Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p22
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 22/47)
Character Range: 70702–73982

automated procedures to initiate, record, process, and report transactions, in which case records in electronic format replace paper documents.

           * Controls in IT systems consist of a combination of automated controls (for example, controls embedded in computer programs) and manual controls.  Further, manual controls may be independent of IT, may use information produced by IT, or may be limited to monitoring the effective functioning of IT and of automated controls, and to handling exceptions.  When IT is used to initiate, record, process or report transactions, or other financial data for inclusion in the financial report, the systems and programs may include controls related to the corresponding assertions for material accounts or may be critical to the effective functioning of manual controls that depend on IT.

    An entity's mix of manual and automated elements in internal control varies with the nature and complexity of the entity's use of IT.

A63.         Generally, IT benefits an entity's internal control by enabling an entity to:

           * Consistently apply predefined business rules and perform complex calculations in processing large volumes of transactions or data;

           * Enhance the timeliness, availability, and accuracy of information;

           * Facilitate the additional analysis of information;

           * Enhance the ability to monitor the performance of the entity's activities and its policies and procedures;

           * Reduce the risk that controls will be circumvented; and

           * Enhance the ability to achieve effective segregation of duties by implementing security controls in applications, databases, and operating systems.

A64.         IT also poses specific risks to an entity's internal control, including, for example:

           * Reliance on systems or programs that are inaccurately processing data, processing inaccurate data, or both.

           * Unauthorised access to data that may result in destruction of data or improper changes to data, including the recording of unauthorised or non‑existent transactions, or inaccurate recording of transactions.  Particular risks may arise where multiple users access a common database.

           * The possibility of IT personnel gaining access privileges beyond those necessary to perform their assigned duties thereby breaking down segregation of duties.

           * Unauthorised changes to data in master files.

           * Unauthorised changes to systems or programs.

           * Failure to make necessary changes to systems or programs.

           * Inappropriate manual intervention.

           * Potential loss of data or inability to access data as required.

A65.         Manual elements in internal control may be more suitable where judgement and discretion are required such as for the following circumstances:

           * Large, unusual or non‑recurring transactions.

           * Circumstances where errors are difficult to define, anticipate or predict.

           * In changing circumstances that require a control response outside the scope of an existing automated control.

           * In monitoring the effectiveness of automated controls.

A66.         Manual elements in internal control may be less