Requirement
The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
Points of Focus
Considers a Mix of Ongoing and Separate Evaluations
Requirement: Management includes a balance of ongoing and separate evaluations.
Considers Rate of Change
Requirement: Management considers the rate of change in business and business processes when selecting and developing ongoing and separate evaluations.
Establishes Baseline Understanding
Requirement: The design and current state of an internal control system are used to establish a baseline for ongoing and separate evaluations.
Uses Knowledgeable Personnel
Requirement: Evaluators performing ongoing and separate evaluations have sufficient knowledge to understand what is being evaluated.
Integrates With Business Processes
Requirement: Ongoing evaluations are built into the business processes and adjust to changing conditions.
Adjusts Scope and Frequency
Requirement: Management varies the scope and frequency of separate evaluations depending on risk.
Objectively Evaluates
Requirement: Separate evaluations are performed periodically to provide objective feedback.
Considers Different Types of Ongoing and Separate Evaluations
Requirement: Management uses a variety of ongoing and separate risk and control evaluations to determine whether internal controls are present and functioning. Depending on the entity’s objectives, such risk and control evaluations may include first- and second-line monitoring and control testing, internal audit assessments, compliance assessments, resilience assessments, vulnerability scans, security assessment, penetration testing, and third-party assessments.
Explanation
Having controls is not enough; the organization must check that they are actually present and working. This means a mix of continuous monitoring built into daily operations and periodic independent evaluations such as internal audits, vulnerability scans, and penetration tests. Auditors want evidence these evaluations are planned, risk-based, and performed by knowledgeable people.
