Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p81
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 241774–245068

internal control, including how the measures are evaluated and maintain their relevance;

               * How pressures associated with the achievement of control objectives impact the individual's responsibilities and performance measures; and

               * How the individuals are disciplined as necessary.

The appropriateness of the above matters will be different for every entity depending on its size, the complexity of its structure and the nature of its activities.

The Entity's Risk Assessment Process

7.                   The entity's risk assessment process is an iterative process for identifying and analysing risks to achieving the entity's objectives, and forms the basis for how management or those charged with governance determine the risks to be managed.

8.                   For financial reporting purposes, the entity's risk assessment process includes how management identifies business risks relevant to the preparation of financial report in accordance with the entity's applicable financial reporting framework, estimates their significance, assesses the likelihood of their occurrence, and decides upon actions to manage them and the results thereof.  For example, the entity's risk assessment process may address how the entity considers the possibility of unrecorded transactions or identifies and analyses significant estimates recorded in the financial report.

9.                   Risks relevant to reliable financial reporting include external and internal events, transactions or circumstances that may occur and adversely affect an entity's ability to initiate, record, process, and report financial information consistent with the assertions of management in the financial report.  Management may initiate plans, programs, or actions to address specific risks or it may decide to assume a risk because of cost or other considerations.  Risks can arise or change due to circumstances such as the following:

           * Changes in operating environment.  Changes in the regulatory, economic or operating environment can result in changes in competitive pressures and significantly different risks.

           * New personnel.  New personnel may have a different focus on or understanding of the entity's system of internal control.

           * New or revamped information system.  Significant and rapid changes in the information system can change the risk relating to the entity's system of internal control.

           * Rapid growth.  Significant and rapid expansion of operations can strain controls and increase the risk of a breakdown in controls.

           * New technology.  Incorporating new technologies into production processes or the information system may change the risk associated with the entity's system of internal control.

           * New business models, products, or activities.  Entering into business areas or transactions with which an entity has little experience may introduce new risks associated with the entity's system of internal control.

           * Corporate restructurings.  Restructurings may be accompanied by staff reductions and changes in supervision and segregation of duties that may change the risk associated with the entity's system internal control.

           * Expanded foreign operations.