Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p100
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 301665–305048

arising from the use of IT related to unauthorised updates to financial reporting information in the database through direct database access or execution of a script or program.

(c)                Operating system

General IT controls at the operating system layer typically address risks arising from the use of IT related to administrative access, which can facilitate the override of other controls. This includes actions such as compromising other user's credentials, adding new, unauthorised users, loading malware or executing scripts or other unauthorised programs.

(d)                Network

General IT controls at the network layer typically address risks arising from the use of IT related to network segmentation, remote access, and authentication. Network controls may be relevant when an entity has web-facing applications used in financial reporting. Network controls are also may be relevant when the entity has significant business partner relationships or third-party outsourcing, which may increase data transmissions and the need for remote access.

2.                   Examples of general IT controls that may exist, organised by IT process include:

(a)                Process to manage access:

               * Authentication

Controls that ensure a user accessing the IT application or other aspect of the IT environment is using the user's own log-in credentials (i.e., the user is not using another user's credentials).

               * Authorisation

Controls that allow users to access the information necessary for their job responsibilities and nothing further, which facilitates appropriate segregation of duties.

               * Provisioning

Controls to authorise new users and modifications to existing users' access privileges.

               * Deprovisioning

Controls to remove user access upon termination or transfer.

               * Privileged access

Controls over administrative or powerful users' access.

               * User access reviews

Controls to recertify or evaluate user access for ongoing authorisation over time.

               * Security configuration controls

Each technology generally has key configuration settings that help restrict access to the environment.

               * Physical access

Controls over physical access to the data centre and hardware, as such access may be used to override other controls.

(b)                Process to manage program or other changes to the IT environment:

               * Change management process

Controls over the process to design, program, test and migrate changes to a production (i.e., end user) environment.

               * Segregation of duties over change migration

Controls that segregate access to make and migrate changes to a production environment.

               * Systems development or acquisition or implementation

Controls over initial IT application development or implementation (or in relation to other aspects of the IT environment).

               * Data conversion

Controls over the conversion of data during development, implementation or upgrades to the IT environment.

(c)                Process to manage IT operations

               * Job scheduling

Controls over access to schedule and initiate jobs or programs that may affect financial reporting.

               * Job monitoring

Controls to monitor financial reporting