New pages

16 August 2026

• 11:1711:17, 16 August 2026 13.01 (hist | edit) [667 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Information and Communication''' '''Principle 13 - Use Quality Information''' '''Attribute 13.01''' - Management should obtain or generate relevant, quality information and use it to support the functioning of the internal control system. <u>Attributes</u> The following attributes contribute to the design, implementation, and operating effectiveness of this principle: * Identification of Information Requirements * Relevant Data from Reliable Sources * Data Proces...") Tag: Visual edit
• 11:1211:12, 16 August 2026 12.05 (hist | edit) [1,313 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 12 - Implement Control Activities''' '''Attribute 12.05''' - Management reviews policies, procedures, and related control activities on a periodic and ongoing basis for continued relevance and effectiveness in achieving the entity's objectives or mitigating related risks. If there is a significant change in an entity's process, management reviews this process in a timely manner after the change to determine that the control activit...") Tag: Visual edit
• 11:1011:10, 16 August 2026 12.04 (hist | edit) [788 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 12 - Implement Control Activities''' '''Attribute 12.04''' - Those in key roles for the unit may further define policies through day-to-day procedures, depending on the rate of change in the operating environment and complexity of the business process. Procedures may include the timing of when a control activity occurs and any follow-up corrective actions to be performed by competent personnel if deficiencies are identified. Manage...") Tag: Visual edit
• 11:0911:09, 16 August 2026 12.03 (hist | edit) [943 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 12 - Implement Control Activities''' '''Attribute 12.03''' - Management documents in policies and procedures for each unit within the entity's organizational structure its responsibility for a business process's objectives and related risks and control activity design, implementation, and operating effectiveness. Each unit, with guidance from management, determines the policies necessary to operate the business process based on the...") Tag: Visual edit
• 11:0711:07, 16 August 2026 12.02 (hist | edit) [584 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 12 - Implement Control Activities''' '''Attribute 12.02''' - Management establishes control activities by documenting in policies what is expected and in procedures specified actions that implement policies, to mitigate risks to achieving the entity's objectives to acceptable levels ['''documentation requirement''']. Note: The GAO emphasized "'''documentation requirements."'''") Tag: Visual edit
• 11:0411:04, 16 August 2026 12.01 (hist | edit) [589 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 12 - Implement Control Activities''' '''Attribute 12.01''' - Management should implement control activities through policies and procedures. <u>Attributes</u> The following attributes contribute to the design, implementation, and operating effectiveness of this principle: * Documentation of Control Activities Through Policies and Procedures * Periodic Review of Control Activities") Tag: Visual edit
• 01:5001:50, 16 August 2026 11.17 (hist | edit) [864 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.17''' - Contingency planning protects critical and sensitive data against loss and allows for critical operations to continue without disruption or be promptly resumed when unexpected events occur. Maintaining technology through contingency planning often includes backup and recovery procedures, as well as continuity of operations plans, depending...") Tag: Visual edit
• 01:4901:49, 16 August 2026 11.16 (hist | edit) [880 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.16''' - Segregation of duties control activities help prevent fraud, waste, and abuse from being executed using information technology in the internal control system and mitigate the risk of management override of automated processes. Management considers the need to separate responsibilities for control activities related to the entity's informat...") Tag: Visual edit
• 01:4801:48, 16 August 2026 11.15 (hist | edit) [1,138 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.15''' - Control activities for changing information technology prevent unauthorized or untested modifications to existing systems. To reasonably assure that changes to the configuration of information technology are necessary, work as intended, and do not cause loss of data or program integrity, changes go through a formal change management proces...") Tag: Visual edit
• 01:4601:46, 16 August 2026 11.14 (hist | edit) [1,590 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.14''' - Control activities for maintaining information technology include identifying vulnerabilities to patch and other functional updates to be made. Management continuously monitors the entity's information technology to establish a baseline for evaluating performance, detecting underlying deficiencies before they negatively impact users, colle...") Tag: Visual edit
• 01:4501:45, 16 August 2026 11.13 (hist | edit) [1,240 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.13''' - Control activities for developing information technology, commonly referred to as systems development controls, prevent the use of unauthorized or untested systems. Management may internally develop information technology, acquire it from suppliers, or outsource its development to service organizations. Management incorporates methodologie...") Tag: Visual edit
• 01:4401:44, 16 August 2026 11.12 (hist | edit) [977 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.12''' - Configuration management control activities involve the identification and management of operating and security features for information technology (i.e., infrastructure, platforms, and software) throughout the technology development process. Management may use a technology development methodology to provide a structure for a new informati...") Tag: Visual edit
