Requirement
The entity identifies and assesses changes that could significantly impact the system of internal control.
Points of Focus
Assesses Changes in the External Environment
Requirement: The risk identification process considers changes to the regulatory, economic, and physical environment in which the entity operates.
Assesses Changes in the Business Model
Requirement: The entity considers the potential impacts of new business lines, dramatically altered compositions of existing business lines, acquired or divested business operations on the system of internal control, rapid growth, changing reliance on foreign geographies, and new technologies.
Assesses Changes in Leadership
Requirement: The entity considers changes in management and respective attitudes and philosophies on the system of internal control.
Assesses Changes in Systems and Technology
Requirement: The risk identification process considers changes arising from changes in the entity’s systems and changes in the technology environment.
Assesses Changes in Vendor and Business Partner Relationships
Requirement: The risk identification process considers changes in vendor and business partner relationships.
Assesses Changes in Threats and Vulnerabilities
Requirement: The risk identification process assesses changes in (1) internal and external threats to and vulnerabilities of the components of the entity’s systems and (2) the likelihood and magnitude of the resultant risks to the achievement of the entity’s objectives.
Explanation
Controls that worked yesterday can fail when circumstances change. The organization must watch for significant changes — new regulations, business models, leadership, systems, technology, or vendor relationships — and reassess its risks when they occur. Auditors look for evidence that change triggers risk re-evaluation rather than the assessment going stale.
