Systems Development Controls professionals to ensure an effective

transfer of knowledge.
and Application Controls
Program Testing
01 Systems Development Controls
• All program modules must be
• Controlling systems development
thoroughly tested before they are
activities
implemented.
• Controlling program changes.
• A program testing procedure involves
02 Application Controls the creation of hypothetical master files
and transactions files that the tested
• Input controls modules process.
• Processing controls Output controls • The results of the tests are then
CONTROLLING SYSTEMS compared against predetermined
DEVELOPMENT ACTIVITIES results to identify programming and
logic errors.
Systems Authorization Activities
User Test and Acceptance Procedures
• All systems should be properly
authorized. • Many consider this to be the most
• Users must submit requests to systems important control over the systems
professionals in written form. development.
• The last point at which the user can
User Specification Activities determine the system's acceptability
• Users need to be actively involved in prior to it going into service.
the systems development process. • The test team should be composed of
• User specification document - A user personnel, systems professionals,
detailed written description of user's and internal auditors.
needs which describe the user's view of • The details of the tests performed and
the problem. Users & systems their results need to be formally
professionals’ joint effort. documented and analyzed.

Technical Design Activities

Audit Objectives Relating to Systems
• Translate user specifications into a set Development
of detailed technical specifications for
a system that meets the user's needs. The auditor's objectives are to ensure that:
• The scope of these activities includes
systems analysis, feasibility analysis, 1) Systems development activities are
and detailed systems design. applied consistently and in accordance
• The adequacy of these activities is with management's policies to all
measured by the quality of systems development projects
documentation.
2) The system as originally implemented
Internal Audit Participation
was free from material errors and fraud
• The internal auditor can play an 3) The system was judged necessary and
important role in the control of systems justified at various checkpoints
development activities. throughout the SDLC.
• The internal auditor can serve as a
liaison between users and the systems
 4) System documentation is sufficiently CONTROLLING PROGRAM CHANGE
accurate and complete to facilitate ACTIVITIES
audit and maintenance activities.
Source program library controls

Audit Procedures Relating to Systems In larger computer systems, application

Development | program modules are stored in source code
form on magnetic disks called the source
The auditor should select a sample of program library (SPL).
completed and review the documentation for
evidence of compliance with stated systems Executing a production application requires
development policies. that the source code be compiled and linked to
a load module that the computer can process. As
Specific points for review should include a practical matter, programs in their compiled
determining that: state are secure and free from the threat of
unauthorized modification.
• User and computer services
management properly authorized the Protecting the source code on the SPL is central
project. to protecting the production application.
• A preliminary feasibility study showed
that the project had merit. A controlled SPL environment
• A detailed analysis of user needs was
Controlling the SPL requires SPL management
conducted that resulted in alternative
system (SPLMS) software.
conceptual designs.
• A cost-benefit analysis was conducted The SPLMS, which controls four critical
using reasonably accurate figures, functions:
• The detailed design was an appropriate
and accurate solution to the user's (1) Storing programs on the SPL
problem. (2) Retrieving programs for maintenance
• Test results show that the system was purposes
thoroughly tested. (3) Deleting obsolete programs from the
• There is a checklist of specific library
problems detected during the (4) Documenting program changes to
conversion period, along with evidence provide an audit trail of the changes.
that they were corrected in the
maintenance phase.
• Systems documentation complies with
organizational requirements and
standards.
 A CONTROLLED SPL Audit Objectives Relating to
ENVIRONMENT Systems Maintenance
Password Control The auditor’s objectives are to determine that:

Every financially significant program stored in 1) Maintenance procedures protect

the SPL can be assigned a separate password. applications from unauthorized
changes
Separation of Test Libraries
2) Applications are free from material
Under this concept, a strict separation errors
is maintained between the production programs 3) Program libraries are protected
that are subject to maintenance in the SPL and from unauthorized access
those being developed.
Audit Procedures for Identifying
Direct access to the production SPL is Unauthorized Program Changes
limited to a specific librarian group that must
• Reconcile program version numbers
approve all requests to modify, delete, and copy
• Confirm maintenance authorization
programs.

Audit Trail and Management Reports

Audit Procedures for Identifying
An important feature of SPL
Application Errors
management software is the creation of reports
that enhance management control and support • Reconcile the source code
the audit function. • Review the test results
• Retest the program
Program Version Numbers

The SPLMS assigns a version number

Audit Procedures for Identifying
automatically to each program stored on the
Application Errors
SPL.
• Reconcile the source code
When programs are first placed in the libraries,
• Review the test results
they are assigned version number zero. With
• Retest the program
each modification to the program, the version
number is increased by one.