• 01:4401:44, 16 August 2026 11.11 (hist | edit) [1,409 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.11''' - Logical and physical access control activities include restricting access or detecting inappropriate access to information and information technology. They protect information technology resources against unauthorized access, use, disclosure, disruption, modification, or destruction, whether from malicious intent or error. Logical access c...") Tag: Visual edit
• 01:4201:42, 16 August 2026 11.10 (hist | edit) [598 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.10''' - Security management is the ongoing process for mitigating information security risks as part of the entity's overall internal control system (sometimes referred to as a security management program). This ongoing process covers all components of internal control related to information security risks.") Tag: Visual edit
• 01:4101:41, 16 August 2026 11.09 (hist | edit) [1,326 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.09''' - General control activities may be applied at the entity, system, and business process levels. General control activities include the following: * '''Security management''' - A separate process, addressing all components of internal control, for responding to risks related to information security. * '''Logical and physical access''' - Cont...") Tag: Visual edit
• 01:4001:40, 16 August 2026 11.08 (hist | edit) [593 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.08''' - The nature, timing, and precision of general control activities will depend on various factors, such as the complexity of the technology, sensitivity of information, use of service organizations, use of shared service or data centers, and risk of the underlying business process being supported.") Tag: Visual edit
• 01:3901:39, 16 August 2026 11.07 (hist | edit) [1,503 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.07''' - Management designs appropriate types of general control activities to mitigate information security risks. General control activities are the actions established through policies and procedures that apply to all or a large segment of an entity's information technology. They support the proper operation of the entity's information technol...") Tag: Visual edit
• 01:3701:37, 16 August 2026 11.06 (hist | edit) [1,263 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.06''' - Management designs the information technology infrastructure to support the entity's business processes. Information technology requires a physical infrastructure in which to operate, including communication networks for linking information technologies, computing resources for software and platforms to operate, and electricity to power th...") Tag: Visual edit
• 01:3601:36, 16 August 2026 11.05 (hist | edit) [1,120 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.05''' - nformation technology consists of the infrastructure, platforms, and software used to automate processes. Infrastructure comprises the physical information technology resources necessary to run software, including the hardware and devices used for information processing, data storage, and network communication. Infrastructure also includes...") Tag: Visual edit
• 01:3501:35, 16 August 2026 11.04 (hist | edit) [1,000 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.04''' - Management designs the entity's use of information technology in the information system by considering the defined information requirements for each of the entity's business processes. Information technology incorporated into business processes enables information related to those processes to become available to the entity on a timelier b...") Tag: Visual edit
• 01:3401:34, 16 August 2026 11.03 (hist | edit) [568 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.03''' - Management designs information technology to support the entity's information system and business processes. The entity's information system includes both manual and automated processes. Automated processes are wholly or partially performed using information technology.") Tag: Visual edit
• 01:3301:33, 16 August 2026 11.02 (hist | edit) [869 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.02''' - Management designs general control activities over the entity's information technology to mitigate risks to information security. Information security is the protection of information or information technology from unauthorized access, use, disclosure, disruption, modification, or destruction to provide confidentiality, integrity, and avai...") Tag: Visual edit
• 01:3201:32, 16 August 2026 11.01 (hist | edit) [717 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.''' - Management should design general control activities over information technology to mitigate risks to achieving the entity's objectives to acceptable levels. <u>Attributes</u> The following attributes contribute to the design, implementation, and operating effectiveness of this principle: * Response to Risks * Design of the Entity's Info...") Tag: Visual edit
• 01:1901:19, 16 August 2026 10.23 (hist | edit) [497 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.23''' -If segregation of duties is not practical within a business process because of limited personnel or other factors, management designs alternative control activities to mitigate the risk of fraud, waste, or abuse in the business process.") Tag: Visual edit
• 01:1801:18, 16 August 2026 10.22 (hist | edit) [934 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.22''' - Segregation of duties helps prevent fraud, waste, and abuse in the internal control system. Management considers the need to separate control activities related to authority, custody, and accounting of operations to achieve adequate segregation of duties within the entity's business processes. Segregation of duties can mitigate the risk of management override. Management ove...") Tag: Visual edit
