9.08

Risk Assessment

Principle 9 - Identify, Analyze, and Respond to Change

Attribute 9.08 - Management's change assessment process includes steps for timely identifying risks related to significant change, which may include the following:

• the need to provide complex or different services quickly, which may result in increased risks overall, including those related to fraud, improper payments, information security, and noncompliance with applicable laws and regulations;
• ability to design and implement preventive control activities timely due to legal requirements or urgency to deliver a service quickly;
• ability to timely communicate relevant and quality information both internally and externally to support the internal control system, such as changes to identified risks, internal control responsibilities, and training on how to administer new internal controls;
• availability of existing resources, such as workforce capacity or availability of data (i.e., data-sharing agreements for external data), to adequately and timely adapt the entity's internal control system to address new or increased risks; and
• known internal control deficiencies that could increase risks related to significant change.

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute - ?
• Next Attribute - ?