Requirement
The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity’s objectives.
Points of Focus
Defines Processing Specifications
Requirement: The processing specifications that are necessary to meet product or service requirements are defined.
Defines Processing Activities
Requirement: Processing activities are defined to result in products or services that meet specifications.
Detects and Corrects Processing or Production Activity Errors
Requirement: Errors encountered in processing or production activities are detected and corrected in a timely manner.
Records System Processing Activities
Requirement: System processing activities are recorded completely and accurately in a timely manner.
Processes Inputs
Requirement: Inputs are processed completely, accurately, and timely as authorized in accordance with defined processing activities.
Explanation
Once data enters the system, processing must follow defined specifications so the results actually meet product and service requirements. The entity needs documented processing activities, timely detection and correction of errors, and complete records of what was processed. Auditors care because undetected processing errors silently corrupt everything downstream.
