adequate controls exists over the entity’s assets Organizational controls address the proper

and records. Management needs a control segregation of duties and responsibilities within
system that generates a reliable information for the computer processing environment.
decision making. The auditor should give
Segregation of Duties. This general control is
adequate considerations to these controls
vital because a segregation of functions
because the quality of the entity’s internal
(authorization, recording, and access to assets)
control systems can have an impact on the
may not be feasible in an IT environment.
overall audit strategy. The auditor’s
Accordingly, certain tasks should not be
responsibilities with respect to internal control
combined.
over EDP systems remain the same as with
manual systems. (1) Database/network/web administrators.
They are responsible for management,
Auditors should also consider the following risk
supervision, and oversight of computing
to computer information system environment:
facilities.
 Reliance on the functioning capabilities (a) The database administrator (DBA) is
of hardware and software the individual who has the overall
 Visibility of audit trail responsibility for developing and
 Reduced human involvement maintaining the database and for
 Unauthorized access establishing controls to protect its
 Reduced segregation of duties integrity. Thus, only the DBA should be
able to update data dictionaries
 Lack of traditional authorization
(2) Data administrator. They coordinate
INTERNAL CONTROL OVER EDP ACTIVITIES activities within the data administration
department.
Internal control over EDP activities are classified
(3) System analysts. They are specifically
as either general controls or application controls.
qualified to analyze and design computer
Exhibit 11.1 describes the categories of general
information systems. They survey the
controls and application controls
existing system, analyze the
Exhibit 11.2 Categories of General and organization's information requirements,
Application controls and design new systems to meet those
Control Type Category of control needs. These design specifications will
General Organizational and operation guide the preparation of specific
Controls control programs by computer programmers.
Systems development and (4) Programmers. Programmers design,
documentation controls write, test, and document the specific
Access controls programs developed by the analysts.
Data recovery controls Programmers as well as the analysts may
Hardware controls
be able to modify programs, data files,
Application Input controls
and controls and should therefore have
Controls Processing controls
no access to computer equipment and
Output controls
files or to programs used in productions.
(5) Computer (console) operator. Computer
GENERAL CONTROLS operators are responsible for the actual
processing of data in accordance with the
General controls apply to all computer activities.
program and messages received from the
They often include controls over the
system. They load mount storage devices,
development, modification, and maintenance of
and operate the equipment.
computer programs and controls over the use of
(a) Console operators should not be
and changes to data maintained on computer
assigned programming duties
files.
responsibility for systems design and
ORGANIZATIONAL AND OPERATION CONTROLS should have no opportunity to make
changes in programs and systems as
 Organizational Controls they operate the equipment. Ideally,
computer operators should not have
programming knowledge or access to
 documentation not strictly necessary changes in existing programs are also
for their work. necessary.
(b) Help desk are usually a responsibility
ACCESS CONTROLS
of computer operations because of
the operational nature of their Access controls provide assurance that only
functions. A help desk logs reported authorized individuals use the system and that
problems, resolves minor problems, usage is for authorized purposes. Examples of
and forwards more difficult problems access controls are
to the appropriate information
systems resources, such as technical  Encryption. Encryption involves using
support unit or vendor assistance. fixed algorithm to manipulate plaintext.
(6) Data conversion operators. Data The information is sent in its
conversion operators perform the tasks manipulated form and the receiver
of data preparation and transmission, for translates the information back into
example, conversion of source data to plaintext. Although data may be accessed
magnetic disk or tape and entry of by tapping into the transmission line, the
transactions from remote terminals. encryption key is necessary to
(7) Librarians. Librarians should maintain understand the data being sent.
control over and accountability for  Call back. A call back feature requires the
documentation, programs, and data files. remote user to call the computer, give
Librarians should have no access to identification, hang up, and wait for the
equipment or the skills to perpetrate computer to call the user's authorized
fraud. number. This control ensures acceptance
(8) Data control group. The data control of data transmissions only from
group must be independent of systems authorized modems. However, call
development, programming, and forwarding may thwart this control.
operations. The control group receives  Password and ID numbers. The use of
user input, logs it, transfers it to the passwords and identification numbers is
computer center, monitors processing, an effective control in an online system to
reviews error, compares control totals, prevent unauthorized access to
distributes output, and determines computer files. Lists of authorized
whether error corrections have been persons are maintained in the computer.
made by users. The entry of passwords or identification
(9) End users. The end users need access to numbers; a prearranged set of personal
applications data and functions only. questions; and the use of badges,
magnetic cards, or optically scanned
 Operating controls cards may be combined to avoid
unauthorized access. To be more
Operating controls ensure efficient and effective effective, passwords should consist of
operation within the computer department. random letters, symbols, and numbers.
