Principle 13 - Use Quality Information

13.0 Use Quality Information

External Link to US GAO Green Book Principle 13

Overview

13.01

Management should obtain or generate relevant, quality information and use it to support the functioning of the internal control system.

13.1 Identification of Information Requirements

13.02

Management designs a process that uses the entity’s objectives and related risks to identify the information requirements needed to support the internal control system. Information requirements consider the needs of both internal and external users. Management defines the identified information requirements at the relevant level and requisite specificity for appropriate personnel.

13.03

Management identifies information requirements in an iterative and ongoing process that occurs throughout the design, implementation, and operation of an effective internal control system. An entity’s controls within the five components of internal control establish information requirements. As change in the entity and its objectives and risks occurs, management changes information requirements as needed to meet these modified objectives and address these modified risks. Management establishes information requirements through policies and procedures, with clear responsibility and accountability for the quality of information. These information requirements are communicated both internally and externally, such as with service organizations.

13.2 Relevant Data from Reliable Sources

13.04

Management obtains or generates relevant data from reliable internal and external sources in a timely manner based on the identified information requirements. Relevant data have a logical connection with, or bearing upon, the identified information requirements. Reliable internal and external sources provide data that are reasonably free from error and bias and faithfully represent what they purport to represent. Management evaluates both internal and external sources of data for reliability. Management obtains relevant data through a variety of forms, including using manual input or compilation, using information technology, or coordinating with other entities to obtain or access data.[1] Sources of data can be operational, reporting, or compliance related. Management obtains data on a timely basis so that they can be used for effective monitoring.

13.3 Data Processed into Quality Information

13.05

Management processes relevant data obtained or generated from reliable sources into quality information through the entity’s information system. The entity’s information system comprises the people, processes, data, and information technology that management uses to obtain, generate, communicate, or dispose of information to support the entity’s business processes.

13.06

Management develops the entity’s information system to obtain, generate, and process relevant data into quality information to meet the identified information requirements needed to support the internal control system. Information processing can be manual, automated through the use of information technology, or a combination of both.

13.07

Management evaluates the processed information to determine whether it is quality information. Quality information meets the identified information requirements when relevant data from reliable sources are used. Quality information is appropriate, current, complete, accurate, accessible, verifiable, retained as appropriate, and provided on a timely basis. Management considers these characteristics and the information processing and information security objectives in evaluating processed information, and makes revisions when necessary, so that the information is quality information. Management uses the quality information to make informed decisions and evaluate the entity’s performance in achieving key objectives, addressing risks, and fulfilling internal control responsibilities.

Assessment Observations Compared to Green Book Components, Principles, & Attributes

Control Environment

Component: Control Environment - The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives.

• Principle 1 - Demonstrate Commitment to Integrity and Ethical Values
  • Attributes (1.01, 1.02, 1.03, 1.04, 1.05, 1.06, 1.07, 1.08, 1.09, 1.10)

• Principle 2 - Exercise Oversight Responsibility
  • Attributes (2.01, 2.02, 2.03, 2.04, 2.05, 2.06, 2.07, 2.08, 2.09, 2.10, 2.11, 2.12, 2.13)

• Principle 3 - Establish Structure, Responsibility, and Authority
  • Attributes (3.01, 3.02, 3.03, 3.04, 3.05, 3.06, 3.07, 3.08, 3.09, 3.10, 3.11, 3.12)

• Principle 4 - Demonstrate Commitment to Competence
  • Attributes (4.01, 4.02, 4.03, 4.04, 4.05, 4.06, 4.07, 4.08)
• Principle 5 - Enforce Accountability
  • Attributes (5.01, 5.02, 5.03, 5.04, 5.05, 5.06, 5.07, 5.08)

Risk Assessment

Component: Risk Assessment - The identification and analysis of risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses.

• Principle 6 - Define Objectives and Risk Tolerances
  • Attributes (6.01, 6.02, 6.03, 6.04, 6.05, 6.06, 6.07, 6.08, 6.09, 6.10)
• Principle 7 - Identify, Analyze, and Respond to Risks
  • Attributes (7.01, 7.02, 7.03, 7.04, 7.05, 7.06, 7.07, 7.08, 7.09, 7.10, 7.11, 7.12, 7.13, 7.14, 7.15)
• Principle 8 - Assess Fraud, Improper Payment, and Information
  • Attributes (8.01, 8.02, 8.03, 8.04, 8.05, 8.06, 8.07, 8.08, 8.09, 8.10, 8.11, 8.12, 8.13, 8.14, 8.15, 8.16, 8.17, 8.18, 8.19, 8.20)
• Principle 9 - Identify, Analyze, and Respond to Change
  • Attributes (9.01, 9.02, 9.03, 9.04, 9.05, 9.06, 9.07, 9.08, 9.09, 9.10, 9.11, 9.12, 9.13)

Control Activities

Component: Control Activities - The actions management establishes through policies and procedures to mitigate risks to achieving the entity's objectives to acceptable levels.

• Principle 10 - Design Control Activities
  • Attributes (10.01, 10.02, 10.03, 10.04, 10.05, 10.06, 10.07, 10.08, 10.09, 10.10, 10.11, 10.12, 10.13, 10.14, 10.15, 10.16, 10.17, 10.18, 10.19, 10.20, 10.21, 10.22, 10.23)
• Principle 11 - Design General Control Activities over Information
  • Attributes (11.01, 11.02, 11.03, 11.04, 11.05, 11.06, 11.07, 11.08, 11.09, 11.10, 11.11, 11.12, 11.13, 11.14, 11.15, 11.16, 11.17)
• Principle 12 - Implement Control Activities
  • Attributes (12.01, 12.02, 12.03, 12.04, 12.05)

Information and Communication

Component: Information and Communication - The quality information management and other personnel communicate and use to support the internal control system.

• Principle 13 - Use Quality Information
  • Attributes (13.01, 13.02, 13.03, 13.04, 13.05, 13.06, 13.07)
• Principle 14 - Communicate Internally
  • Attributes (14.01, 14.02, 14.03, 14.04, 14.05, 14.06, 14.07, 14.08)
• Principle 15 - Communicate Externally
  • Attributes (15.01, 15.02, 15.03, 15.04, 15.05, 15.06, 15.07, 15.08, 15.09)

Monitoring

Component: Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews.

• Principle 16 - Perform Monitoring Activities
  • Attributes (16.01, 16.02, 16.03, 16.04, 16.05, 16.06, 16.07, 16.08, 16.09, 16.10)
• Principle 17 - Evaluate Issues and Remediate Deficiencies
  • Attributes (17.01, 17.02, 17.03, 17.04, 17.05, 17.06, 17.07, 17.08)

Related Story Events

• ❓ 2001: The Journey Begins — Information Gaps