders, including the auditee, audit client, and external interested parties, are critical during the audit process. This ensures effective information exchange, compliance with regulatory reporting requirements, and overall success of the audit. Here are key considerations:

1. Internal Communication within the Audit Team: Establish clear communication channels within the audit team. Define how information will be shared, the frequency of team meetings, and the protocol for documenting and disseminating audit-related information among team members.
2. Communication with the Auditee: Define formal channels for communication between the audit team and the auditee. Specify the points of contact, preferred communication methods, and the process for addressing questions, concerns, or providing clarification during the audit.
3. Communication with the Audit Client: If the audit is conducted on behalf of a client, establish formal communication channels with the audit client. Discuss reporting expectations, key contacts, and the process for sharing interim updates or addressing client-specific requirements.
4. Communication with External Interested Parties (Regulators, etc.): Identify external interested parties, such as regulators, and establish formal communication channels with them. Understand any statutory or regulatory requirements for reporting nonconformities or other relevant information. Ensure that the audit process aligns with these reporting obligations.
5. Mandatory Reporting of Nonconformities: If statutory and regulatory requirements mandate the reporting of nonconformities, define the procedures for such reporting. Ensure that the audit team is aware of the specific reporting criteria, timelines, and the information that needs to be communicated to the relevant authorities.
6. Documentation Protocols: Establish formal protocols for documenting audit findings, nonconformities, and other relevant information. This includes the format for audit reports, the level of detail required, and the process for obtaining approval before finalizing and disseminating reports.
7. Secure and Confidential Communication: Emphasize the importance of secure and confidential communication, especially when dealing with sensitive information or nonconformities that require discretion. Ensure that communication methods comply with data protection and confidentiality requirements.
8. Feedback Mechanisms: Create mechanisms for feedback from the auditee, audit client, and other stakeholders. This could include formal channels for responding to inquiries, addressing concerns, and receiving input on audit processes and findings.
9. Continuous Communication Updates: Regularly update stakeholders, including the auditee, on the progress of the audit. This helps manage expectations, provides opportunities for clarification, and promotes a collaborative approach.
10. Post-Audit Reporting Requirements: Clarify any post-audit reporting requirements with the auditee, audit client, and external interested parties. Ensure that there is a shared understanding of what information will be provided after the audit is completed.

By formalizing these communication arrangements, the audit team can ensure that information flows efficiently, stakeholders are well-informed, and the audit process aligns with statutory, regulatory, and contractual obligations. This proactive approach contributes to the credibility and effectiveness of the audit process.

The audit team should confer periodically to exchange information, assess audit progress and reassign work between the audit team members, as needed. Regular conferencing within the audit team is a best practice in audit management. Periodic team meetings play a crucial role in promoting effective communication, assessing audit progress, and ensuring that the audit team is working collaboratively toward achieving the audit objectives. Here are key reasons and considerations for periodic team conferencing:

1. Information Exchange: Team meetings provide a forum for audit team members to share information, insights, and updates. This helps ensure that everyone is on the same page regarding audit progress, findings, and any challenges encountered.
2. Assessment of Audit Progress: Regular team meetings allow for the assessment of audit progress against the planned schedule and objectives. This assessment helps identify any areas that may require additional attention, resources, or adjustments to the audit plan.
3. Reassignment of Work: Periodic team conferences enable the team to assess individual workloads and redistribute tasks as needed. This flexibility ensures that team members are efficiently using their skills and expertise to address different aspects of the audit.
4. Problem-Solving and Decision-Making: Team meetings provide a platform for collaborative problem-solving and decision-making. If challenges or uncertainties arise during the audit, the team can collectively discuss and formulate solutions.
5. Alignment with Audit Objectives: Regular conferences help ensure that all team members are aligned with the overall audit objectives. It allows for a collective understanding of the purpose of the audit and the specific goals that need to be achieved.
6. Review of Findings: Team meetings are an opportunity to review and discuss audit findings. This collective review ensures that findings are thoroughly examined, understood, and properly documented before being communicated to the auditee.
7. Quality Assurance: Conferencing within the team supports quality assurance by providing a mechanism for peer review. Team members can share their perspectives, validate each other’s work, and ensure that the audit process is rigorous and accurate.
8. Communication of Changes: If there are changes to the audit plan, scope, or other elements, team meetings serve as a means to communicate these changes effectively. This helps maintain transparency and ensures that all team members are informed of any adjustments.
9. Enhanced Collaboration: Regular interaction fosters a collaborative team culture. It allows team members to build stronger working relationships, share expertise, and leverage the collective knowledge and skills of the team.
10. Monitoring and Adapting to Emerging Issues: Team meetings provide a platform for monitoring emerging issues and adapting the audit approach as needed. This adaptability is crucial in addressing unforeseen challenges and ensuring that the audit remains on track.

