|
|
| Line 17: |
Line 17: |
| # [[Principle 16 - Perform Monitoring Activities]] | | # [[Principle 16 - Perform Monitoring Activities]] |
| # [[Principle 17 - Evaluate Issues and Remediate Deficiencies]] | | # [[Principle 17 - Evaluate Issues and Remediate Deficiencies]] |
|
| |
| === Index of Green Book Attributes Relating to Maricopa County Performance ===
| |
|
| |
| ==== '''Principle 1 - Demonstrate Commitment to Integrity and Ethical Values''' ====
| |
|
| |
| * '''[[1.01|Attribute 1.01]]'''
| |
| '''''<big>Tone at the Top</big>'''''
| |
| * '''[[1.02|Attribute 1.02]]'''
| |
| * '''[[1.03|Attribute 1.03]] - with potential governance gap example(s)'''
| |
| * '''[[1.04|Attribute 1.04]]'''
| |
| * '''[[1.05|Attribute 1.05]]'''
| |
| '''<big>Standards of Conduct</big>'''
| |
| *'''Attribute [[1.06]]'''
| |
| * '''Attribute [[1.07]]'''
| |
| '''<big>Adherence to Standards of Conduct</big>'''
| |
| * '''Attribute [[1.08]]'''
| |
| * '''Attribute [[1.09]]'''
| |
| * '''Attribute [[1.10]] '''
| |
|
| |
| ==== '''Principle 2 - Exercise Oversight Responsibility''' ====
| |
|
| |
| * '''Attribute [[2.01]]'''
| |
| '''<big>Oversight Structure</big>'''
| |
| * '''Attribute [[2.02]]'''
| |
| * '''Attribute [[2.03]]'''
| |
| * '''Attribute [[2.04]]'''
| |
| * '''Attribute [[2.05]]'''
| |
| * '''Attribute [[2.06]]'''
| |
| * '''Attribute [[2.07]]'''
| |
| * '''Attribute [[2.08]]'''
| |
| '''<big>Oversight for the Internal Control System</big>'''
| |
| * '''Attribute [[2.09]]'''
| |
| * '''Attribute [[2.10]]'''
| |
| '''<big>Input for Remediation of Deficiencies</big>'''
| |
| * '''Attribute [[2.11]]'''
| |
| * '''Attribute [[2.12]]'''
| |
| * '''Attribute [[2.13]]'''
| |
|
| |
| ==== '''Principle 3 - Establish Structure, Responsibility, and Authority''' ====
| |
|
| |
| * '''Attribute [[3.01]]'''
| |
|
| |
| '''<big>Organizational Structure</big>'''
| |
|
| |
| * '''Attribute [[3.02]]'''
| |
| * '''Attribute [[3.03]]'''
| |
| * '''Attribute [[3.04]]'''
| |
| * '''Attribute [[3.05]]'''
| |
|
| |
| '''<big>Assignment of Responsibility and Delegation of Authority</big>'''
| |
|
| |
| * '''Attribute [[3.06]]'''
| |
| * '''Attribute [[3.07]]'''
| |
| * '''Attribute [[3.08]]'''
| |
|
| |
| '''<big>Documentation of the Internal Control System</big>'''
| |
|
| |
| * '''Attribute [[3.09]]'''
| |
| * '''Attribute [[3.10]]'''
| |
| * '''Attribute [[3.11]]'''
| |
| * '''Attribute [[3.12]]'''
| |
|
| |
| ==== '''Principle 4 - Demonstrate Commitment to Competence''' ====
| |
|
| |
| * '''Attribute [[4.01]]'''
| |
|
| |
| '''<big>Expectations of Competence</big>'''
| |
|
| |
| * '''Attribute [[4.02]]'''
| |
| * '''Attribute [[4.03]]'''
| |
| * '''Attribute [[4.04]]'''
| |
|
| |
| '''<big>Recruitment, Development, and Retention of Individuals</big>'''
| |
|
| |
| * '''Attribute [[4.05]]'''
| |
|
| |
| '''<big>Succession and Contingency Plans and Preparation</big>'''
| |
|
| |
| * '''Attribute [[4.06]]'''
| |
| * '''Attribute [[4.07]]'''
| |
| * '''Attribute [[4.08]]'''
| |
|
| |
