Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p83
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 247665–250944

those that monitor underlying automated controls, may be automated or manual, or a combination of both.  For example, an entity may use automated monitoring controls over access to certain technology with automated reports of unusual activity to management, who manually investigate identified anomalies.

13.               When distinguishing between a monitoring activity and a control related to the information system, the underlying details of the activity are considered, especially when the activity involves some level of supervisory review.  Supervisory reviews are not automatically classified as monitoring activities and it may be a matter of judgement whether a review is classified as a control related to the information system or a monitoring activity.  For example, the intent of a monthly completeness control would be to detect and correct errors, where a monitoring activity would ask why errors are occurring and assign management the responsibility of fixing the process to prevent future errors.  In simple terms, a control related to the information system responds to a specific risk, whereas a monitoring activity assesses whether controls within each of the five components of the entity's system of internal control are operating as intended.

14.               Monitoring activities may include using information from communications from external parties that may indicate problems or highlight areas in need of improvement.  Customers implicitly corroborate billing data by paying their invoices or complaining about their charges.  In addition, regulators may communicate with the entity concerning matters that affect the functioning of the entity's system of internal control, for example, communications concerning examinations by bank regulatory agencies.  Also, management may consider in performing monitoring activities any communications relating to the entity's system of internal control from external auditors.

The Information System and Communication

15.               The information system relevant to the preparation of the financial report consists of activities and policies, and accounting and supporting records, designed and established to:

           * Initiate, record and process entity transactions (as well as to capture, process and disclose information about events and conditions other than transactions) and to maintain accountability for the related assets, liabilities and equity;

           * Resolve incorrect processing of transactions, for example, automated suspense files and procedures followed to clear suspense items out on a timely basis;

           * Process and account for system overrides or bypasses to controls;

           * Incorporate information from transaction processing in the general ledger (e.g., transferring of accumulated transactions from a subsidiary ledger);

           * Capture and process information relevant to the preparation of the financial report for events and conditions other than transactions, such as the depreciation and amortisation of assets and changes in the recoverability of assets; and

           * Ensure information required to be disclosed by the applicable financial reporting framework is accumulated, recorded, processed, summarised and appropriately