Requirement
The entity also selects and develops general control activities over technology to support the achievement of objectives.
Points of Focus
Determines Dependency Between the Use of Technology in Business Processes and Technology General Controls
Requirement: Management understands and determines the dependency and linkage between business processes, automated control activities, and technology general controls.
Establishes Relevant Technology Infrastructure Control Activities
Requirement: Management selects and develops control activities over the technology infrastructure, which are designed and implemented to help ensure the completeness, accuracy, and availability of technology processing.
Establishes Relevant Security Management Process Controls Activities
Requirement: Management selects and develops control activities that are designed and implemented to restrict technology access rights to authorized users commensurate with their job responsibilities and to protect the entity’s assets from external threats.
Establishes Relevant Technology Acquisition, Development, and Maintenance Process Control Activities
Requirement: Management selects and develops control activities over the acquisition, development, and maintenance of technology and its infrastructure to achieve management’s objectives.
Explanation
Business controls depend on the technology underneath them, so the organization needs general controls over the technology itself: infrastructure that processes completely and accurately, access restricted to authorized users, and disciplined acquisition, development, and maintenance of systems. Auditors test these because a weak technology layer undermines every control built on it.