| ==== '''Principle 5 - Enforce Accountability''' ====
| |
|
| |
| * '''Attribute [[5.01]]'''
| |
|
| |
| '''<big>Enforcement of Accountability</big>'''
| |
|
| |
| * '''Attribute [[5.02]]'''
| |
| * '''Attribute [[5.03]]'''
| |
| * '''Attribute [[5.04]]'''
| |
| * '''Attribute [[5.05]]'''
| |
| * '''Attribute [[5.06]]'''
| |
|
| |
| '''<big>Consideration of Excessive Pressures</big>'''
| |
|
| |
| * '''Attribute [[5.07]]'''
| |
| * '''Attribute [[5.08]]'''
| |
|
| |
| ==== '''Principle 6 - Define Objectives and Risk Tolerances''' ====
| |
|
| |
| * '''Attribute [[6.01]]'''
| |
|
| |
| '''Definitions of Objectives'''
| |
|
| |
| * '''Attribute [[6.02]]'''
| |
| * '''Attribute [[6.03]]'''
| |
| * '''Attribute [[6.04]]'''
| |
| * '''Attribute [[6.05]]'''
| |
| * '''Attribute [[6.06]]'''
| |
| * '''Attribute [[6.07]]'''
| |
|
| |
| '''Definitions of Risk Tolerances'''
| |
|
| |
| * '''Attribute [[6.08]]'''
| |
| * '''Attribute [[6.09]]'''
| |
| * '''Attribute [[6.10]]'''
| |
|
| |
| ==== '''Principle 7 - Identify, Analyze, and Respond to Risks''' ====
| |
|
| |
| * '''Attribute [[7.01]]'''
| |
|
| |
| '''<big>Identify Risks</big>'''
| |
|
| |
| * '''Attribute [[7.02]]'''
| |
| * '''Attribute [[7.03]]'''
| |
|
| |
| * '''Attribute [[7.04]]'''
| |
| * '''Attribute [[7.05]]'''
| |
| * '''Attribute [[7.06]]'''
| |
|
| |
| '''<big>Analyze Risks</big>'''
| |
|
| |
| * '''Attribute [[7.07]]'''
| |
| * '''Attribute [[7.08]]'''
| |
| * '''Attribute [[7.09]]'''
| |
|
| |
| '''<big>Respond to Risks</big>'''
| |
|
| |
| * '''Attribute [[7.10]]'''
| |
| * '''Attribute [[7.11]]'''
| |
| * '''Attribute [[7.12]]'''
| |
| * '''Attribute [[7.13]]'''
| |
| * '''Attribute [[7.14]]'''
| |
| * '''Attribute [[7.15]]'''
| |
|
| |
| ==== '''Principle 8 - Assess Fraud, Improper Payment, and Informati<big>on</big>''' ====
| |
|
| |
| * '''Attribute [[8.01]]'''
| |
|
| |
| '''<big>Identify Risks Related to Fraud, Improper Payments, and Information Security</big>'''
| |
|
| |
| * '''Attribute [[8.02]]'''
| |
| * '''Attribute [[8.03]]'''
| |
| * '''Attribute [[8.04]]'''
| |
| * '''Attribute [[8.05]]'''
| |
|
| |
| '''<big>Types of Fraud and Fraud Risk Factors</big>'''
| |
|
| |
| * '''Attribute [[8.06]]'''
| |
| * '''Attribute [[8.07]]'''
| |
| * '''Attribute [[8.08]]'''
| |
| * '''Attribute [[8.09]]'''
| |
| * '''Attribute [[8.10]]'''
| |
|
| |
| '''<big>Types of Improper Payments and Improper Payment Risk Factors</big>'''
| |
|
| |
| * '''Attribute [[8.11]]'''
| |
| * '''Attribute [[8.12]]'''
| |
|
| |
| * '''Attribute [[8.13]]'''
| |
|
| |
| '''<big>Types of Information Security Risk and Information Security Risk Factors</big>'''
| |
|
| |
| * '''Attribute [[8.14]]'''
| |
| * '''Attribute [[8.15]]'''
| |
| * '''Attribute [[8.16]]'''
| |
| * '''Attribute [[8.17]]'''
| |
|
| |
| '''<big>Analyze and Respond to Identified Risks</big>'''
| |
|
| |
| * '''Attribute [[8.18]]'''
| |
| * '''Attribute [[8.19]]'''
| |
| * '''Attribute [[8.20]]'''
| |
|
| |
| ==== '''Principle 9 - Identify, Analyze, and Respond to Change''' ====
