Home / Summaries / AIS [Hall] / output-application-control

IT controls : Systems development, program changes, and application controls

22 important questions on IT controls : Systems development, program changes, and application controls

Which points distinguish an effective systems development process?

- Systems authorization activities: all systems should be properly authorized, which requires a formal environment.
- User specification activities: the users need to be actively involved in the systems development process.
- Technical design activities: the technical design activities translate user specifications into a set of detailed technical specifications for a system that meets the user’s needs.
- Internal audit participation: the internal auditor can serve as a liaison between users and the systems professionals to ensure an effective transfer of knowledge.

What are the four controls all maintenance actions should require?

1. formal authorizations,
2. technical specifications,
3. testing and
4. documentation updates.

What is a source program library (SPL)?

Even with formal maintenance procedures in place, individuals who gain unauthorized access to programs threaten application integrity. In larger computer systems, application program modules are stored in source code form on magnetic disks called the source program library (SPL). Protecting the source code on the SPL is central to protecting the production application.

Which four critical functions does the SPLMS control?

(1) storing programs on the SPL,
(2) retrieving programs for maintenance purposes,
(3) deleting obsolete programs from the library and
(4) documenting program changes to provide an audit trail of the changes.

Which planning and control techniques does an SPL require?

- Password control: access through passwords
- Separation of test libraries: a strict separation is maintained between the production programs that are subject to maintenance in the SPL and those being developed
- Audit trail and management reports: an important feature of SPLMS is the creation of reports that enhance management control and support the audit function.

What are batch controls?

Batch controls are used to manage the flow on high volumes of transactions through batch processing systems. The objective of batch control is to reconcile system output with the input originally entered into the system. The control record contains relevant information about the batch, such as:
- a unique batch number
- a batch date
- a transaction code
- record count
- batch control total
- hash total.

What is a run-to-run control?

Run-to-run control is the use of batch figures to monitor the batch as it moves from one programmed procedure to another. This application comprises four runs: (1) data input, (2) accounts receivable update, (3) inventory update and (4) output.

What are output controls?

Output controls are a combination of programmed routines and other procedures to ensure that system output is not lost, misdirected, or corrupted and that privacy is not violated. This can cause serious disruptions in operations and may result in financial losses to a firm.

What is output spooling and how can it be abused?

Applications are often designed to direct their output to a magnetic disk file rather than print it directly. This is called spooling. Later when the printer resources become available, the output files are printed. It creates an output file as an intermediate step in the printing process. A computer criminal can use this opportunity to:
- Access the output file and change critical data values;
- Access the file and change the number of copies of output to be printed;
- Make a copy of the output file to produce illegal output reports;
- Destroy the output file before output printing takes place.

What are print programs?

Printing programs are often complex systems that require operator intervention. Four common types of operator actions:
Pausing the print program to load the correct type of output documents;
Entering parameters that the print run needs (number of copies to be printed);
Restarting the print run at a prescribed checkpoint after a printer malfunction;
Removing printed output from the printer for review and distribution.
Print programs should deal with two types of exposure:
1) the production of unauthorized copies of output and
2) employee browsing of sensitive data.

How can waste be abused?

Computer output waste is a potential source of exposure. Aborted reports and the carbon copies from multipart paper need to be disposed of properly. Computer criminals search through trash for information that is presumed to be of no value.

What are the risks with report distribution?

The primary risk of associated with the distribution of sensitive reports include their being lost, stolen, or misdirected in transit to the user. Control techniques:
- a secure mailbox of which only the user has the key;
- user must (in person) sign for receipt of the report;
- making use of a security officer or special courier.

What are end-user controls?

Output reports should be examined for correctness. Errors may be symptoms of for example an improper system design.

How can digital output be controlled?

Digital output can be directed to the user’s computer screen or printer. The primary output threat is the interception, disruption, destruction or corruption of the output message as it passes across the communications network. This threat comes from two types of disposures: 1) exposures from equipment failure and 2) exposures from subversive acts.

What is black box testing?

Auditors performing black box testing do not rely on a detailed knowledge of the application’s internal logic. Instead they analyze flowcharts and interview knowledgeable personnel in the clients organization to understand the functional characteristics of the application.

What is white box testing?

The white box approach relies on an in-depth understanding of the internal logic of the application being tested. The most common types of tests of controls include:
- Authenticity tests;
- Accuracy tests;
- Completeness tests;
- Redundancy tests:
- Access tests;
- Audit trial tests;
- Rounding error tests

What is the test data method?

used to establish application integrity by processing specially sets of input data through production applications that are under review. The results of each test are compared to predetermined expectations to obtain an objective assessment of application logic and control effectiveness.

What is a base case system evaluation (BCSE)?

Is a variant of the test data approach. BCSE tests are conducted with a set of test transactions containing all possible transaction types. These are processed through repeated iterations during systems development testing until consistent and valid results are obtained. These results are the base case. When subsequent changes to the application occur during maintenance, their effect are evaluated by comparing current results with base case results.

What is an integrated test facility (ITF)?

Is an automated technique that enables the auditor to test an application’s logic and controls during its normal operations.

What are substantive testing techniques?

Substantive tests are so named because they are used to substantiate dollar amounts in account balances. Substantive tests include but are not limited to the following:
Determining the correct value of inventory;
Determining the accuracy of prepayments and accruals;
Confirming accounts receivable with customers;
Searching for unrecorded liabilities.

What is the embedded audit module?

The embedded audit module (EAM) techniques use one or more programmed modules embedded in a host application to select, for subsequent analysis, transactions that meet predetermined conditions.

What is the generalized audit software?

GAS is the most widely used CAATT for IS auditing. GAS allows auditors to assess electronically coded data files and perform various operations on their contents.

The question on the page originate from the summary of the following study material:

AIS [Hall]

View summary

A unique study and practice tool
Never study anything twice again
Get the grades you hope for
100% sure, 100% understanding

Remember faster, study better. Scientifically proven.

IT controls : Systems development, program changes, and application controls

22 important questions on IT controls : Systems development, program changes, and application controls

Which points distinguish an effective systems development process?

What are the four controls all maintenance actions should require?

What is a source program library (SPL)?

Which four critical functions does the SPLMS control?

Which planning and control techniques does an SPL require?

What are batch controls?

What is a run-to-run control?

What are output controls?

What is output spooling and how can it be abused?

What are print programs?

How can waste be abused?

What are the risks with report distribution?

What are end-user controls?

How can digital output be controlled?

What is black box testing?

What is white box testing?

What is the test data method?

What is a base case system evaluation (BCSE)?

What is an integrated test facility (ITF)?

What are substantive testing techniques?

What is the embedded audit module?

What is the generalized audit software?

Summaries related to The information system: an accountant's perspective

AIS [Hall]

Management Control Papers

AIS

AIS [ABN]

Investments and portfolio management

Investments

Indian Economics

Global politics

Essentials of international relations

Behavioral genetics

Management and organisational behaviour

Follow Up Engels idioom 4/5 H