E.2. System and Application Controls

Question 1

What are the objectives of controls for an information system?

Answer 1

• Promoting effectiveness and efficiency of operations
• Maintaining the reliability of financial reporting
• Assuring compliance with all laws, regulations, and managerial policies
• Safeguarding assets

Question 2

Fill in the blanks:

The first line of defense against threats to an information system is _______ _______ ________.

Answer 2

Effective system controls

Question 3

What are the primary purposes of system controls in an organization?

Answer 3

To preserve the integrity of data and reduce the risk of loss from inadequate records, inaccurate accounting, business interruption, fraud, violations of the law, asset loss, and damage to the business’s competitive position.

System controls must not only exist but must also function effectively to achieve these objectives.

Question 4

What are the two main types of controls for a computer system?

Answer 4

• General controls
• Application controls

General controls relate to all systems components, processes, and data in a systems environment.

Application controls are specific to individual applications and are designed to prevent, detect, and correct errors and irregularities in transactions

Question 5

What types of controls are included in general controls in an information system?

Answer 5

• Administrative controls, including segregation of duties
• Computer operations controls
• Controls over development, maintenance, and modification of computer programs
• Software controls
• Hardware controls
• Data security controls
• Provision for disaster recovery

Question 6

Application controls in an information system include what three classifications of controls?

Answer 6

• Input controls
• Processing controls
• Output controls

Question 7

One of the three classifications of application controls in an information system is input controls. What is the function of input controls?

Answer 7

They are designed to provide reasonable assurance that input to the system has proper authorization, has been converted to machine-sensible form, and has been entered accurately.

Question 8

One of the three classifications of application controls in an information system is processing controls. What is the function of processing controls?

Answer 8

They are designed to provide reasonable assurance that processing has occurred properly and no transactions have been lost or incorrectly added.

Question 9

One of the three classifications of application controls used in an information system is output controls. What is the function of output controls?

Answer 9

They are designed to provide reasonable assurance that input and processing of the input have resulted in valid output.

Question 10

What is the focus of segregation of duties in system controls?

Answer 10

Separating the authority for a function from the responsibility for the function to limit opportunities for unauthorized use of and changes to the computer and its stored data and applications, although collusion between employees can still override controls.

Question 11

What is the role of a systems analyst in an information systems department, and what other responsibilities are incompatible with systems analysis from a segregation of duties standpoint?

Answer 11

Systems analysts are responsible for reviewing the current system to ensure it meets the organization’s needs and providing design specifications for new systems.

Systems analysts should not do programming, nor should they have access to hardware, software, or data files.

Question 12

What is the role of the data control group in system controls?

Answer 12

• Receives user input and logs it
• Monitors processing
• Reconciles input and output
• Distributes output to authorized users
• Checks for errors and corrects them when found

The data control group should be organizationally independent of computer operations.

Question 13

What are the responsibilities of a database administrator?

(DBA)

Answer 13

• Designing and maintaining database structures
• Granting/revoking user access rights
• Implementing data security controls and encryption
• Managing database backups and recovery procedures
• Establishing data validation rules
• Implementing audit trails for data access and modifications

Question 14

In accounting system controls, why are audit trails important?

Answer 14

They provide a step-by-step documented history of transactions, enabling an auditor or other examiner to trace a transaction from the general ledger back to the source document such as an invoice or a receipt.

The absence of audit trails can make the reliability of an accounting information system questionable.

Question 15

What are the three categories of general controls in system controls?

Answer 15

• Controls over the organization and operation of the facilities and resources
• General operating procedures
• Software, hardware, and access controls

Question 16

In system controls, what are the functions of administrative controls?

Answer 16

In an information systems department, administrative controls provide for segregation of duties and supervision of personnel involved in control procedures to ensure that the controls are performing as intended.

Supervisors can spot weaknesses, correct errors, and identify deviations from standard procedures. Without adequate supervision, controls may be neglected or deliberately by-passed.

Question 17

What is the role of a computer operator in an information systems department, and what duties are incompatible with those of computer operators?

Answer 17

Computer operators perform the actual operation of computers for processing data.

Computer operators should not have programming functions or the ability to modify programs.

Question 18

What is the significance of cost/benefit analysis in implementing controls?

Answer 18

Cost/benefit analysis means that management should not spend more on controls than the amount the company can expect to receive in benefits from the controls.

Question 19

What should general operating procedures, a general system control, include?

Answer 19

Procedures should be documented for:

• Start-up process
• Job scheduling
• Setup of processing jobs
• Instructions for running jobs
• Processing continuity during operator shift changes
• Operations logs
• Backup and recovery procedures
• Procedures for connection and disconnection of links to remote operations

Question 20

What is a turnaround document and what is its purpose as a system control?