• 01:1601:16, 16 August 2026 10.21 (hist | edit) [493 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.21''' - Management considers segregation of duties in designing control activities so that incompatible duties are segregated. Where such segregation is not practical, management designs alternative control activities to mitigate the risk.") Tag: Visual edit
• 01:1501:15, 16 August 2026 10.20 (hist | edit) [1,616 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.20''' - When designing entity-level and transaction control activities, management evaluates the level of precision needed for the business processes to meet the entity's objectives and mitigate related risks. The precision of a control activity refers to how exact the control activity will be in preventing or detecting an unintended event or result. Control activity precision is cl...") Tag: Visual edit
• 01:1401:14, 16 August 2026 10.19 (hist | edit) [622 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.19''' - While the information processing objectives are most often associated with financial processes and transactions, information processing objectives can be applied to any activity in an organization. For example, information processing objectives and related control activities can be applied to management's decision-making processes that use nonfinancial data.") Tag: Visual edit
• 01:1301:13, 16 August 2026 10.18 (hist | edit) [839 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.18''' - When designing transaction control activities, management evaluates information processing objectives to meet the entity's objectives and mitigate related risks.⁸⁹ Information processing objectives may include the following: * '''Completeness''' - All transactions and events that occur have been properly recorded. * '''Accuracy''' - Data relating to transactions...") Tag: Visual edit
• 01:1101:11, 16 August 2026 10.17 (hist | edit) [996 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.17''' - Transaction control activities are controls that directly mitigate information processing risks in the entity's business processes. The term transaction tends to be associated with business processes addressing reporting objectives (e.g., financial transactions), while the term activity is more often associated with business processes addressing operations or compliance obje...") Tag: Visual edit
• 01:0901:09, 16 August 2026 10.16 (hist | edit) [647 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.16''' - Entity-level control activities are controls designed to mitigate risks that have a pervasive effect on an entity's internal control system and may pertain to multiple components. Entity-level control activities may include controls related to the entity's risk assessment process, control environment, service organizations, management override, and performance or analytical...") Tag: Visual edit
• 01:0601:06, 16 August 2026 10.15 (hist | edit) [924 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.15''' -") Tag: Visual edit
• 01:0601:06, 16 August 2026 10.14 (hist | edit) [358 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.14''' - Management designs control activities at the appropriate levels in the organizational structure.") Tag: Visual edit
• 01:0501:05, 16 August 2026 10.13 (hist | edit) [829 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.13''' - There may be rare situations where management determines through its evaluation that a preventive control activity would better mitigate a particular risk but is unable to implement it. In these situations, management strengthens and expedites detective control activities and may also expedite monitoring activities to enable the entity to effectively mitigate the risk to acc...") Tag: Visual edit
• 01:0401:04, 16 August 2026 10.12 (hist | edit) [849 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.12''' - Management designs an appropriate mix of preventive and detective control activities to mitigate risks to an acceptable level, prioritizing preventive control activities where appropriate. When designing control activities, management first considers preventive control activities, as they generally offer the most cost-efficient use of resources and are generally effective at...") Tag: Visual edit
• 01:0301:03, 16 August 2026 10.11 (hist | edit) [902 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute 10.11''' - Management evaluates the purpose of the control activity as well as the likelihood of an unintended event or result occurring and the magnitude of impact it would have on the entity in achieving its objectives. Management may design both preventive and detective control activities to effectively mitigate the risks to achieving the objectives, particularly in circumstances wh...") Tag: Visual edit
• 01:0101:01, 16 August 2026 10.10 (hist | edit) [963 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute''' '''10.10''' - Control activities can be either preventive or detective. The main difference between preventive and detective control activities is timing, that is, when the control activity occurs within an entity's operations. A preventive control activity is designed to avoid an unintended event or result before it occurs. A detective control activity is designed to discover and t...") Tag: Visual edit
• 00:5900:59, 16 August 2026 10.09 (hist | edit) [770 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute''' '''10.09''' - Common categories of information technology control activities and how they align with information processing and information security objectives are illustrated in figure 7.⁸⁴ The common categories of information technology control activities listed in figure 7 are meant only to illustrate the range and variety of control activities that may be useful to ma...") Tag: Visual edit
