COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate
Management and the board of directors, as appropriate, assess results of ongoing and separate evaluations
Deficiencies are communicated to parties responsible for taking corrective action and to senior management and the board of directors, as appropriate
Management tracks whether deficiencies are remedied on a timely basis.