Chapter 9: Internal controls II Flashcards
Briefly describe and compare general controls and application controls.
General controls
Those policies and procedures that ‘relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems’.
Operate across the organisation and relate to the overall environment of information systems.
General controls do not relate to a specific application or process and will not directly affect the operation of the different information systems within the organisation.
May provide a suitable environment to apply separation of duties and restricted access to resources and relate to the overall computerised information system environment.
Application controls
‘Apply to the processing of individual applications’ or processes.
‘These controls help to provide reasonable assurance that all transactions have occurred, are authorised, and are completely and accurately recorded and processed’.
Application controls are designed around the control objectives of a specific business process or system and relate to processing within individual applications.
That is, application controls address the risks and threats unique to a specific business process.
Briefly describe and compare preventive control, detective control, and corrective control.
Preventive controls help to stop errors or irregularities occurring.
Detective controls will not prevent errors, but function to alert those involved in the system when an error or anomaly occurs.
Corrective controls aim to correct an error or irregularity after it has occurred.
Briefly describe and compare input control, processing control, and output control.
Input controls aim to operate as data enters the system.
They typically try to provide reasonable assurance about the accuracy, validity and completeness of entered data.
Processing controls work toward the correct handling of data within the information processing stages.
Output controls concern the various outputs generated by the process and focus on issues such as:
- who can request outputs
- preparing outputs
- accounting for all outputs
Describe the advantages and disadvantages of batch processing.
Batch processing operates by accumulating transactions in a group or batch before processing them together.
It can have several advantages for an organisation, including efficiency in processing transactions and fewer system demands during regular operations.
However, it also means that the system does not update data immediately after each transaction.
What are the two types of temporary sites?
List their differences.
The two general types of temporary sites are hot-sites and cold-sites.
A hot-site is a facility located away from the organisation’s usual premises.
It contains offices and the necessary equipment (IT, telecommunications and data) to continue running the business in the minimal amount of time after a disaster.
In contrast, a cold-site lacks the necessary equipment and data for the organisation to immediately resume operations.
Instead, it is an available office with basic telephone and electricity supplies ready for use if needed.
What are the advantages and disadvantages of manual controls?
People perform manual controls.
The main disadvantage of manual controls is that they are prone to human error and inconsistent application.
However, the benefit of manual controls is their ability to handle one-off or irregular events.
While algorithms form the basis of computer programs, they cannot necessarily compute these rare events.
For such transactions, manual controls may be a suitable option.
What are the advantages and disadvantages of computer-based controls?
Computer-based controls offer the benefits of consistent application, timely execution and a greater degree of difficulty in working around or avoiding the regulation.
For example, programmed commands assure consistent application.
Also, computers best perform procedures requiring computation because of their relative efficiency and accuracy.
Furthermore, the control data gathered by the computer provide for further analysis and follow up.
Since computer-based controls are also more challenging to work around,
the only way to evade them is through program manipulation, which few people in an organisation can do.
Computer-based rules, however, are incredibly dependent on a sound control environment and general controls.
However, if an organisation fails to implement the separation of duties within the IT environment, then there is the risk of program and data manipulation by staff.
Consequently, it is necessary to consider internal controls and the separation of duties when designing computer-based controls.
Why can unexpected transactions contribute to the ineffectiveness of an internal control system?
How can an organisation minimise the impact brought about by unexpected transactions?
We usually design control systems around typical business transactions and the usual errors or threats that apply to them.
However, the designers of a control system cannot predict every possible outcome or future event.
Therefore, at some point, unanticipated events or transactions will occur.
A sound control environment, accompanied by a strong emphasis on ethical and responsible behaviour, can help employees to carry out these unexpected transactions.
Furthermore, organisations should regularly review and assess internal controls.
Provide at least five examples of processing controls.
Run-to-run totals reconcile account balances from one data processing run to the next.
Batch totals also validate data processing since the transfer of data totals from one file to another should not change them.
Moreover, we can also use sequence checks during the data processing stage to ensure that no data are missing.
Hash totals are batch totals based around meaningless figures, and reconciliations can also function as a processing control measure.
Describe the checks that we can perform during data entry.
Validity checks ensure that a field input value is acceptable.
Completeness checks ensure that we enter all the required data.
Limit checks verify that field input values fit within a pre-determined upper limit.
Range checks function like limit checks but verify both upper and lower limits.
Reasonableness checks ensure that numeric field input values are within a reasonable range.
Redundant data checks operate by entering the data twice to verify that they are identical.
Explain the following using examples:
(a) General controls.
(b) Application controls.
(a) General controls consist of the policies and procedures that impact on various organisational applications and also provide a suitable application control environment.
General rules help ensure the continued proper operation of information systems and operate across the organisation.
General controls include:
- Physical controls over data centre and network operations
- Segregation of duties
- User access
- Systems development procedures
- User awareness of risks
- Data storage procedures
- Security policies
(b) Application controls relate to specific accounting applications or processes to ensure that transactions are authorised, accurately recorded and processed.
Therefore, tailored application controls are built around input, processing and output activities to meet functional requirements within individual business processes.
Input controls include standardised forms, pre-numbered documents and data entry routines.
Processing controls include run-to-run batch totals, reconciliations and sequence checks.
Output controls include privileges and access to outputs.
Explain the following:
(a) What is a turnaround document?
(b) Provide five examples and discuss how turnaround documents help to achieve the aims of input accuracy and input completeness.
(a) A turnaround document is the output of one system or process that forms the input of another.
Since turnaround documents contain all the necessary transaction data, they help to ensure valid and complete system inputs.
(b) Examples of turnaround documents include:
- Boarding passes
- Detachable remittance slips
- Subscription renewals
- Meter cards for measuring gas and water usage
- Shipping notices
