Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p103
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 319255–326331

meet company or professional policies and standards (e.g., password minimum length and complexity, expiration, account lockout)    N/A – no separate network authentication method exists   Yes                                                                                             Yes
Network is architected to segment web-facing applications from the internal network, where ICFR relevant applications are accessed                                                          N/A – no network segmentation employed                                                                                                                                                                                                                       Yes ‒ with judgement                                                                                                                                                                                                                                                                                                         Yes ‒ with judgement
On a periodic basis, vulnerability scans of the network perimeter are performed by the network management team, which also investigates potential vulnerabilities                           N/A                                                                                                                                                                                                                                                          Yes ‒ with judgement                                                                                                                                                                                                                                                                                                         Yes ‒ with judgement
On a periodic basis, alerts are generated to provide notification of threats identified by the intrusion detection systems.  These threats are investigated by the network management team  N/A                                                                                                                                                                                                                                                          Yes ‒ with judgement                                                                                                                                                                                                                                                                                                         Yes ‒ with judgement
Controls are implemented to restrict Virtual Private Network (VPN) access to authorised and appropriate users                                                                               N/A – no VPN                                                                                                                                                                                                                                                 Yes ‒ with judgement                                                                                                                                                                                                                                                                                                         Yes ‒ with judgement
IT Operations                                                                                                                                                                               Data backup and recovery: Financial data cannot be recovered or accessed in a timely manner when there is a loss of data.                                                                                                                                    Financial data is backed up on a regular basis according to an established schedule and frequency                                                                                                                                                                                                                            N/A – relying on manual backups by finance team          Yes                                                                                             Yes

IT Operations                                                                                                                                                                               Job scheduling: Production systems, programs, or jobs result in inaccurate, incomplete, or unauthorised processing of data.                                                                                                                                  Only authorised users have access to update the batch jobs (including interface jobs) in the job scheduling software                                                                                                                                                                                                         N/A – no batch jobs                                      Yes ‒ for certain applications                                                                  Yes
Critical systems, programs, or jobs are monitored, and processing errors are corrected to ensure successful completion.                                                                     N/A – no job monitoring                                                                                                                                                                                                                                      Yes ‒ for certain applications                                                                                                                                                                                                                                                                                               Yes

[1]  See ASA 200 Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with Australian Auditing Standards.
[2]  See ASA 200, paragraph 17.
[3]  See ASA 200, paragraph 13(c).
[4]  See ASA 200, paragraph A36.
[5]  See ASA 200, paragraphs 15–16.
[6]  See ASA 200, paragraph A38 and ASA 330 The Auditor's Responses to Assessed Risks, paragraph 6.
[7]  See ASA 240 The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Report.
[8]  See ASA 330, paragraph 5.
[9]  See ASA 330, paragraph 6.
[10]  See ASA 200, paragraph A65.
[11]  See ASA 240, paragraphs A24‒A27.
[12]  See ASA 240, paragraph 28 and ASA 550, Related Parties, paragraph 18.
[13]  See ASA 230, Audit Documentation, paragraphs 8–11, and A6–A7.
[14]  See ASA 580 Written Representations.
[15]  See ASA 240, paragraphs 17–28.
[16]  See ASA 540 Auditing Accounting Estimates and Related Disclosures.
* See ASA 550 Related Parties.
[17]  See ASA 570 Going Concern.
[18]  See ASA 600 Special Considerations—Audits of a Group Financial Report.
[19] See paragraphs