The Information and Communication component of the Framework supports the functioning of all components of internal control. In combination with the other components, Information and Communication supports the achievement of the entity's objectives, including objectives relevant to internal and external reporting. Controls within Information and Communication support the organization's ability to use the right information within the system of internal control and to carry out internal control responsibilities.

Information is the data that is combined and summarized based on relevance to information requirements. Information requirements are determined by the ongoing functioning of the other internal control components, taking into consideration the expectations of all users, both internal and external. Information systems support informed decision making and the functioning of the internal control by processing relevant, timely, and quality information from internal and external sources.

Communication enables the organization to share relevant and quality information internally and externally. Communication provides information necessary in designing, implementing, and conducting internal control, and in assessing its effectiveness. Management communicates information internally to enable personnel to understand the entity's objectives and the importance of their control responsibilities. Internal communication facilitates the functioning of internal control by sharing information up, down, and across the entity. External communication enables management to obtain and share information between the entity and external parties about risks, regulatory matters, changes in circumstances, customer satisfaction, and other information relevant to the functioning of the internal control.

An information system is the set of activities, involving people, processes, data and/or technology, which enable the organization to obtain, generate, use, and communicate transactions and information to maintain accountability and measure and review the entity's performance or progress toward achievement of objectives.

The Framework distinguishes this component from the internal reporting category of objectives. Information and Communication is only one component of the Framework. This component serves to provide relevant, quality information to support all components of internal control. On the other hand, an organization seeking reasonable assurance in preparing external reports requires all five components of internal control. Communication can appear broad at times (e.g., information communicated about external trends or events), but in the context of the Framework, its use may be narrower (e.g., communication enabling a user to carry out controls within Risk Assessment).