Requirement
The entity obtains or generates and uses relevant, quality information to support the functioning of internal control.
Points of Focus
Identifies Information Requirements
Requirement: A process is in place to identify the information required and expected to support the functioning of the other components of internal control and the achievement of the entity’s objectives.
Captures Internal and External Sources of Data
Requirement: Information systems capture internal and external sources of data.
Processes Relevant Data Into Information
Requirement: Information systems process and transform relevant data into information.
Maintains Quality Throughout Processing
Requirement: Information systems produce information that is timely, current, accurate, complete, accessible, protected, verifiable, and retained. Information is reviewed to assess its relevance in supporting the internal control components.
Documents Data Flow
Requirement: The entity documents and uses internal and external information and data flows to support the design and operation of controls.
Manages Assets
Requirement: The entity identifies, documents, and maintains records of system components such as infrastructure, software, and other information assets. Information assets include physical endpoint devices and systems, virtual systems, data and data flows, external information systems, and organizational roles.
Classifies Information
Requirement: The entity classifies information by its relevant characteristics (for example, personally identifiable information, confidential customer information, and intellectual property) to support identification of threats to the information and the design and operation of controls.
Uses Information That Is Complete and Accurate
Requirement: The entity uses information and reports that are complete, accurate, current, and valid in the operation of controls.
Manages the Location of Assets
Requirement: The entity identifies, documents, and maintains records of physical location and custody of information assets, particularly for those stored outside the physical security control of the entity (for example, software and data stored on vendor devices or employee mobile phones under a bring-your-own-device policy).
Explanation
The organization must know what information its controls need, capture it from reliable internal and external sources, and keep it accurate, complete, and current — including inventories of systems, data flows, and information classifications. Auditors care because controls that run on incomplete or wrong information produce false assurance.
