A team finishes fieldwork on Friday, emails the draft report to the process owner Monday, and the process owner replies that two of the five findings were fixed in March. What the team does next, and who eventually receives the final report, is the entire content of this lesson.
The closing communication (widely called the exit conference or closing meeting) is the structured discussion where internal audit presents draft results to the audited party before the report is finalized. It sits between the end of fieldwork and issuance of the final communication.
Its purposes are narrow and testable:
- Validate facts: confirm the conditions, criteria, cause, and effect of each finding are accurate and complete, so no surprise appears in the final report.
- Confirm significance: align on how serious each finding is and how it will be rated.
- Obtain management responses: secure the management action plan, owner, and target date for each finding.
- Surface disagreements: identify where management disputes a finding, so the disagreement can be documented rather than discovered later.
Common mistakes
- Dropping a finding management already fixed. The condition existed during the period and stays in the report; only the disclosure changes to note the correction, its date, and whether internal audit verified it.
- Treating the closing meeting as a negotiation. Facts and ratings get validated there; disputed findings remain in the report with management's position documented alongside.
- Sending the correction only to affected parties. A corrected communication goes to every recipient of the original, including external auditors who may be relying on the wrong figure.
Bottom line
- Closing communication purposes: validate facts, confirm significance, obtain management action plans with owners and dates, document disagreements, preview distribution.
- Participants: engagement lead and supervisor, CAE for significant engagements, management of the audited activity, and process owners with authority to commit resources.
- Distribution responsibility: the CAE decides who receives the final communication and how much each party receives.
- External distribution: assess risk to the organization, consult senior management and legal counsel, restrict use of results.
Exam shortcut
Read the stem for a timing word. If management fixed something "after fieldwork" or "before the report was issued," the answer includes the finding and discloses the correction. Eliminate every option containing "remove," "omit," or "do not report." For any distribution question, ask who is deciding. If the actor is a staff auditor or engagement lead and the destination is outside the organization, the answer is escalate to the CAE.
The full lesson (about 2,346 words, 16 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 4
Browse all free CIA Part 3 lessons or jump into free CIA Part 3 practice questions.