These controls also assure proper procedures in They should contain words and phrases.
case of data loss because of error or disaster.  Security personnel. An organization may
Typical operating controls include the proper need to hire security specialists. For
labeling of all files both internally and externally, example, developing an information
halt and error procedures duplicate files, and security policy for the organization,
reconstruction procedures for files. commenting on security controls in new
SYSTEMS DEVELOPMENT AND DOCUMENTATION applications.
CONTROLS  Controlled disposal of documents. One
method of enforcing access restrictions
These controls are concerned with the proper is to destroy data when they are no longer
planning, development, writing, and testing in use.
computer applications. These activities require  Biometric technologies. These are
proper documentation, including flowcharts, automated methods of establishing an
listings, and run manuals for programs already individual's identity using physiological
written. Controls over proper authorization of any or behavioral traits. These characteristics
 include fingerprints, retina patterns, processing, and reporting of data are properly
hand geometry, signature dynamics, performed.
speech, and keystrokes dynamics.
INPUT CONTROLS
 Automatic log-off. Automatic log-off
(disconnection) of inactive data Input controls provide reasonable assurance
terminals may prevent the viewing of that the data received for processing have been
sensitive data on an unattended data properly authorized, converted into machine-
terminal. readable form, and identified. They also provide
 Utility software restrictions. Utility reasonable assurance that the data (including
software may have privileged access and the data transmitted over communication lines)
therefore be able to bypass normal have not been lost, suppressed, added,
security measures. Performance duplicated, or otherwise improperly changed.
monitors, tape and disk management Moreover, input controls relate to rejection,
systems, job schedulers, online editors, correction, and resubmission of data that were
and report management systems are initially incorrect.
example of utility software. Management
can limit the use of privileged software to  Edit checks
security personnel and establish audit They include: Error listing. Editing (validation) of
trails to document its use. The purpose is data should produce a cumulative automated
to gain assurance that its users are error listing that includes not only errors found
necessary and authorized. in the current processing run but also
DATA RECOVERY CONTROLS uncorrected errors from earlier runs. Each error
should be identified and described, and the date
Disasters such as power failures, fire, excessive and time of detection should be given.
heat or humidity, water damage, or even Sometimes the erroneous transactions may
sabotage have serious consequences to need to be recorded in a suspensed file. This
business using IT. To address such risks process is the basis for developing appropriate
organizations develop detailed back up reports.
contingency plans. One key to a back
contingency plan is to make sure that all critical Field checks. Field checks are tests of the
copies of software and data files backed up and characters in the field to verify that they are
stored off the data premises. Also the plans of an appropriate type for that field.
should identify alternative hardware to process Financial totals. Financial totals summarize
company data. peso amounts in an information field in a
HARDWARE CONTROLS group of records.

Hardware controls assure the proper internal Hash totals. A hash total is a control total
handling of data as they are moved and stored. without a defined meaning, such as the total
They include: of employee numbers or invoice numbers,
that is used to verify the completeness of
 Parity check. A special bit is added to data. the hash total for the employee listing
each character stored in memory that can by the personnel department could be
detect if the hardware loses a bit during compared with the total generated during the
the internal movement of a charact% payroll run.
similar to a check digit.
Limit and range checks. Limit and range
 Echo checks. It detects line errors by re-
checks are based on known limits for given
transmitting data back to the sending
information.
device (hardware) for comparison with
the original transmission. Preformatting. To avoid data entry errors in
 Read-after-write checks online systems, a screen prompting
approach may be used, that is the equivalent
APPLICATION CONTROLS
of the preprinted forms routinely employed
Application controls relate to specific tasks as source documents. The dialogue
performed by the system. They should provide approach, for example, presents a series of
reasonable assurance that the recording, question to the operator. The preformatted