Communication to external parties allows them to readily understand events, activities, or other circumstances that may affect how they interact with the entity. Management's communication to external parties sends a message about the importance of internal control in the organization by demonstrating open lines of communication. Communication to external suppliers and customers supports the entity's ability to maintain an appropriate control environment. Suppliers and customers need to fully understand the entity's values and cultures. They are informed of the entity's code of conduct and recognize their responsibilities in helping to ensure compliance with the code of conduct. For example, management communicates its controls relating to business dealings with vendors upon approval of a new vendor and requires the vendor to acknowledge its adherence prior to the approval of an initial purchase order with the vendor.

Technology and communication tools enable external parties to have access to public forums to post and discuss an entity's business, activities, and controls. When an organization uses, or authorizes its employees to use public forums, such as social media and similar unrestricted communication tools, management develops and implements controls that guide expectations for proper use to avoid jeopardizing the entity's objectives.

Communications from external parties may also provide important information on the functioning of the entity's internal control system. These can include:

Information resulting from external assessments about the organization's activities that relate to matters of internal control are evaluated by management and, where appropriate, communicated to the board of directors. For example, management has entered into an arrangement that allows the organization to periodically use externally managed technology services to perform transaction processing in lieu of hiring personnel and purchasing and implementing additional hardware and software internally. The organization uses sensitive customer data in certain processes. To maintain compliance with the entity's policies and external laws, regulations, and standards, an assessment of internal control over the security and privacy of externally transmitted data (including data transmitted over the Internet) is performed by a third party. The results of the assessment reveal weaknesses in internal control that could impact the security and privacy of data. Management assesses the significance of the weaknesses and reports information necessary to enable the board of directors to carry out its oversight responsibilities.

The interdependence of business processes between the entity and outsourced service providers can blur the lines of responsibility between the entity's internal control system and that of outsourced service providers. This creates a need for more rigorous controls over communication between the parties. For example, supply chain management in a global retail company occurs through a dynamic, interactive exchange of activities between the company, vendors, logistics providers, and contract manufacturers. Internal control over the end-to-end processes becomes a shared responsibility, but there may be uncertainty about which entity is responsible at a particular stage of the process. Communicating with outsourced service providers responsible for activities supporting the entity's objectives may facilitate the risk assessment process, the oversight of business activities, decision making, and the identification of responsibility for internal control throughout the process regardless of where activities occur.