Information Technology (IT) Controls in the Audit

Two layers

• Information technology general controls (ITGCs): access, program changes, development, operations. Weakness undermines every application control relying on that system.
• Application controls: input, processing, output.

Input checks

Field · validity · limit/reasonableness · check digit · completeness · closed-loop verification.

Batch controls

Record count · financial total · hash total (meaningless field).

Segregation

Programmers ≠ operators ≠ users; programmers no access to production.

Testing

• Automated control + effective change management → test one instance; benchmarking in later years.
• System reports → test accuracy and completeness.

Techniques

• Test data: fake data, client program.
• Parallel simulation: real data, auditor program.
• Integrated test facility: dummy entity in live system.
• Embedded audit module: continuous monitoring.

Service organizations

System and Organization Controls (SOC) 1 Type 2 to rely on controls; test complementary user entity controls.

Exam traps

• Test data shows how the program worked when tested — not that the same program ran all year. That depends on change controls.
• A check digit catches transcription errors in a number; it doesn't prove the account is valid or authorized.
• Benchmarking automated controls still needs evidence each year that the program hasn't changed.