In summary, periodic team conferencing is integral to the success of an audit. It facilitates efficient communication, supports teamwork, and ensures that the audit team is well-coordinated and responsive to the evolving needs of the audit process.

During the audit, the audit team leader should periodically communicate the progress, any significant findings and any concerns to the auditee and audit client, as appropriate. Regular communication with the auditee and audit client is a fundamental aspect of effective audit management. Periodic updates, especially regarding progress, significant findings, and any concerns, contribute to transparency, collaboration, and the overall success of the audit. Here are key reasons and considerations for periodic communication with the auditee and audit client:

1. Transparency and Open Communication: Regular updates foster transparency between the audit team and the auditee. Open communication builds trust and helps manage expectations throughout the audit process.
2. Real-Time Progress Reporting: Providing periodic updates allows the auditee and audit client to stay informed about the progress of the audit in real time. This enables them to anticipate and address any issues promptly.
3. Timely Identification of Concerns: Communicating any concerns as they arise ensures that they are identified and addressed in a timely manner. Early awareness of challenges allows for proactive problem-solving and mitigates potential disruptions to the audit process.
4. Confirmation of Significant Findings: Significant findings, whether positive or negative, should be communicated promptly to the auditee and audit client. This confirmation helps maintain a shared understanding of the audit outcomes and promotes accountability.
5. Opportunity for Clarification: Periodic communication provides an opportunity for the auditee to seek clarification on any aspects of the audit process, findings, or expectations. This helps avoid misunderstandings and ensures a clear understanding of the audit status.
6. Collaborative Problem-Solving: In the spirit of collaboration, the audit team leader can work with the auditee and audit client to address any challenges or roadblocks. This collaborative approach enhances the effectiveness of the audit process.
7. Feedback and Input: Periodic communication creates a platform for receiving feedback and input from the auditee and audit client. This feedback loop contributes to continuous improvement and ensures that the audit is responsive to the needs and expectations of stakeholders.
8. Adaptation to Changing Circumstances: If there are changes to the audit plan or unforeseen circumstances, keeping the auditee and audit client informed allows for adaptation. Flexibility in the audit process is essential for addressing evolving situations.
9. Effective Stakeholder Management: Regular updates contribute to effective stakeholder management. By keeping the auditee and audit client informed, the audit team leader demonstrates professionalism and ensures that the audit process aligns with stakeholder expectations.
10. Enhanced Relationship Building: Establishing a communication rhythm helps build stronger relationships between the audit team, auditee, and audit client. Positive communication experiences contribute to a collaborative and constructive working environment.

In summary, periodic communication with the auditee and audit client is a proactive and essential practice in audit management. It supports the principles of transparency, collaboration, and responsiveness, contributing to the successful completion of the audit and the achievement of its objectives.

Evidence collected during the audit that suggests an immediate and significant risk should be reported without delay to the auditee and, as appropriate, to the audit client. The reporting of immediate and significant risks identified during an audit is a critical aspect of audit management. Timely communication of such risks is essential to ensure that the auditee and audit client are promptly informed, allowing for swift action to address the identified issues. Here are key considerations:

