{"schema_version":"ICEQC_NEWS_ARTICLE_V1","id":"iceqc-news-63e72d0c21385323","slug":"2017-03-24-record-integrity-in-relation-to-internal-audit","language":"en","publication_status":"READY_FOR_IMPORT","publication_date":"2017-03-24","last_modified_date":"2017-03-24","title":"Record integrity in relation to internal audit","summary":"Clarifies the practical meaning of record integrity in relation to internal audit and the evidence required to support a reliable assurance conclusion.","category":{"code":"STANDARDS_INTERPRETATION","label":"Standards Interpretation"},"article_type":"Standards interpretation","publisher":"International Council for Education Quality Certification (ICEQC)","jurisdictional_scope":"International","historical_reference_basis":"Independent assurance within education providers","reference_authority":"Relevant public authorities and official international sources","sections":[{"heading":null,"paragraphs":["The present attention to record integrity in relation to internal audit follows the independent assurance within education providers and requires a careful distinction between public commitment, institutional practice and demonstrated result. Oversight of the control should reflect the principle that interpretation should begin with the intended outcome, then identify the controls and evidence needed to show that the outcome is achieved across the declared scope. The effect on learner access and reliable decision-making should inform the scale of control applied."]},{"heading":"Scope and application of record integrity in relation to internal audit","paragraphs":["The historical reference basis is the independent assurance within education providers. Its relevance to record integrity in relation to internal audit should be assessed against the affected jurisdiction, learner population and form of provision. In relation to record integrity in relation to internal audit, any consequential application should rest on evidence suited to the affected scope, not on the existence of an international development alone.","Responsibility for the stated expectation should be visible at the point where consequential decisions are made. Oversight of the stated expectation should reflect the principle that a provider should be able to trace the expectation from approved policy through implementation, monitoring, identified exceptions and corrective action. Incomplete evidence, unmanaged conflict, absent learner groups or material learner impact require a higher level of review.","A focused examination of the issue under review requires a clear analytical discipline. For the control, a reliable record should identify what occurred, when it occurred, who was responsible, the authority for the action and any later correction. Records should remain protected against unauthorised alteration while legitimate amendments remain visible. A formally complete record is not reliable if its scope or measure does not correspond to the decision being made.","Relevant evidence for record integrity in relation to internal audit will normally include role-based access and access reviews, lawful authority and consent records where relevant, retention and secure disposal evidence, a register of information assets and purposes, and supplier and transfer arrangements. Evidence outside the relevant period or scope should be identified and given no more weight than its limitations permit. An unresolved contradiction is a limitation on the conclusion and should be reported as such."]},{"heading":"Evidence required","paragraphs":["For record integrity in relation to internal audit, the public interest is not confined to institutional compliance. For the control, education information should be collected for a defined purpose, protected in proportion to its sensitivity and retained only for an authorised period.","Failure in relation to the stated expectation may arise even where the stated policy is reasonable. Material concerns include uncontrolled supplier access or transfer, excessive access to learner information, collection without a defined educational or legal purpose, and secondary use without adequate authority. The assessment of an exception should address severity, persistence and the likelihood that the condition is more widely present."],"bullets":["Control third-party processing.","Test incident and recovery arrangements.","Assign accountable data owners.","Minimise collection.","Verify accuracy where information affects learners."]},{"heading":"Decision criteria and exceptions","paragraphs":["Implementation of record integrity in relation to internal audit can be tested without imposing unnecessary reporting. Review of the control should specify mandatory fields, source ownership, access rights, retention and correction procedures. Test a sample from creation through use, amendment, reporting and disposal, including records created during disruption or by a delivery partner. In relation to record integrity in relation to internal audit, existing records may be used if reliable and relevant, but data collected for another purpose may not answer the assurance question.","The final record on the relevant requirement should identify the applicable expectation, the relevant scope, the evidence examined, the sampling basis, material exceptions and the reason for the conclusion. Departure from an illustrative method may be justified where equivalent outcome and evidence are established. The affected scope should remain open where a material limitation prevents assurance.","Interpretation of the stated expectation should avoid two errors: treating a formal commitment as proof of effect, and treating one adverse case as proof that every part of the system has failed. For the issue under review, security, privacy and data quality are related but distinct. A secure record may still be inaccurate or used without adequate authority, and a lawful use may still be poorly governed. For the assurance question, interpretive guidance should not create an obligation that is absent from the governing instrument or applicable law.","Decisions concerning the control should remain traceable to the information available for the stated reference period. A revision should state whether the change concerns the underlying condition, the evidence, the method or the interpretation. Without this distinction, a reporting change may be mistaken for improvement or deterioration in educational practice."]},{"heading":"Continuing assurance","paragraphs":["Public reporting on record integrity in relation to internal audit should distinguish established fact, analytical judgement and planned action. Material revisions should be traceable to their reason and effective date. A revised conclusion should distinguish a change in the underlying condition from a change in method, coverage or evidence.","The appropriate response to the issue under review is therefore one of controlled implementation and review. The objective should be explicit, the evidence proportionate and learner impact visible. Where evidence cannot support assurance, the limitation should be reported and corrective work should remain open."]}],"word_count":849,"content_hash":"sha256-52ea03b4b63345a16d23da03345987661213e0c67cfe6d80e115e23d142290c7","seo_keywords":["record integrity in relation to internal audit","education quality standards","education quality","ICEQC"],"schema_type":"TechArticle"}