Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p92
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 276949–281418

IT environment (the number and skill level of the IT support resources that manage security and changes to the IT environment).                                                                                                       Few personnel with limited IT knowledge to process vendor upgrades and manage access            Limited personnel with IT skills / dedicated to IT                                                                                                               Dedicated IT departments with skilled personnel, including programming skills
      * The complexity of processes to manage access rights.                                                                                                                                                                                                                            Single individual with administrative access manages access rights                              Few individuals with administrative access manage access rights                                                                                                  Complex processes managed by IT department for access rights
      * The complexity of the security over the IT environment, including vulnerability of the IT applications, databases, and other aspects of the IT environment to cyber risks, particularly when there are web-based transactions or transactions involving external interfaces.    Simple on-premise access with no external web-facing elements                                   Some web-based applications with primarily simple, role-based security                                                                                           Multiple platforms with web-based access and complex security models
      * Whether program changes have been made to the manner in which information is processed, and the extent of such changes during the period.                                                                                                                                       Commercial software with no source code installed                                               Some commercial applications with no source code and other mature applications with a small number or simple changes; traditional systems development lifecycle  New or large number or complex changes, several development cycles each year
      * The extent of change within the IT environment (e.g., new aspects of the IT environment or significant changes in the IT applications or the underlying IT infrastructure).                                                                                                     Changes limited to version upgrades of commercial software                                      Changes consist of commercial software upgrades, ERP version upgrades, or legacy enhancements                                                                    New or large number or complex changes, several development cycles each year, heavy ERP customization
      * Whether there was a major data conversion during the period and, if so, the nature and significance of the changes made, and how the conversion was undertaken.                                                                                                                 Software upgrades provided by vendor; No data conversion features for upgrade                   Minor version upgrades for commercial software applications with limited data being converted                                                                    Major version upgrade, new release, platform change

Emerging Technologies

5.                   Entities may use emerging technologies (e.g., blockchain, robotics or artificial intelligence) because such technologies may present specific opportunities to increase operational efficiencies or enhance financial reporting.  When emerging technologies are used in the entity's information system relevant to the preparation of the financial report, the auditor may include such technologies in the identification of IT applications and other aspects of the IT environment that are subject to risks arising from the use of IT.  While emerging technologies may be seen to be more sophisticated or more complex compared to existing technologies, the auditor's responsibilities in relation to IT applications and identified general IT controls in accordance with paragraph 26(b)‒(c) remain unchanged.

Scalability