Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p101
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 304726–313038

development, implementation or upgrades to the IT environment.

(c)                Process to manage IT operations

               * Job scheduling

Controls over access to schedule and initiate jobs or programs that may affect financial reporting.

               * Job monitoring

Controls to monitor financial reporting jobs or programs for successful execution.

               * Backup and recovery

Controls to ensure backups of financial reporting data occur as planned and that such data is available and able to be accessed for timely recovery in the event of an outage or attack.

               * Intrusion detection

Controls to monitor for vulnerabilities and or intrusions in the IT environment.

The table below illustrates examples of general IT controls to address examples of risks arising from the use of IT, including for different IT applications based on their nature.
Process                                                                                                                                                                                     Risks                                                                                                                                                                                                                                                        Controls                                                                                                                                                                                                                                                                                                                     IT Applications
IT Process                                                                                                                                                                                  Example Risks Arising from the Use of IT                                                                                                                                                                                                                     Example General IT Controls                                                                                                                                                                                                                                                                                                  Non-complex commercial software – Applicable (yes / no)  Mid-size and moderately complex commercial software or IT applications – Applicable (yes / no)  Large or complex IT applications (e.g., ERP systems) – Applicable (yes / no)

Manage Access                                                                                                                                                                               User-access privileges: Users have access privileges beyond those necessary to perform their assigned duties, which may create improper segregation of duties.                                                                                               Management approves the nature and extent of user-access privileges for new and modified user access, including standard application profiles/roles, critical financial reporting transactions, and segregation of duties                                                                                                    Yes – instead of user access reviews noted below         Yes                                                                                             Yes
Access for terminated or transferred users is removed or modified in a timely manner                                                                                                        Yes – instead of user access reviews below                                                                                                                                                                                                                   Yes                                                                                                                                                                                                                                                                                                                          Yes
User access is periodically reviewed                                                                                                                                                        Yes – instead of provisioning/                                                                                                                                                                                                                               Yes ‒ for certain applications                                                                                                                                                                                                                                                                                               Yes

                                                                                                                                                                                            Deprovisioning controls above
Segregation of duties is monitored and conflicting access is either removed or mapped to mitigating controls, which are documented and tested                                               N/A – no system enabled segregation                                                                                                                                                                                                                          Yes ‒ for certain applications                                                                                                                                                                                                                                                                                               Yes
Privileged-level access (e.g., configuration, data and security administrators) is authorised and appropriately restricted                                                                  Yes – likely at IT application layer only                                                                                                                                                                                                                    Yes ‒ at IT application and certain layers of IT environment for platform                                                                                                                                                                                                                                                    Yes ‒ at all layers of IT environment for platform

Manage Access                                                                                                                                                                               Direct data access: Inappropriate changes are made directly to financial data through means other than application transactions.                                                                                                                             Access to application data files or database objects/tables/data is limited to authorised personnel, based on their job responsibilities and assigned role, and such access is approved by management                                                                                                                        N/A                                                      Yes ‒ for certain applications and databases                                                    Yes
Manage Access                                                                                                                                                                               System settings: Systems are not adequately configured or updated to restrict system access to properly authorised and appropriate users.                                                                                                                    Access is authenticated through unique user IDs and passwords or other