Distinguish between general controls and application controls and give two examples of each. (Objective 12-3) INTERNAL CONTROLS

Fantastic news! We've Found the answer you've been seeking!

Question:

Distinguish between general controls and application controls and give two examples of each.

(Objective 12-3)

INTERNAL CONTROLS SPECIFIC TO INFORMATION TECHNOLOGY

To address many of the risks associated with reliance on IT, organizations often imple - ment specific IT controls. Auditing standards describe two categories of controls for IT systems: general controls and application controls. General controls apply to all aspects of the IT function, including IT administration; separation of IT duties; systems development; physical and online security over access to hardware, software, and related data; backup and contingency planning in the event of unexpected emergencies; and hardware controls. Because general controls often apply on an entity-wide basis, auditors evaluate general controls for the company as a whole. Application controls apply to processing transactions, such as controls over the processing of sales or cash receipts. Auditors must evaluate application controls for every class of transactions or account in which the auditor plans to reduce assessed control risk because IT controls will be different across classes of transactions and accounts. Application controls are likely to be effective only when general controls are effective. Figure 12-1 illustrates the relationship between general controls and application controls. General controls provide assurance that all application controls are effective. Strong general controls reduce the types of risks identified in the boxes outside the general controls oval in Figure 12-1. Table 12-1 describes six categories of general controls and three categories of application controls, with specific examples for each category. Let’s examine these categories of general and application controls in more detail. Similar to the effect that the control environment has on other components of internal control discussed in Chapter 10, the six categories of general controls have an entitywide effect on all IT functions. Auditors typically evaluate general controls early in the audit because of their impact on application controls. Administration of the IT Function The board of directors’ and senior manage - ment’s attitude about IT affect the perceived importance of IT within an organization. Their oversight, resource allocation, and involvement in key IT decisions each signal the importance of IT. In complex environments, management may establish IT steering committees to help monitor the organization’s technology needs. In less complex organizations, the board may rely on regular reporting by a chief information officer (CIO) or other senior IT manager to keep management informed. In contrast, when management assigns technology issues exclusively to lower-level employees or outside

consultants, an implied message is sent that IT is not a high priority. The result is often an understaffed, underfunded, and poorly controlled IT function. Separation of IT Duties To respond to the risk of combining traditional custody, authorization, and record-keeping responsibilities by having the computer perform

those tasks, well-controlled organizations respond by separating key duties within IT. For example there should be separation of IT duties to prevent IT personnel from authorizing and recording transactions to cover the theft of assets. Figure 12-2 shows an ideal separation of duties. Ideally, responsibilities for IT management, systems development, operations, and data control should be separated as follows:

• IT management. The CIO or IT manager should be responsible for oversight of the IT function to ensure that activities are carried out consistent with the IT strategic plan. A security administrator should monitor both physical and online access to hardware, software, and data files and investigate all security breaches.

• Systems development. Systems analysts, who are responsible for the overall design of each application system, coordinate the development and changes to IT systems by IT personnel responsible for programming the application and personnel outside IT who will be the primary system users (such as accounts receivable personnel). Programmers develop flowcharts for each new applica - tion, prepare computer instructions, test the programs, and document the results. Programmers should not have access to input data or computer operations to avoid using their knowledge of the system for personal benefit. They should be allowed to work only with test copies of programs and data so they can only make software changes after proper authorization.

• Operations. Computer operators are responsible for the day-to-day operations of the computer following the schedule established by the CIO. They also monitor computer consoles for messages about computer efficiency and malfunctions. A librarian is responsible for controlling the use of computer programs, trans - action files, and other computer records and documentation. The librarian releases them to operators only when authorized. For example, programs and transaction files are released to operators only when a job is scheduled to be pro - cessed. Similarly, the librarian releases a test copy to programmers only on approval by senior manage ment. Network administrators also affect IT operations as they are responsible for planning, implementing, and maintaining operations of the network of servers that link users to various applications and data files.

• Data control. Data input/output control personnel independently verify the quality of input and the reasonableness of output. For organizations that use databases to store information shared by accounting and other functions, database adminis - trators are responsible for the operation and access security of shared databases.

Naturally, the extent of separation of duties depends on the organization’s size and complexity. In many small companies, it is not practical to segregate the duties to the extent illustrated in Figure 12-2. Systems Development Systems development includes:

• Purchasing software or developing in-house software that meets the organiza - tion’s needs. A key to implementing the right software is to involve a team of both IT and non-IT personnel, including key users of the software and internal auditors. This combination increases the likelihood that information needs as well as software design and implementation concerns are properly addressed. Involving users also results in better acceptance by key users.

• Testing all software to ensure that the new software is compatible with existing hardware and software and determine whether the hardware and software can handle the needed volume of transactions. Whether software is purchased or developed internally, extensive testing of all software with realistic data is critical. Companies typically use one or a combination of the following two test approaches:

1. Pilot testing: A new system is implemented in one part of the organization while other locations continue to rely on the old system.

2. Parallel testing: The old and new systems operate simultaneously in all locations. Proper documentation of the system is required for all new and modified software. After the software has been successfully tested and documented, it is transferred to the librarian in a controlled manner to ensure only authorized software are ultimately accepted as the authorized version. Physical and Online Security Physical controls over computers and restrictions to on - line software and related data files decrease the risk of unauthorized changes to programs and improper use of programs and data files. Security plans should be in writing and monitored. Security controls include both physical controls and online access controls.

• Physical controls. Proper physical controls over computer equipment restrict access to hardware, software, and backup data files on magnetic tapes or disks, hard drives, CDs, and external disks. Common examples to physically restrict unauthorized use include keypad entrances, badge-entry systems, security cameras, and security personnel. More sophisticated controls only allow physical and online access after employee fingerprints are read or employee retinas are scanned and matched with an approved database. Other physical controls include monitoring of cooling and humidity to ensure that the equipment functions properly and installing fire-extinguishing equipment to reduce fire damage.

• Online access controls. Proper user IDs and passwords control access to software and related data files, reducing the likelihood that unauthorized changes are made to software applications and data files. Separate add-on security software packages, such as firewall and encryption programs, can be installed to improve a system’s security. (See page 388 for a description of firewall and encryption programs.) Backup and Contingency Planning Power failures, fire, excessive heat or humidity, water damage, or even sabotage can have serious consequences to businesses using IT. To prevent data loss during power outages, many companies rely on battery backups or on-site generators. For more serious disasters, organizations need detailed backup and contingency plans such as off-site storage of critical software and data files or out - sourcing to firms that specialize in secure data storage. Backup and contingency plans should also identify alternative hardware that can be used to process company data. Companies with small IT systems can purchase replacement computers in an emergency and reprocess their accounting records by using backup copies of software and data files. Larger companies often contract with IT data centers that specialize in providing access to off-site computers and data storage and other IT services for use in the event of an IT disaster.