Ex, 4 – major, 2 – minor, 1 – patch Application Controls

Controlling Access to Maintenance Application controls are associated with
Commands specific applications (SAP B1, Oracle ERP,
Quickbooks, etc.)
Powerful maintenance commands are
available for most library systems that can be These fall into three broad categories:
used to alter or eliminate program passwords,
alter the program version number, and 1. Input controls
temporarily modify a program without 2. Processing controls
generating a record of the modification. 3. Output controls

Access to the maintenance commands

themselves should be password controlled, and
management or an IT security group should
control the authority to use them.
 INPUT CONTROLS Illustration:

Input controls are programmed procedures CUSTOMER ACCT NO: 5372

(routines) that perform tests on transaction
Step 1: Weights: 5,4,3,2
data to ensure that they are free from errors.
Step 2: 5 x 5 = 25
Input controls in real-time systems are placed 3 x 4 = 12
at the data collection stage to monitor data as 7 x 3 = 21
they are entered from terminals. 2x2=4
62
In batch systems, input control tests are
performed as a separate procedure (or run) Step 3: 62/11 = 5 r7
prior to the master file update process. Step 4: 11-7 = 4
Step 5: CUSTOMER ACCT NO: 53724
Check digit

A control digit is added to the code to detect Example: Sales clerk entered 53274
data coding errors. instead of 53724
Two common classes of data input errors: Computer will reconcile the check digit.
a. transcription errors 5 x 5 = 25
b. transposition errors. 3 x 4 = 12
2x3=6
Data Input Errors 7 x 2 = 14
1) Transcription errors 57
57/11 = 5 remainder 2
Illustration: CUSTOMER ACCT NO.: 12345 11-2 = 9
Conclusion: 9 should be the check digit of
123455 Addition error
53274 and not 4.
1234 Truncation error
The system will detect the encoding error.
12845 Substitution error
INPUT CONTROLS

Missing data check

2) Transposition errors

Illustration: CUSTOMER ACCT NO.: 12345

12435 Single transposition

14325 Multiple transposition

Check Digit

Using Modulus 11:

1) Assign weights Numeric – alphabetic check
2) Sum the products
3) Divide by the modulus
4) Subtract the remainder fromthe
modulus to obtain the check digit
5) Add the check digit to the original
code to yield the new code.
Limit check PROCESSING CONTROLS

Batch Controls

• Batch number
• Batch date
• Transaction code
• Record count
• Batch control total
• Hash total

Range Check

Run-to-run control

• Run-to-run control is the use of batch

figures to monitor the batch as it moves
from one programmed procedure (run)
to another.
Reasonableness Check • At various points throughout
processing and at the end of processing,
the batch totals are recalculated and
compared to the batch control record.
• This ensures that each run in the system
processes the batch correctly and
completely.

Validity Check

Audit Trail Controls

Transaction logs
Every transaction the system successfully
processes should be recorded on a transaction
log, which serves as a journal.
Log of automatic transactions From trash, computer criminals may obtain
All internally generated transactions must be information about a firm’s market research,
placed in a transaction log. credit ratings of its customers, or trade secrets,
which they can sell to a competitor.
Transaction listings
Report distribution
The system should produce a (hard-copy)
transaction listing of all successful transactions. The primary risks associated with the
distribution of sensitive reports include their
being lost, stolen, or misdirected in transit to the
OUTPUTS CONTROLS
user.
Output controls are a combination of
The following control techniques can be used:
programmed routines and other procedures to
ensure that system output is not lost, 1) The reports may be placed in a secure
misdirected, or corrupted and that privacy is not mailbox to which only the user has the
violated. key.
2) The user may be required to appear in
Controlling Hard-Copy Output
person at the distribution center and
Output spooling sign for the report.
3) A security officer or special courier
in large-scale data processing may deliver the report to the user.
operations, output devices such as line printers
can become backlogged with many programs End-user controls
simultaneously demanding limited resources.
Once in the hands of the user, output reports
Applications are often designed to should be examined for correctness.
direct their output to a magnetic disk file rather
Errors the user detects should be reported to the
than print it directly. This is called spooling.
appropriate computer services management.
Print programs
Once a report has served its purpose, it should
When a printer becomes available, the print run be stored in a secure location until its retention
program produces hard-copy output from the period has expired and then it should be
output file. shredded.

Print program controls should be designed to Digital output controls

deal with two types of exposures present in this
The primary output threat is the interception,
environment:
disruption, destruction, or corruption of the
1) The production of unauthorized copies output message as it passes across the
of output communications network.
2) Employee browsing of sensitive data.
Controls against exposures from equipment
failure - Parity check, echo check
WASTE
Controls against exposures from subversive
Computer output waste is a potential source of acts - Encryption, digital envelope, digital
exposure. Aborted reports and the carbon signature, digital certificate
copies from multipart paper need to be disposed
of properly.