Document ID: chunk:federal_register_of_legislation:F2025L00107:front:0:p150
Version: federal_register_of_legislation:F2025L00107
Segment Type: other
Provision Reference: 
Character Range: 470020–473449

as necessary, and incorporated into the sustainability information may also include an understanding of:

         1.                 The nature and significance of the data or information provided by external sources; and

         2.                 How the entity addresses the reliability of information from external sources, for example by:

                 1.                  Monitoring information provided to, and received back from, the external source;

                 2.                Considering the reputation of the external source; and

                 3.              Considering whether there are other sources of similar information, and whether the information from such different available sources is aligned.

Evaluating the information system to support the preparation of the sustainability information (Ref: Para. 118)

 1.       The understanding of the information system may also include an understanding of how the entity communicates significant matters that support the preparation of the sustainability information and related reporting responsibilities in the information system and other components of the entity's system of internal control:

         1.                 Between people within the entity, including how roles and responsibilities are communicated;

         2.                 Between management and those charged with governance;

         3.                 With intended users; and

         4.                 With external parties, such as regulatory authorities.

Control Activities (Ref: Para. 119R, 120L)

 1.       The practitioner's identification and evaluation of controls in the control activities component of the entity's system of internal control may focus on information processing controls, which are controls applied during the processing of information in the entity's information system that directly address risks to the integrity of information (i.e., the completeness, accuracy, and validity of information). However, the practitioner is not required to identify and evaluate all information processing controls.

 2.       An assurance engagement does not require an understanding of all the controls related to each disclosure or to every assertion relevant to them.
 1.       Examples of other controls for which it may be appropriate for the practitioner to obtain an understanding include:

           * Controls that address risks of material misstatement assessed as higher on the spectrum of risk based on their likelihood and magnitude.

           * Controls that are related to the assembly of, or adjustments to, the sustainability information.

           * If the entity uses a service organisation, controls at the entity that relate to the services provided by the service organisation.

 1.       Identifying IT applications and other aspects of the IT environment, related risks arising from the use of IT, and general IT controls in place to address those risks affects the practitioner's decisions on testing controls, assessing risks of material misstatement, testing information produced by IT applications, and designing further procedures.

 2.       In identifying IT applications subject to risks arising from IT, the practitioner may consider the entity's automated controls, information storage and processing, and reliance on general IT controls. The extent of understanding and the number of applications subject to