Document ID: chunk:federal_register_of_legislation:F2025L00107:front:0:p147
Version: federal_register_of_legislation:F2025L00107
Segment Type: other
Provision Reference: 
Character Range: 460976–464415

monitors its system of internal control include:

 1.                 The design of the monitoring activities, for example, whether it is periodic or ongoing monitoring;

 2.                 The performance and frequency of the monitoring activities;

 3.                 The evaluation of the results of the monitoring activities, on a timely basis, to determine whether the controls have been effective; and

 4.                 How identified deficiencies have been addressed through appropriate remedial actions, including timely communication of such deficiencies to those responsible for taking remedial action.

A374R. The practitioner may also consider how the entity's process to monitor the system of internal control addresses monitoring of information processing controls that involve the use of IT. This may include, for example:

 1.                 Controls to monitor complex IT environments that:

         1.                  Evaluate the continuing design effectiveness of information processing controls and modify them, as appropriate, for changes in conditions; or

         2.                Evaluate the operating effectiveness of information processing controls.

 2.                 Controls that monitor the permissions applied in automated information processing controls that enforce the segregation of duties.

 3.                 Controls that monitor how errors or control deficiencies related to the automation of sustainability reporting are identified and addressed.

Scalability

A375R. In less complex entities, and in particular owner-manager entities, the practitioner's understanding of the entity's process to monitor the system of internal control is often focused on how management or the owner-manager is directly involved in operations, as there may not be any other monitoring activities.

A376R. For entities where there is no formal process, understanding the process to monitor the system of internal control may include understanding periodic reviews of information that are designed to contribute to how the entity prevents or detects misstatements.

The Information System and Communication (Ref: Para. 117–118)

     1.

     2.

     3.

     4.

     5.

     6.

 7.       The practitioner uses professional judgement to determine which aspects of the information system are relevant to the sustainability matters and the preparation of the sustainability information and may make enquiries of the appropriate party(ies) about those aspects and perform other procedures, as necessary.

 8.       The understanding of the information system may include an understanding of the entity's information processing activities, its data and information, the resources to be used in such activities and the policies or procedures that define, for the sustainability information:

         1.                 How data and information, including qualitative information, are captured, recorded, processed, reviewed, corrected, and presented, including whether, and if so, how, the entity centralises activities relevant to sustainability reporting. Such policies or procedures may include internal verification processes whereby the data and information are checked by a reviewer for accuracy and completeness, and signed off to evidence that the review has taken place;

         2.                 Supporting records and other relevant information about the sustainability matters relating to