| |
|
| |
| * '''Attribute [[9.01]]'''
| |
|
| |
| '''<big>Identify Significant Changes</big>'''
| |
|
| |
| * '''Attribute [[9.02]]'''
| |
| * '''Attribute [[9.03]]'''
| |
| * '''Attribute [[9.04]]'''
| |
|
| |
| '''<big>Establish a Change Assessment Process</big>'''
| |
|
| |
| * '''Attribute [[9.05]]'''
| |
| * '''Attribute [[9.06]]'''
| |
| * '''Attribute [[9.07]]'''
| |
| * '''Attribute [[9.08]]'''
| |
| * '''Attribute [[9.09]]'''
| |
| * '''Attribute [[9.10]]'''
| |
|
| |
| '''<big>Identify, Analyze and Respond to Risks Related to Significant Changes</big>'''
| |
|
| |
| * '''Attribute [[9.11]]'''
| |
| * '''Attribute [[9.12]]'''
| |
| * '''Attribute [[9.13]]'''
| |
|
| |
| ==== '''Principle 10 - Design Control Activities''' ====
| |
|
| |
| * '''Attribute [[10.01]]'''
| |
|
| |
| '''<big>Response to Risks</big>'''
| |
|
| |
| * '''Attribute [[10.02]]'''
| |
|
| |
| '''<big>Design of Appropriate Types of Control Activities</big>'''
| |
|
| |
| * '''Attribute [[10.03]]'''
| |
| * '''Attribute [[10.04]]'''
| |
|
| |
| '''<big>Design of Automated and Manual Control Activities</big>'''
| |
|
| |
| * '''Attribute [[10.05]]'''
| |
| * '''Attribute [[10.06]]'''
| |
| * '''Attribute [[10.07]]'''
| |
| * '''Attribute [[10.08]]'''
| |
| * '''Attribute [[10.09]]'''
| |
|
| |
| '''<big>Design of Preventive and Detective Control Activities</big>'''
| |
|
| |
| * '''Attribute [[10.10]]'''
| |
| * '''Attribute [[10.11]]'''
| |
| * '''Attribute [[10.12]]'''
| |
| * '''Attribute [[10.13]]'''
| |
|
| |
| '''<big>Design of Control Activities at Various Levels</big>'''
| |
|
| |
| * '''Attribute [[10.14]]'''
| |
| * '''Attribute [[10.15]]'''
| |
| * '''Attribute [[10.16]]'''
| |
| * '''Attribute [[10.17]]'''
| |
| * '''Attribute [[10.18]]'''
| |
| * '''Attribute [[10.19]]'''
| |
| * '''Attribute [[10.20]]'''
| |
|
| |
| '''<big>Segregation of Duties</big>'''
| |
|
| |
| * '''Attribute [[10.21]]'''
| |
| * '''Attribute [[10.22]]'''
| |
| * '''Attribute [[10.23]]'''
| |
|
| |
| ==== '''Principle 11 - Design General Control Activities over Information''' ====
| |
|
| |
| * '''Attribute [[11.01]]'''
| |
|
| |
| '''<big>Response to Risks</big>'''
| |
|
| |
| * '''Attribute [[11.02]]'''
| |
|
| |
| '''<big>Design of the Entity’s Information Technology</big>'''
| |
|
| |
| * '''Attribute [[11.03]]'''
| |
| * '''Attribute [[11.04]]'''
| |
| * '''Attribute [[11.05]]'''
| |
| * '''Attribute [[11.06]]'''
| |
|
| |
| '''<big>Design of Appropriate Types of General Control Activities</big>'''
| |
|
| |
| * '''Attribute [[11.07]]'''
| |
| * '''Attribute [[11.08]]'''
| |
| * '''Attribute [[11.09]]'''
| |
| * '''Attribute [[11.10]]'''
| |
| * '''Attribute [[11.11]]'''
| |
| * '''Attribute [[11.12]]'''
| |
| * '''Attribute [[11.13]]'''
| |
| * '''Attribute [[11.14]]'''
| |
| * '''Attribute [[11.15]]'''
| |
| * '''Attribute [[11.16]]'''
| |
| * '''Attribute [[11.17]]'''
| |
|
| |
| ==== '''Principle 12 - Implement Control Activities''' ====
| |
|
| |
