Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p99
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 298902–301940

impact or scope of potential misstatements in the financial report or may determine that the entity has provided adequate disclosures in relation to such security breach.

20.               In addition, laws and regulations that may have a direct or indirect effect on the entity's financial report may include data protection legislation.  Considering an entity's compliance with such laws or regulations, in accordance with ASA 250,[77] may involve understanding the entity's IT processes and general IT controls that the entity has implemented to address the relevant laws or regulations.

21.               General IT controls are implemented to address risks arising from the use of IT.  Accordingly, the auditor uses the understanding obtained about the identified IT applications and other aspects of the IT environment and the applicable risks arising from the use of IT in determining the general IT controls to identify.  In some cases, an entity may use common IT processes across its IT environment or across certain IT applications, in which case common risks arising from the use of IT and common general IT controls may be identified.

22.               In general, a greater number of general IT controls related to IT applications and databases are likely to be identified than for other aspects of the IT environment.  This is because these aspects are the most closely concerned with the information processing and storage of information in the entity's information system.  In identifying general IT controls, the auditor may consider controls over actions of both end users and of the entity's IT personnel or IT service providers.

23.               Appendix 6 provides further explanation of the nature of the general IT controls typically implemented for different aspects of the IT environment.  In addition, examples of general IT controls for different IT processes are provided.

Appendix 6

(Ref: Para. 25(c)(ii), A173‒A174)

Considerations for Understanding General IT Controls

This appendix provides further matters that the auditor may consider in understanding general IT controls.

      1. The nature of the general IT controls typically implemented for each of the aspects of the IT environment:

(a)                Applications

General IT controls at the IT application layer will correlate to the nature and extent of application functionality and the access paths allowed in the technology. For example, more controls will be relevant for highly-integrated IT applications with complex security options than a legacy IT application supporting a small number of account balances with access methods only through transactions.

(b)                Database

General IT controls at the database layer typically address risks arising from the use of IT related to unauthorised updates to financial reporting information in the database through direct database access or execution of a script or program.

(c)                Operating system

General IT controls at the operating system layer typically