Document ID: chunk:federal_register_of_legislation:F2025L00107:front:0:p151
Version: federal_register_of_legislation:F2025L00107
Segment Type: other
Provision Reference: 
Character Range: 473170–476290

2.       In identifying IT applications subject to risks arising from IT, the practitioner may consider the entity's automated controls, information storage and processing, and reliance on general IT controls. The extent of understanding and the number of applications subject to risks arising from the use of IT vary based on the entity's complexity. When the practitioner has identified IT applications that are subject to risks arising from IT, other aspects of the IT environment (for example network, operating systems, databases, and interfaces between IT applications) are likely to be identified because such aspects support and interact with the identified IT applications.

 3.       Risks arising from IT may include unauthorised access, program changes, and inappropriate data changes, and their extent depends on the nature and characteristics of the IT applications and environment.

Design and Implementation of Controls (Ref: Para. 120L, 120R)

 1.       Evaluating the design of an identified control involves the practitioner's consideration of whether the control, individually or in combination with other controls, is capable of effectively preventing, or detecting and correcting, material misstatements (i.e., the control objective).

 2.       The practitioner determines the implementation of an identified control by establishing that the control exists and that the entity is using it. There is little point in the practitioner assessing the implementation of a control that is not designed effectively. Therefore, the practitioner evaluates the design of a control first. An improperly designed control may represent a control deficiency.

 3.       The practitioner may conclude that a control, which is effectively designed and implemented, may be appropriate to test in order to take its operating effectiveness into account in determining the nature, timing and extent of further procedures. However, when a control is not designed or implemented effectively, there is no benefit in testing it.

 4.       When the practitioner plans to test the operating effectiveness of a control, the information obtained about the extent to which the control addresses the risk(s) of material misstatement is an input to the practitioner's risk assessment.

 5.       Evaluating the design and determining the implementation of controls is not sufficient to test their operating effectiveness. However, the practitioner may plan to test the operating effectiveness of automated controls by identifying and testing general IT controls that provide for the consistent operation of the automated controls instead of testing the operating effectiveness of the automated controls directly. General IT controls that are not able to be reconfigured or changed by management provide for the consistent operation of an automated control.

 6.       The practitioner may expect more formal documentation of the information system and controls when the information system and controls form part of the sustainability matters (e.g., when the sustainability information is about the entity's controls).

A399L. In