Module 5 Flashcards
What are are IT General controls?
Policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems
Whole item system (bubble around)
E.g username password, backups
ITGC can be?
Manual
Automated
Combination of both
What are the 4 areas ITGCs commonly cover?
Access to programs and data
Program changes and development
Operations (computer)
Continuity of operations
What is the key risk for access to programs and data?
Loss, destruction or unauthorised use and alteration of data
What is the key risk for program changes and development?
Changes may be unsuitable
New programs may not be fit for purpose
What is the key risk for computer operations?
Problems with system fail to be resolved in a timely manner
What is the key risk for continuity of operations?
Unexpected distasters
What is access to programs and data?
Access restricted to authorised persons only
What is program changes and development?
Any changes or development must incorporate controls including appropriate authorisation and testing
What are computer operations?
Procedures are required to ensure the recording, analysis and timely resolution of problems
Day to day processing of information
Ensure efficiency to achieve objectives
What are continuity of operations?
Take precautions against potential hazards and implement suitable backup procedures
What are the components of access to programs and data?
Awareness of information security policies by all staff
Appropriate restrictions of access to IT resources
Segregation of duties within key processes
What are the common controls within restriction of access?
Physical access
User access
Administrator access
What do you need to consider to ensure changes and development are appropriate and don’t negatively affect?
Authorisation
Development
Testing
Approval
DATA
Change should be made where?
In separate test environments to avoid any negative impact on info processing and application controls
What should organisations consider with regards to computer operations?
Job processing (documented procedures) Backup and recovery procedures Incident and problem management procedures (doc)
The ability to carry on trading after a distaste involves formulation a?
Disaster recovery plan as well as procedures to avoid disaster occurring
How can the DRP be developed?
Internally or outsourced to a specialist
What steps does designing a good DRP involve?
Identifying IT risk events
Assessing threat and impact
Preventing and reducing risk
What are the objective of a good DRP?
Minimising interruption Securing alternative internet access Recovering lost data Providing recovery procedures Training employees
What are typical physical security measures for distasteful prevention?
Fire and smoke detectors Alarms Plastic equipment covers Air con Firewalls
4 key areas ITGCs cover?
Access to programs and data
Program changes and development
Operations computer
Continuity of operations
APOC
What do IT application controls apply to?
Processing of specific types of transactions
To ensure genuine accurate and compete transactions
At business process/transaction level
What is the key difference between a manual and IT application control?
IT application contains some element of automation or involvement of IT
What are the 6 common examples of IT application controls?
Audit log Batch controls Programmed editing Calculation Check digits Exception reports
What is an audit log?
Automatic log kept of activity that can be manually reviewed
What are batch controls?
Operate where a manual count or total is made of inputs prior to being put into system.
Once input, but before processing, the manual count is agreed to the computer generated totals to ensure accuracy
What is programmed editing?
Computer is programmed to anticipate entires fields
Tests on data entry incorporated e.g 1-100 over is rejected
What is calculation?
Automatic calculations embedded within applications based on inputted info
What are check digits?
A decimal digit added to a number for detecting the sorts of errors humans typically make on data entry.
The digit is driven by a formula and the system can perform an automatic check using it
What are exception reports?
A report generated that identifies any transactions that are outside the normal expected range
Should be reviewed and investigated