| * '''Attribute [[12.01]]'''
| |
|
| |
| '''Documentation of Control Activities Through Policies and Procedures'''
| |
|
| |
| * '''Attribute [[12.02]]'''
| |
| * '''Attribute [[12.03]]'''
| |
| * '''Attribute [[12.04]]'''
| |
|
| |
| '''<big>Periodic Review of Control Activities</big>'''
| |
|
| |
| * '''Attribute [[12.05]]'''
| |
|
| |
| ==== '''Principle 13 - Use Quality Information''' ====
| |
|
| |
| * '''Attribute [[13.01]]'''
| |
|
| |
| '''<big>Identification of Information Requirements</big>'''
| |
|
| |
| * '''Attribute [[13.02]]'''
| |
| * '''Attribute [[13.03]]'''
| |
|
| |
| '''<big>Relevant Data from Reliable Sources</big>'''
| |
|
| |
| * '''Attribute [[13.04]]'''
| |
|
| |
| '''<big>Data Processed into Quality Information</big>'''
| |
|
| |
| * '''Attribute [[13.05]]'''
| |
| * '''Attribute [[13.06]]'''
| |
| * '''Attribute [[13.07]]'''
| |
|
| |
| ==== '''Principle 14 - Communicate Internally''' ====
| |
|
| |
| * '''Attribute [[14.01]]'''
| |
|
| |
| '''<big>Communication Throughout the Entity</big>'''
| |
|
| |
| * '''Attribute [[14.02]]'''
| |
| * '''Attribute [[14.03]]'''
| |
| * '''Attribute [[14.04]]'''
| |
| * '''Attribute [[14.05]]'''
| |
| * '''Attribute [[14.06]]'''
| |
|
| |
| '''<big>Appropriate Methods of Communication</big>'''
| |
|
| |
| * '''Attribute [[14.07]]'''
| |
| * '''Attribute [[14.08]]'''
| |
|
| |
| ==== '''Principle 15 - Communicate Externally''' ====
| |
|
| |
| * '''Attribute [[15.01]]'''
| |
|
| |
| '''<big>Communication with External Parties</big>'''
| |
|
| |
| * '''Attribute [[15.02]]'''
| |
| * '''Attribute [[15.03]]'''
| |
| * '''Attribute [[15.04]]'''
| |
| * '''Attribute [[15.05]]'''
| |
| * '''Attribute [[15.06]]'''
| |
|
| |
| '''<big>Appropriate Methods of Communication</big>'''
| |
|
| |
| * '''Attribute [[15.07]]'''
| |
| * '''Attribute [[15.08]]'''
| |
| * '''Attribute [[15.09]]'''
| |
|
| |
| ==== '''Principle 16 - Perform Monitoring Activities''' ====
| |
|
| |
| * '''Attribute [[16.01]]'''
| |
|
| |
| '''<big>Establishment of a Baseline</big>'''
| |
|
| |
| * '''Attribute [[16.02]]'''
| |
| * '''Attribute [[16.03]]'''
| |
|
| |
| '''<big>Internal Control System Monitoring</big>'''
| |
|
| |
| * '''Attribute [[16.04]]'''
| |
| * '''Attribute [[16.05]]'''
| |
| * '''Attribute [[16.06]]'''
| |
| * '''Attribute [[16.07]]'''
| |
| * '''Attribute [[16.08]]'''
| |
|
| |
| '''<big>Evaluation of Results</big>'''
| |
|
| |
| * '''Attribute [[16.09]]'''
| |
| * '''Attribute [[16.10]]'''
| |
|
| |
| ==== '''Principle 17 - Evaluate Issues and Remediate Deficiencies''' ====
| |
|
| |
| * '''Attribute [[17.01]]'''
| |
|
| |
| '''<big>Reporting of Issues</big>'''
| |
|
| |
| * '''Attribute [[17.02]]'''
| |
| * '''Attribute [[17.03]]'''
| |
| * '''Attribute [[17.04]]'''
| |
|
| |
| '''<big>Evaluation of Issues</big>'''
| |
|
| |
| * '''Attribute [[17.05]]'''
| |
|
| |
| '''<big>Corrective Actions</big>'''
| |
|
| |
| * '''Attribute [[17.06]]'''
| |
| * '''Attribute [[17.07]]'''
| |
| * '''Attribute [[17.08]]'''
| |