• 00:5800:58, 16 August 2026 10.08 (hist | edit) [786 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute''' '''10.08''' - General control activities are designed to mitigate information security risks and are the actions established through policies and procedures that apply to all or a large segment of an entity's information technology. General control activities support the proper operation of the entity's information technology by creating a suitable environment for effective operatio...") Tag: Visual edit
• 00:5700:57, 16 August 2026 10.07 (hist | edit) [1,076 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute''' '''10.07''' - Application and user control activities rely on the entity's information technology. Application control activities are automated control activities that are incorporated directly into application software to achieve the completeness, accuracy, and validity of transactions and data. Application control activities include control activities over the input, processing, a...") Tag: Visual edit
• 00:5500:55, 16 August 2026 10.06 (hist | edit) [543 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute''' '''10.06''' - Management designs information technology control activities to support the operation and security of the entity's information technology and automated business processes. Information technology control activities consist of general, application, and user control activities.") Tag: Visual edit
• 00:5400:54, 16 August 2026 10.05 (hist | edit) [733 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute''' '''10.05''' - Control activities can be designed and implemented in an automated, partially automated, or a manual manner. Automated control activities may be wholly or partially performed using the entity's information technology. Manual control activities are performed by individuals without relying on the entity's information technology. Automated control activities tend to be mo...") Tag: Visual edit
• 00:5300:53, 16 August 2026 10.04 (hist | edit) [1,394 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute''' '''10.04''' - The common categories of control activities listed in table 1 illustrate the range and variety of control activities that may be useful to management. The list is not all inclusive and may not include all categories of control activities that an entity may need. <u>Common Categories of Control Activities</u> * Top-level reviews of actual performance * Reviews by mana...") Tag: Visual edit
• 00:5000:50, 16 August 2026 10.03 (hist | edit) [1,012 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute''' '''10.03''' - Management designs appropriate types of control activities for the entity's internal control system, including the entity's information technology, by considering all aspects of its internal control components, relevant business processes, and operating environment. An entity's internal control is flexible to allow management to tailor control activities to meet the en...") Tag: Visual edit
• 00:4900:49, 16 August 2026 10.02 (hist | edit) [1,319 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute''' '''10.02''' - Management designs control activities in response to risks to achieve an effective internal control system. Control activities are the actions management establishes through policies and procedures to specifically mitigate risks to achieving the entity's objectives to acceptable levels. Control activities support all the components of internal control but are particula...") Tag: Visual edit
• 00:4800:48, 16 August 2026 10.01 (hist | edit) [778 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Control Activities''' '''Principle 10 - Design Control Activities''' '''Attribute''' '''10.01''' - Management should design control activities to mitigate risks to achieving the entity's objectives to acceptable levels. <u>Attributes</u> The following attributes contribute to the design, implementation, and operating effectiveness of this principle: * Response to Risks * Design of Appropriate Types of Control Activities * Design of Automated and Manual Control...") Tag: Visual edit
• 00:3200:32, 16 August 2026 9.13 (hist | edit) [709 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Risk Assessment''' '''Principle 9 - Identify, Analyze, and Respond to Change''' '''Attribute''' '''9.13''' - Further, changing conditions often prompt new risks or changes to existing risks that need to be assessed. As part of analyzing and responding to significant change, management performs a risk assessment to identify, analyze, and respond to any new risks prompted by the changes. Additionally, existing risk assessments may need to be updated to determine whet...") Tag: Visual edit
• 00:3100:31, 16 August 2026 9.12 (hist | edit) [427 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Risk Assessment''' '''Principle 9 - Identify, Analyze, and Respond to Change''' '''Attribute''' '''9.12''' - Management also performs ongoing risk assessments as the entity responds to changing conditions to analyze and respond to risks on a real-time basis.") Tag: Visual edit
• 00:3000:30, 16 August 2026 9.11 (hist | edit) [1,083 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Risk Assessment''' '''Principle 9 - Identify, Analyze, and Respond to Change''' '''Attribute''' '''9.11''' - Changes in conditions affecting the entity and its environment often require changes to the entity's internal control system, as existing controls may not be effective for meeting objectives or addressing risks under changed conditions. Once significant changes are identified, management uses its change assessment process to identify and analyze the impact of...") Tag: Visual edit
• 00:2900:29, 16 August 2026 9.10 (hist | edit) [1,726 bytes] Neil thibodaux (talk | contribs) (Created page with "'''Risk Assessment''' '''Principle 9 - Identify, Analyze, and Respond to Change''' '''Attribute''' '''9.10''' - Management's change assessment process includes considerations to facilitate its ability to quickly adapt the entity's internal control system and effectively respond to a significant change once it occurs, such as the following: * modifying the organizational structure, responsibilities, and authorities to address identified risks; * determining whether to...") Tag: Visual edit