COSO Principle 9: The entity identifies and assesses changes that could significantly impact the system of internal control
The risk identification process considers changes to the regulatory, economic, and physical environment in which the entity operates
The entity considers the potential impacts of new business lines, dramatically altered compositions of existing business lines, acquired or divested business operations on the system of internal control, rapid growth, changing reliance on foreign geographies, and new technologies
The entity considers changes in management and respective attitudes and philosophies on the system of internal control
The risk identification process considers changes arising from changes in the entity’s systems and changes in the technology environment
The risk identification process considers changes in vendor and business partner relationships.