Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p6
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 15289–18566

framework.  Assertions are used by the auditor to consider the different types of potential misstatements that may occur when identifying, assessing and responding to the risks of material misstatement.  (Ref: Para. A1)

(b)                Business risk – A risk resulting from significant conditions, events, circumstances, actions or inactions that could adversely affect an entity's ability to achieve its objectives and execute its strategies, or from the setting of inappropriate objectives and strategies.

(c)                Controls – Policies or procedures that an entity establishes to achieve the control objectives of management or those charged with governance.  In this context: (Ref: Para. A2–A5)

(i)                 Policies are statements of what should, or should not, be done within the entity to effect control.  Such statements may be documented, explicitly stated in communications, or implied through actions and decisions.

(ii)               Procedures are actions to implement policies.

(d)                General information technology (IT) controls – Controls over the entity's IT processes that support the continued proper operation of the IT environment, including the continued effective functioning of information processing controls and the integrity of information (i.e., the completeness, accuracy and validity of information) in the entity's information system.  Also see the definition of IT environment.

(e)                Information processing controls – Controls relating to the processing of information in IT applications or manual information processes in the entity's information system that directly address risks to the integrity of information (i.e., the completeness, accuracy and validity of transactions and other information).  (Ref: Para. A6)

(f)                 Inherent risk factors – Characteristics of events or conditions that affect susceptibility to misstatement, whether due to fraud or error, of an assertion about a class of transactions, account balance or disclosure, before consideration of controls.  Such factors may be qualitative or quantitative, and include complexity, subjectivity, change, uncertainty or susceptibility to misstatement due to management bias or other fraud risk factors[11] insofar as they affect inherent risk.  (Ref: Para. A7–A8)

(g)                IT environment – The IT applications and supporting IT infrastructure, as well as the IT processes and personnel involved in those processes, that an entity uses to support business operations and achieve business strategies.  For the purposes of this ASA:

(i)                 An IT application is a program or a set of programs that is used in the initiation, processing, recording and reporting of transactions or information.  IT applications include data warehouses and report writers.

(ii)               The IT infrastructure comprises the network, operating systems, and databases and their related hardware and software.

(iii)             The IT processes are the entity's processes to manage access to the IT environment, manage program changes or changes to the IT environment and manage IT operations.

(h)                Relevant assertions – An assertion about a class of transactions, account balance or disclosure