risk, has been superseded. Where account balances from single units or groups of similar units are a material portion of the consolidated account balance, management should carefully consider whether MMR may exist in a particular unit. Testing focused on just the controls related to the MMR should then be performed. Monitoring controls, such as detailed performance review meetings with robust reporting packages, should also be considered to limit transaction-specific testing. IT assessment approach Focus IT general control (ITGC) testing: ITGC are not included in the definition of entity-level controls under the SEC or PCAOB guidance. Therefore, ITGC testing should be performed to the extent it addresses specific MMR. By nature, ITGC enables management to place reliance on fully automated application controls (i.e., those that operate without human intervention) and IT-dependent controls (i.e., those that involve the review of automatically generated reports). Focused ITGC testing is merited to support the control objectives or assertions that fully automated controls have not been changed without authorization and that control reporting generated is both accurate and complete. Key ITGC focus areas therefore likely to be critical include: change management procedures applied to specific financial system implementations during the period; change management procedures sufficient to support a benchmarking strategy; and periodic monitoring of application security, including separation of duties. PCAOB guidance subsequent to 2007 The PCAOB issues "Staff Audit Practice Alerts" (SAPA) periodically that "highlight new, emerging or otherwise noteworthy circumstances that may affect how auditors conduct audits under the existing requirements of the standards..." Under SAPA #11 Considerations for Audits of Internal Control over Financial Reporting (October 24, 2013), the PCAOB discussed significant audit practice issues regarding ICFR assessment. These included, among other topics: System-generated reports ("Information provided by the entity" or "IPE"): Requirements that auditors (and by proxy management) obtain additional evidence that fully automated reports and manual queries used as control inputs are accurate and complete. Entity-level controls and management review controls: Excessive reliance was sometimes placed on entity-level controls and management review controls (similar conceptually to period-end controls), which were insufficiently precise to reduce the risk of material misstatement to the "remote" level. SAPA #11 provides additional criteria to assist in this evaluation of precision. Criteria for investigation: Auditors did not always obtain sufficient evidence that management's controls were executed effectively where unusual variation outside of specified tolerances was noted. For example, management may have signed a control report saying it