1. Definition of Immediate and Significant Risks: Clearly define what constitutes immediate and significant risks in the context of the audit. This definition should align with the objectives and criteria of the audit and may include risks that pose a serious threat to safety, compliance, or the overall well-being of the audited organization.
2. Prompt Reporting: Report identified immediate and significant risks without delay. This prompt reporting ensures that the auditee and audit client are aware of potential threats that require urgent attention.
3. Clear Communication: Clearly communicate the nature of the identified risks, providing sufficient detail for the auditee and audit client to understand the severity and potential impact. Use concise and unambiguous language to convey the urgency of the situation.
4. Direct Communication Channels: Utilize direct communication channels to report immediate and significant risks. This may involve direct communication with key individuals within the auditee organization and, if applicable, with the audit client.
5. Documentation of Findings: Document the identified risks thoroughly, including the evidence collected and any supporting documentation. This documentation serves as a basis for the report to the auditee and audit client and provides a clear record of the audit findings.
6. Inclusion in Interim Updates: If interim updates are part of the audit communication plan, ensure that immediate and significant risks are included in these updates. This allows for ongoing awareness and collaboration in addressing the identified risks.
7. Collaborative Problem-Solving: Engage in collaborative problem-solving with the auditee and audit client to address the identified risks. This may involve discussions on corrective actions, preventive measures, and any necessary adjustments to the audit plan.
8. Escalation Procedures: Establish clear escalation procedures for immediate and significant risks. Define the steps that will be taken if the risks are not promptly addressed or if there is a need for further intervention beyond the audit team’s scope.
9. Follow-Up Communication: Provide follow-up communication to confirm the resolution of immediate and significant risks. This ensures that the auditee and audit client are informed of the actions taken and the effectiveness of those actions in mitigating the identified risks.
10. Adherence to Ethical Standards: Uphold ethical standards in reporting immediate and significant risks. Ensure that the information is accurate, objective, and presented in a manner that prioritizes the well-being and interests of the auditee.

By promptly reporting immediate and significant risks, the audit team contributes to a proactive and collaborative approach to risk management. This ensures that the auditee and audit client can take swift action to address critical issues and mitigate potential harm or negative impact on the audited organization.

Any concern about an issue outside the audit scope should be noted and reported to the audit team leader, for possible communication to the audit client and auditee. Noting and reporting any concerns about issues outside the audit scope is a responsible and prudent practice in audit management. Issues beyond the agreed-upon audit scope can have implications for the overall audit process, and addressing these concerns in a timely manner is crucial. Here are key considerations:

1. Identification of Concerns: Be vigilant in identifying any concerns related to issues that fall outside the agreed-upon audit scope. These concerns may include potential risks, significant findings, or emerging issues that warrant attention.
2. Documentation of Concerns: Thoroughly document any concerns, providing clear details on the nature of the issue, its potential impact, and the reasons it is considered outside the audit scope. This documentation serves as a basis for communication to the audit team leader.
3. Communication to the Audit Team Leader: Report identified concerns promptly to the audit team leader. The team leader plays a central role in coordinating the audit process and is responsible for addressing issues that may impact the audit scope or objectives.
4. Assessment of Relevance and Significance: The audit team leader, upon receiving the concerns, should assess their relevance and significance. This assessment helps determine the appropriate course of action, including whether communication to the audit client and auditee is necessary.
5. Decision on Communication: Based on the assessment, the audit team leader decides whether to communicate the concerns to the audit client and auditee. This decision may depend on factors such as the severity of the issue, its potential impact on the audit, and the need for immediate attention.
6. Inclusion in Audit Reports or Updates: If the concerns are deemed significant and relevant to the audit process, they may be included in audit reports or updates. This provides transparency to the audit client and auditee and ensures that all stakeholders are informed of issues that could impact the audit outcome.
7. Collaborative Approach: Adopt a collaborative approach when communicating concerns outside the audit scope. Engage in open dialogue with the audit client and auditee to discuss the issues, potential implications, and any recommended actions to address the concerns.
8. Documentation of Actions Taken: Document any actions taken to address the concerns, including communication with the audit client and auditee. This documentation is valuable for maintaining an audit trail, demonstrating due diligence, and ensuring accountability.
9. Ethical Considerations: Adhere to ethical standards throughout the process. Ensure that communication is accurate, objective, and prioritizes the interests of all stakeholders involved.

By proactively noting and reporting concerns about issues outside the audit scope, the audit team contributes to a comprehensive and transparent audit process. It also allows for the identification and resolution of issues that could impact the integrity and effectiveness of the audit.

