Document ID: chunk:federal_register_of_legislation:F2016C00028:reg:26:p32
Version: federal_register_of_legislation:F2016C00028
Segment Type: reg
Provision Reference: reg 26 (pt 32/47)
Character Range: 100112–103454

they maintain the integrity of information and the security of the data such systems process, and include effective general IT‑controls and application controls.

A108.      General IT‑controls are policies and procedures that relate to many applications and support the effective functioning of application controls.  They apply to mainframe, miniframe, and end‑user environments.  General IT‑controls that maintain the integrity of information and security of data commonly include controls over the following:

           * Data centre and network operations.

           * System software acquisition, change and maintenance.

           * Program change.

           * Access security.

           * Application system acquisition, development, and maintenance.

They are generally implemented to deal with the risks referred to in paragraph A64 above.

A109.      Application controls are manual or automated procedures that typically operate at a business process level and apply to the processing of transactions by individual applications.  Application controls can be preventive or detective in nature and are designed to ensure the integrity of the accounting records.  Accordingly, application controls relate to procedures used to initiate, record, process and report transactions or other financial data.  These controls help ensure that transactions occurred, are authorised, and are completely and accurately recorded and processed.  Examples include edit checks of input data, and numerical sequence checks with manual follow‑up of exception reports or correction at the point of data entry.

Components of Internal Control—Monitoring of Controls (Ref: Para. 22)

A110.      Monitoring of controls is a process to assess the effectiveness of internal control performance over time.  It involves assessing the effectiveness of controls on a timely basis and taking necessary remedial actions.  Management accomplishes monitoring of controls through ongoing activities, separate evaluations, or a combination of the two.  Ongoing monitoring activities are often built into the normal recurring activities of an entity and include regular management and supervisory activities.

A111.      Management's monitoring activities may also include using information from communications from external parties such as customer complaints and regulator comments that may indicate problems or highlight areas in need of improvement.

Considerations Specific to Smaller Entities

A112.      Management's monitoring of control is often accomplished by management's or the owner‑manager's close involvement in operations.  This involvement often will identify significant variances from expectations and inaccuracies in financial data leading to remedial action to the control.

The Entity's Internal Audit Function  (Ref: Para. 23)

A113.       If the entity has an internal audit function, obtaining an understanding of that function contributes to the auditor's understanding of the entity and its environment, including internal control, in particular the role that the function plays in the entity's monitoring of internal control over financial reporting.  This understanding, together with the information obtained from the auditor's enquiries in paragraph 6(a), may also provide information that is directly relevant to the auditor's