Scribd
Upload
40 views6 pages

Checklist For Testing of Controls - (Sample Checklist) Sr. Check Point / Defect Statement

The checklist provides controls to test for transaction processing, data input, data entry, processing, data output, and risk identification. It includes 33 questions to test data input controls, 17 questions to test data entry controls, 15 questions to test processing controls, 22 questions to test data output controls, and asks if the level of risk has been identified, confirmed by audit, and notified to end users. The checklist is to be used by marking checks in yes or no applicable columns for each control point.

Uploaded by

h
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOC, PDF, TXT or read online on Scribd
40 views6 pages

Checklist For Testing of Controls - (Sample Checklist) Sr. Check Point / Defect Statement

The checklist provides controls to test for transaction processing, data input, data entry, processing, data output, and risk identification. It includes 33 questions to test data input controls, 17 questions to test data entry controls, 15 questions to test processing controls, 22 questions to test data output controls, and asks if the level of risk has been identified, confirmed by audit, and notified to end users. The checklist is to be used by marking checks in yes or no applicable columns for each control point.

Uploaded by

h
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOC, PDF, TXT or read online on Scribd
You are on page 1/ 6

Checklist for Testing of Controls - (Sample Checklist)

Check Mark () the


Sr. Check Point / Defect Statement Appropriate Column
Yes N/A
Have the business transactions processed by the
A) software been identified?

Has a transaction flow analysis been prepared for each


B) transaction?

Have controls for the transaction flow been


C) documented?

Do data input controls address the following:

D1) Accuracy of data input?

D2) Completeness of data input?

D3) Timeliness of data input?

D4) Conversion of data input into a machine-readable


format?

D5) The keying of input?

D6) Data input processing schedules?

D7) Assignment of data input duties (e.g. originating,


entering, and processing data and distributing output)?
D)
D8) End users input (with the help of the control
group)?

D9) Input of all source documents?

D10) Batching techniques?

D11) Record counts?

D12) Predetermined control totals?

D13) Control logs?

D14) Key verification?

D15) Preprogrammed keying formats?


D16) Editing for input?

D17) Input data elements?

D18) Data validation editing techniques?

D19) Monitoring for overrides and bypasses?

D20) Restriction of overrides and bypasses to


supervisory personnel?

D21) Automatic recording and submission of overrides


and bypasses to supervisors for analysis?

D22) Automatic development of control counts during


data entry?

D23) Recording of transaction errors?

D24) Monitoring of rejected transactions for correcting


and reentering them on a timely basis?
D)
D25) Written procedures for data input processes?

D26) Appropriate error messages for all data error


conditions?

D27) Security for data entry terminals?

D28) Passwords for entering business transactions


through terminals?

D29) Shutting down of terminals after predefined


periods of inactivity?

D30) Reports of unauthorized terminal use?

D31) Built-in identification codes for terminals?

D32) Logs of transactions entered through terminals?

D33) Interactive displays that tell terminal operators


which data is entered?

Do data entry controls include the following


E) controls:

E1) Accuracy of new data?


E2) Completeness of new data?

E3) Timely recording of new data?

E4) Procedures and methods for creating new data?

E5) Security for blank source documents?

E6) Checking of cross-referenced fields?

E7) Pre-numbered documents?

E8) Transaction authorization?

E9) Systems overrides?

E10) Manual adjustments?

E) E11) Batching of source documents?

E12) Control totals for source documents?

E13) A correction procedure for errors made on source


documents?

E14) A retention repository for source documents?

E15) Transmission of source documents for data


entry?

E16) Confirmation by the data entry function to the


source document function that the documents are
entered? (For online systems, data origination and data
entry are performed concurrently.)

E17) Prompt messages for data entry operators?

Do processing controls address the following:

F1) Input throughout processing?

F2) Instructions for operations personnel on how to


F) control processing?

F3) Abnormal termination or conditions?

F4) Operation logs for review by supervisors?


F5) Procedures for reconciling record counts and
control totals?

F6) Reconciliation of processing control totals and


manually developed control totals?

F7) Procedures ensuring that the right versions of


programs are run?

F8) Procedures ensuring that the right versions of files


are used?

F9) Maintenance of run-to-run totals?

F10) Reconciliation of processing from last to current


run (or between different time periods)?

F11) Validation of new data?

F) F12) Manual validation of override and bypass


procedures after processing?

F13) Maintenance of transaction history files?

F14) Procedures for controlling errors?

F15) Correct and timely reentry of rejected


transactions?

F16) Recording of correct accounting classifications?

F17) Concurrent update protection procedures?

F18) Error messages printed out for each error


condition?

F 19) Identical procedures for processing corrected


and original transactions?

Do data output controls address the following:

G1) Accountable documents (e.g., bank checks)?

G) G2) Accountable documents damaged in output


preparation?

G3) Completeness of output?


G4) Review of output documents for acceptability and
completeness?

G5) Reconciliation of output documents for record


counts and control totals?

G6) Identification of output products?

G7) Delivery of output products to the right locations?

G8) Delivery of output products on a timely basis?

G9) Appropriate security for output products?

G10) The end users assigned responsibility for the


accuracy of all output?

G11) Logs for output production and delivery?

G12) Clear output error messages?

G13) A history of output errors?


G)
G14) Users informed of output product errors?

G15) Users informed of abnormal terminations?

G16) A phone number users can call for help in


understanding output?

G17) A phone number users can call for information


about the output production schedule?

G18) The number of copies of output?

G19) Procedures that determine who gets online


output?

G20) Control totals for online output?

G21) Written procedures for online output?

G22) Procedures for user responses made on the


basis of output information?

Has the level of risk for each control area been


identified?
H)
Has this level of risk been confirmed by the audit
I) function?

Have end users or customers been notified of the level


J) of control risk?

How to use the Above Checklist:

1) We record the conditions or observed results by marking a


checkmark in either of the 2 - data columns against various check
points or defect statements on the checklist.

2) A checkmark in the Yes column against an item indicates that


the checkpoint or the defect statement is True.

3) A checkmark in the N/A column against an item indicates that


the checkpoint or the defect statement is not applicable.

4) The checklist can be customized & additional columns like


Comments etc. may be added which could provide useful
assistance during analysis.

http://www.softwaretestinggenius.com

You might also like