Where the available audit evidence indicates that the audit objectives are unattainable, the audit team leader should report the reasons to the audit client and the auditee to determine appropriate action. When the available audit evidence suggests that the audit objectives are unattainable, it is crucial for the audit team leader to report the reasons for this situation to the audit client and the auditee. Clear and timely communication is essential in such cases to determine appropriate actions and make informed decisions. Here are key considerations:

1. Timely Reporting: Report the unattainability of audit objectives as soon as it becomes evident. Timely reporting allows for prompt action and prevents unnecessary delays in the audit process.
2. Clear Explanation of Reasons: Provide a clear and detailed explanation of the reasons why the audit objectives are deemed unattainable. This may include challenges related to data availability, access to information, or unforeseen circumstances that impact the audit process.
3. Documentation of Evidence: Document the audit evidence that led to the conclusion that objectives are unattainable. This documentation ensures transparency and provides a basis for discussions with the audit client and auditee.
4. Engagement with Audit Client and Auditee: Engage in open and constructive dialogue with the audit client and auditee. Discuss the challenges faced, present the evidence, and seek their input on potential solutions or adjustments to the audit plan.
5. Collaborative Problem-Solving: Work collaboratively with the audit client and auditee to explore possible solutions. This may involve adjusting the audit scope, revising objectives, or identifying alternative approaches to achieve the desired audit outcomes.
6. Identification of Mitigation Measures: Collaboratively identify mitigation measures to address the challenges encountered. This could include developing alternative audit procedures, extending the audit timeline, or obtaining additional resources to overcome obstacles.
7. Consideration of Impact on Audit Conclusions: Assess the potential impact of the unattainable objectives on the overall audit conclusions. Determine whether adjustments to the audit report or other documentation are necessary to accurately reflect the audit findings and limitations.
8. Communication of Revised Objectives or Scope: If appropriate, communicate any revised audit objectives or changes to the audit scope to the audit client and auditee. Ensure that there is a shared understanding of the modified expectations and outcomes.
9. Documentation of Agreed-Upon Actions: Document any agreed-upon actions or decisions resulting from discussions with the audit client and auditee. This documentation serves as a record of the collaborative efforts to address challenges and adjust the audit approach.
10. Compliance with Professional Standards: Ensure that all actions taken and decisions made align with professional audit standards and ethical considerations. Uphold the principles of integrity, objectivity, and accountability throughout the process.

By openly communicating the challenges and collaborating with the audit client and auditee to address unattainable objectives, the audit team leader contributes to a transparent and constructive audit process. This approach helps maintain the credibility of the audit and ensures that all stakeholders are informed and involved in decision-making.

Such action may include changes to audit planning, the audit objectives or audit scope, or termination of the audit. When the available audit evidence indicates that the audit objectives are unattainable, the audit team leader, in collaboration with the audit client and auditee, may need to consider various actions, including changes to audit planning, audit objectives, or audit scope. Additionally, in extreme cases, termination of the audit might be necessary. Here are considerations for each potential action:

