View source for Principle 13 - Use Quality Information


13.01 Management should obtain or generate relevant, quality information
and use it to support the functioning of the internal control system.

Identification of Information Requirements 

13.02 Management designs a process that uses the entity’s objectives and
related risks to identify the information requirements needed to support
the internal control system. Information requirements consider the needs
of both internal and external users. Management defines the identified
information requirements at the relevant level and requisite specificity
for appropriate personnel.

13.03 Management identifies information requirements in an iterative and
ongoing process that occurs throughout the design, implementation, and
operation of an effective internal control system. An entity’s controls
within the five components of internal control establish information
requirements. As change in the entity and its objectives and risks
occurs, management changes information requirements as needed to meet
these modified objectives and address these modified risks. Management
establishes information requirements through policies and procedures,
with clear responsibility and accountability for the quality of
information. These information requirements are communicated both
internally and externally, such as with service organizations.

Relevant Data from Reliable Sources

13.04 Management obtains or generates relevant data from reliable
internal and external sources in a timely manner based on the identified
information requirements. Relevant data have a logical connection with,
or bearing upon, the identified information requirements. Reliable
internal and external sources provide data that are reasonably free from
error and bias and faithfully represent what they purport to represent.
Management evaluates both internal and external sources of data for
reliability. Management obtains relevant data through a variety of
forms, including using manual input or compilation, using information
technology, or coordinating with other entities to obtain or access
data.[1] Sources of data can be operational, reporting, or compliance
related. Management obtains data on a timely basis so that they can be
used for effective monitoring.

Data Processed into Quality Information

13.05 Management processes relevant data obtained or generated from
reliable sources into quality information through the entity’s
information system. The entity’s information system comprises the
people, processes, data, and information technology that management uses
to obtain, generate, communicate, or dispose of information to support
the entity’s business processes.

13.06 Management develops the entity’s information system to obtain,
generate, and process relevant data into quality information to meet the
identified information requirements needed to support the internal
control system. Information processing can be manual, automated through
the use of information technology, or a combination of both.

13.07 Management evaluates the processed information to determine
whether it is quality information. Quality information meets the
identified information requirements when relevant data from reliable
sources are used. Quality information is appropriate, current, complete,
accurate, accessible, verifiable, retained as appropriate, and provided
on a timely basis. Management considers these characteristics and the
information processing and information security objectives in evaluating
processed information, and makes revisions when necessary, so that the
information is quality information. Management uses the quality
information to make informed decisions and evaluate the entity’s
performance in achieving key objectives, addressing risks, and
fulfilling internal control responsibilities.

{{Principles}}

== Related Story Events ==

* [[2001: The Journey Begins|❓ 2001: The Journey Begins — Information Gaps]]