A practical guide to COSO Information and Communication, its three principles, information quality, communication channels, evidence, and GRC traceability.
Published: 8/30/2026Updated: 8/30/2026By growGRC Editorial Team
Executive Summary
Information and Communication ensures relevant, quality information reaches the people and parties who need it to support internal control.
Key Takeaways
✓Information and Communication contains three COSO principles: relevant and quality information, internal communication, and external communication.
✓Information quality should be appropriate for its intended purpose.
✓Internal communication should support both top-down and bottom-up information flows.
✓External information can trigger changes to risks, controls, policies, and monitoring.
✓GRC traceability should connect information requirements with objectives, risks, controls, evidence, and remediation.
COSO Information and Communication
Information and Communication is one of the five components of the COSO Internal Control — Integrated Framework. It supports the organization in obtaining, generating, and using relevant, quality information and communicating that information internally and externally to support the functioning of internal control.
Why Information and Communication matters
Internal control depends on people having the information they need, when they need it, in a form they can understand and use.
A mature program helps the organization obtain relevant and quality information, communicate objectives and responsibilities, maintain reliable information flows, escalate significant issues, and preserve evidence of important communications.
Information should be relevant, accurate, complete, timely, accessible, and sufficiently detailed for its intended use.
The three COSO Information and Communication principles
Principle 13 — Uses relevant, quality information
The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.
Relevant information can come from internal and external sources, including operational and financial systems, compliance activities, risk assessments, monitoring, incidents, third parties, and regulatory developments.
Quality information should be appropriate for its intended purpose. Important characteristics include accuracy, completeness, timeliness, accessibility, relevance, validity, reliability, and an appropriate level of detail.
Principle 14 — Communicates internally
The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
What are the three COSO Information and Communication principles?
They address using relevant, quality information, communicating internally, and communicating externally.
What makes information useful for internal control?
It should be appropriate for its intended purpose, with characteristics such as accuracy, completeness, timeliness, relevance, accessibility, validity, and reliability.
Why is upward communication important?
It allows risks, incidents, exceptions, and control deficiencies to reach the people responsible for oversight and decision-making.
How does GRC support Information and Communication?
GRC can link information requirements, objectives, risks, controls, communication channels, evidence, assessments, deficiencies, and remediation.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.
Employees and control owners should understand what the organization is trying to achieve, what risks and control responsibilities apply to their roles, what policies and procedures they must follow, what information must be reported, when issues must be escalated, and how deficiencies and incidents are communicated.
Communication should support both top-down and bottom-up information flows.
Principle 15 — Communicates externally
The organization communicates with external parties regarding matters affecting the functioning of internal control.
Relevant external parties may include regulators, customers, suppliers, business partners, auditors, investors or other stakeholders, outsourced service providers, and professional or industry organizations.
The organization should also establish channels through which relevant external information can be received and evaluated.
Information lifecycle
A practical GRC information lifecycle is:
Identify Information Needs → Obtain/Generate → Validate → Use → Communicate → Retain → Monitor Quality → Improve
Information requirements should be defined according to the decisions and controls they support.
Identify information needs
Determine what information is required for objectives, risks, controls, compliance obligations, monitoring, and decision-making.
Obtain or generate information
Collect information from appropriate internal and external sources.
Validate quality
Assess whether information is accurate, complete, timely, relevant, reliable, and fit for purpose.
Use information
Ensure authorized users receive and use information to perform their responsibilities.
Communicate information
Deliver information through appropriate internal or external channels.
Retain information
Preserve important records according to legal, regulatory, contractual, and organizational requirements.
Monitor information quality
Identify recurring data-quality, reporting, or communication problems and address their causes.
Communication channels
Examples include policies and procedures, management meetings, dashboards, risk reports, control attestations, training, incident-management channels, reporting mechanisms, regulatory communications, supplier communications, and external reporting.
Sensitive information should be communicated through channels with appropriate access restrictions and security controls.
Information and Communication in a GRC operating model
A GRC platform should maintain relationships among:
Objective → Risk → Control → Information Requirement → Evidence → Communication → Assessment → Deficiency → Remediation
This traceability helps identify what information is required to operate a control, who receives it, which systems generate it, what quality checks exist, what evidence demonstrates communication, and which deficiencies or remediation actions affect the information flow.
Useful metadata can include information requirement ID, related objective and risk, related control, information owner, source system, data owner, audience, frequency, communication channel, classification, retention requirement, quality criteria, evidence location, and escalation requirement.
Information quality and control effectiveness
Poor information quality can undermine otherwise well-designed controls. For example, a reconciliation control may be properly designed, but incomplete source data can prevent it from identifying relevant exceptions.
Organizations should therefore consider information quality as part of control design and assessment when a control depends on information.
A useful relationship is:
Information Quality → Control Execution → Control Evidence → Control Assessment
Internal communication and accountability
Internal communication should make responsibilities understandable and actionable.
A control owner should know what the control is intended to accomplish, what evidence is expected, when it must operate, what exceptions require escalation, and how failures are reported.
External communication
External communication can affect internal control when external information influences objectives, risks, controls, compliance, or decisions.
For example, a regulatory change received from an external authority may require a risk assessment, policy update, control change, training, and monitoring activity.
The communication process should include mechanisms for receiving, evaluating, routing, and responding to relevant external information.
Common implementation mistakes
Treating reports as automatically reliable
A report is useful only when its underlying information is appropriate, complete, accurate, and timely for its intended purpose.
Communicating without defining the audience
Information should reach the people responsible for acting on it.
Relying only on top-down communication
Effective internal control also requires upward communication of risks, incidents, exceptions, and deficiencies.
Ignoring external information
Regulatory, supplier, customer, auditor, and other external information can affect risk and control decisions.
Failing to document important communication
Where evidence is needed, important communications should be retained in an appropriate and retrievable form.
Separating information quality from control assessment
When a control depends on data, information quality should be considered when evaluating whether the control can operate effectively.
Evidence for assessing Information and Communication
The evidence should demonstrate that information is available and appropriate for its intended use and that relevant communication channels operate as designed.
Conclusion
COSO Information and Communication ensures that relevant, quality information reaches the people and parties who need it to support internal control.
The three principles address relevant and quality information, internal communication, and external communication. In a GRC environment, these principles are strongest when information requirements, communication channels, evidence, accountability, and control assessments are connected through traceability.