1. Changes to Audit Planning: Assess the feasibility of making adjustments to the audit plan to address challenges. This may involve revising the timeline, reallocating resources, or modifying specific audit procedures to better align with the available information and resources.
2. Revised Audit Objectives: Collaboratively reassess and redefine audit objectives, taking into account the limitations or challenges encountered. Ensure that the revised objectives remain meaningful and achievable within the constraints of the audit environment.
3. Modification of Audit Scope: Evaluate whether a modification of the audit scope is necessary to align with the available evidence and the practical realities of the audit. Adjustments to the scope may be made to focus on achievable areas or to exclude elements that are currently unattainable.
4. Termination of the Audit: In extreme cases where the obstacles are insurmountable or the audit objectives cannot be reasonably achieved, termination of the audit might be considered. This decision should be made in consultation with the audit client and auditee and may involve a careful assessment of the potential impact on the audit conclusions.
5. Collaborative Decision-Making: Engage in collaborative decision-making with the audit client and auditee to determine the most appropriate course of action. This may include facilitated discussions to explore alternatives and collectively agree on the best way forward.
6. Communication of Changes or Termination: Communicate any changes to audit planning, objectives, or scope, or the decision to terminate the audit, to the relevant stakeholders. Clearly articulate the reasons for these decisions and provide any necessary context to ensure understanding.
7. Documentation of Decisions: Document all decisions made, including the rationale behind changes to audit planning, objectives, or scope, or the decision to terminate the audit. This documentation serves as a record of the collaborative efforts and helps maintain transparency.
8. Consideration of Professional Standards: Ensure that any changes or decisions align with professional audit standards and ethical considerations. Uphold integrity, objectivity, and professional competence in all actions taken.
9. Risk Assessment and Mitigation: Conduct a risk assessment to identify any potential risks associated with changes to the audit plan, objectives, or scope, or with the decision to terminate the audit. Develop mitigation strategies to address identified risks.
10. Client and Auditee Agreement: Seek agreement from the audit client and auditee on any proposed changes or the decision to terminate the audit. Ensure that all parties involved have a shared understanding and are in agreement with the course of action.

These considerations highlight the importance of flexibility, collaboration, and responsiveness in the audit process. Adjustments and decisions should be made in a way that preserves the integrity of the audit and aligns with the ultimate goal of providing meaningful and accurate audit conclusions.

Any need for changes to the audit plan which may become apparent as auditing activities progress should be reviewed and accepted, as appropriate, by both the individuals managing the audit programme and the audit client, and presented to the auditee. It’s a fundamental aspect of effective audit management to recognize that changes to the audit plan may be necessary as auditing activities progress. This adaptability is crucial for addressing emerging issues, accommodating unforeseen challenges, and ensuring the audit remains focused on achieving its objectives. Here are key considerations for managing changes to the audit plan:

1. Ongoing Review of the Audit Plan: Continuously review the audit plan as auditing activities progress. Regularly assess whether the planned approach, scope, or objectives remain appropriate in light of new information, findings, or unexpected circumstances.
2. Identification of Need for Changes: Actively monitor and identify any needs for changes to the audit plan. This may include adjustments due to changes in the audited entity’s operations, emerging risks, or other factors that become apparent during the audit process.
3. Communication with Audit Program Manager: Communicate any identified need for changes to the individual(s) managing the audit program. This could be the audit program manager or a designated person responsible for overseeing the audit process.
4. Consultation with the Audit Client: Engage in consultation with the audit client to discuss proposed changes to the audit plan. This collaborative approach ensures that the client is aware of and agrees with any adjustments that may impact the agreed-upon audit objectives or scope.
5. Presentation to the Auditee: Present proposed changes to the auditee. Clearly communicate the reasons for the changes, the potential impact on the audit process, and seek the auditee’s input and agreement where necessary.
6. Assessment of Implications: Assess the implications of proposed changes on the overall audit process, including timelines, resource requirements, and the achievement of audit objectives. Consider the potential risks and benefits associated with each change.
7. Documentation of Changes: Document any changes to the audit plan thoroughly. This documentation should include the reasons for the changes, the individuals involved in the decision-making process, and the agreement or acceptance from the audit client and auditee.
8. Approval by Relevant Parties: Seek approval for changes to the audit plan from both the individual(s) managing the audit program and the audit client. Ensure that all relevant parties are in agreement with the proposed adjustments.
9. Communication of Changes to the Team: Communicate approved changes to the audit team. Ensure that team members are informed about modifications to the plan, and provide guidance on how the changes will be implemented in their respective areas of responsibility.
10. Adherence to Professional Standards: Ensure that any changes made to the audit plan comply with professional audit standards and ethical considerations. Uphold the principles of integrity, objectivity, and professional competence.
11. Continuous Monitoring and Adaptation: Continue to monitor the audit process and adapt the plan as needed throughout the course of the audit. Embrace a continuous improvement mindset to enhance the effectiveness of the audit.

By actively managing changes to the audit plan in a transparent and collaborative manner, the audit team can enhance the adaptability of the audit process and maintain its effectiveness in achieving audit objectives. This approach also fosters open communication and collaboration with the audit client and auditee.