General controls vs. application controls
| Type | Scope | Examples |
|---|---|---|
| IT general controls (ITGCs) | The whole IT environment | Access security, change management, program development, IT operations/backup |
| Application controls | A single process or system | Input edit checks, validity tests, three-way match, automated approval limits |
IMPORTANT: Application controls can only be relied on if the ITGCs supporting them are effective. If access or change management controls are weak, an automated control that looks perfectly designed cannot be relied on — anyone could have altered the program or the data.
Auditing around vs. through the computer
- Around the computer — trace inputs to outputs, ignoring processing. Only appropriate for simple systems with clear audit trails and low risk.
- Through the computer — test the processing itself, using techniques such as test data (auditor's fictitious transactions run through the client's system), integrated test facility (a dummy entity within live processing), and parallel simulation (auditor's own program reprocesses client data).
Segregation of duties in IT
Classic separations: systems development from operations, and both from data control/security administration. A programmer with production access is the standard exam red flag — it enables unauthorized, untested code to reach live financial data.
Data analytics (ADAs)
Audit data analytics can test 100% of a population rather than a sample — for example, recomputing every sales invoice, matching every payment to an approved vendor, or identifying all journal entries posted on weekends or by unusual users. Analytics identify items warranting further investigation; they don't replace the auditor's judgment about whether an exception is a misstatement.
EXAM TIP: Testing 100% of transactions eliminates sampling risk but not nonsampling risk — the data could be incomplete or the auditor could apply the wrong criteria.