Internal Control Audit and Compliance: Documentation and Testing Under the New COSO Framework

CHAPTER SIX

Information and Communication

THE RELATIVELY EASY-TO-COMPREHEND component of Information and Communication has important tentacles throughout all of the principles and components. Data can be used to enlighten as well as to obscure. A strategy to hide information “in plain sight” is to flood the inquiry with so much data that the relevant information becomes a needle in the haystack. Forensic investigators and data analysis experts have developed sifting programs to signal potentially relevant information from the noise of masses of data. Computerized information makes possible the communication of masses of data at a minimum of cost, but if a human processor is at the end of the communication, the issue becomes one of delivering useful information.

In the infamous ENRON audit failure and management fraud, it was noted that literally rooms full of data were provided to the auditors. At the time the fraud was asserted, much of that information had not been reviewed by the auditors. It is not clear if that information would have contained any clues to the shenanigans that were happening, but by flooding the auditors with information, the distraction factor was well at work.

Assuming employees and stakeholders do not want to become forensic investigators to perform their responsibilities and tasks, it is important for the entity to provide the information needed to:

• Serve the purpose of the recipient.
• Avoid flooding the communication lines with data that numbs the senses ...