Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p82
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 244758–247935

the entity's system of internal control.

           * Corporate restructurings.  Restructurings may be accompanied by staff reductions and changes in supervision and segregation of duties that may change the risk associated with the entity's system internal control.

           * Expanded foreign operations.  The expansion or acquisition of foreign operations carries new and often unique risks that may affect internal control, for example, additional or changed risks from foreign currency transactions.

           * New accounting pronouncements.  Adoption of new accounting principles or changing accounting principles may affect risks in preparing financial report.

           * Use of IT.  Risks relating to:

                   + Maintaining the integrity of data and information processing;

                   + Risks to the entity business strategy that arise if the entity's IT strategy does not effectively support the entity's business strategy; or

                   + Changes or interruptions in the entity's IT environment or turnover of IT personnel or when the entity does not make necessary updates to the IT environment or such updates are not timely.

The Entity's Process to Monitor the System of Internal Control

10.               The entity's process to monitor the system of internal control is a continual process to evaluate the effectiveness of the entity's system of internal control, and to take necessary remedial actions on a timely basis.  The entity's process to monitor the entity's system of internal control may consist of ongoing activities, separate evaluations (conducted periodically), or some combination of the two.  Ongoing monitoring activities are often built into the normal recurring activities of an entity and may include regular management and supervisory activities.  The entity's process will likely vary in scope and frequency depending on the assessment of the risks by the entity.

11.               The objectives and scope of internal audit functions typically include activities designed to evaluate or monitor the effectiveness of the entity's system of internal control.[72] The entity's process to monitor the entity's system of internal control may include activities such as management's review of whether bank reconciliations are being prepared on a timely basis, internal auditors' evaluation of sales personnel's compliance with the entity's policies on terms of sales contracts, and a legal department's oversight of compliance with the entity's ethical or business practice policies.  Monitoring is done also to ensure that controls continue to operate effectively over time.  For example, if the timeliness and accuracy of bank reconciliations are not monitored, personnel are likely to stop preparing them.

12.               Controls related to the entity's process to monitor the entity's system of internal control, including those that monitor underlying automated controls, may be automated or manual, or a combination of both.  For example, an entity may use automated monitoring controls over access to certain technology with automated reports of unusual activity to management, who manually