Answer 20

It is created by a computer, sent to another person or business where additional information is added, and returned to become an input document to the computer.

They limit input errors and reduce or eliminate the need for manual data entry.

Question 21

What is Intelligent Character Recognition?

(ICR)

Answer 21

It uses artificial intelligence to recognize different kinds of handwriting and fonts, read them, and convert them to computer input.

Question 22

Software controls, hardware controls, and access controls comprise one of three categories of general system controls.

What is the function of software controls?

Answer 22

To monitor the use of software, prevent unauthorized access to it, and prevent unauthorized changes to applications and systems.

System software controls are used for compilers, utility programs, operations reporting, file handling and file setup, and library activities.

Question 23

Why are controls over system software particularly important?

Answer 23

System software performs overall control functions for the application programs.

Question 24

What is the role of a compiler in software controls?

Answer 24

To convert source code into object code, which provides the instructions for the computer.

Question 25

Software controls, hardware controls, and access controls comprise one of three categories of general system controls. What is the function of hardware controls?

Answer 25

They are measures to keep computer equipment physically secure, including protection from extremes of temperature and humidity, fire, and natural disasters.

Question 26

What is checkpoint and rollback recovery processing in a systems environment?

Answer 26

Several times per hour, the system stops (checkpoint) and backs up all the data and other information needed to restart the system. If a hardware failure occurs, the system reverts (“rolls back”) to the last saved copy, restarts, and reprocesses only the transactions that were posted after the last checkpoint.

Question 27

What are the two classifications of access controls in system controls?

Answer 27

* Logical security controls * Physical security controls ## Footnote **Logical security controls** are controls over access and the ability to use the equipment as well as data security controls to ensure that data files are not subject to unauthorized access, change, or destruction. **Physical security controls** protect the physical assets of the computer center: the hardware, peripherals, documentation, programs, and data files in the library.

Question 28

System controls are broken down into (1) general controls and (2) application controls. What is the function of application controls?

Answer 28

They focus on preventing, detecting, and correcting errors in transactions as they flow through the input, processing, and output stages of an information system.

Question 29

In system controls, what are application controls, and what are the three categories of application controls?

Answer 29

They are designed to prevent, detect, and correct errors and irregularities in transactions during the input, processing, and output stages. The three categories of application controls are: * Input controls * Processing controls * Output controls

Question 30

In system controls, what are the three classifications of input controls?

Answer 30

* Data observation and recording * Data transcription - preparation of the data for processing * Edit tests - examine specific data fields and reject transactions if their data fields do not meet data quality standards

Question 31

In system controls, what are point-of-sale devices, and how do they help reduce input errors?

Answer 31

Point-of-sale devices such as bar codes that are scanned eliminate the need to manually convert data to machine-readable format, thereby decreasing input errors.

Question 32

In system controls, what are batch control totals, and what is their function?

Answer 32

These are manually calculated totals or counts applied to a group of transactions such as total sales revenue in a batch of billings. The application recalculates the batch total, compares it with the manual batch total, and rejects batches for which the control totals do not match. Control totals can detect missing transactions, duplicate processing, or computational errors that affect totals.

Question 33

What is data transcription in an information systems environment?

Answer 33

It involves taking non-digital source data and using manual data entry to enter it into a computer to prepare it for processing.

Question 34

In system controls, what is the role of format checks?

Answer 34

They are a data transcription control, a type of input control which verifies that each item of data is entered in the proper mode: numeric data in a numeric field, a date in a date field, and so forth.

Question 35

In system controls, what are edit tests, and what are they used for?

Answer 35

They are a type of input control. They are input validation routines used to check the validity and accuracy of input data. Edit tests examine specific data fields and reject transactions if their data do not meet data quality standards.

Question 36

In system controls, what is a completeness check, and what is it used for?

Answer 36

It's a type of edit test, an input control. It checks whether all required data has been entered. It ensures that input has been entered into all required fields. It cannot verify that the input is correct, but it can verify that it is there. ## Footnote For example, a completeness check would check that every employee record has a social security number entered in the correct field.

Question 37

In system controls, what is a check digit, and what is it used for?

Answer 37

It is a type of edit test, an input control. It is one digit that is a function of the other digits within a number such as an account number. It is used to detect errors in transcription such as transposition errors that may take place during input.

Question 38

What is key verification, also called keystroke verification, and what is its purpose as a system control?

Answer 38

A type of edit test, an input control. It is the process of requiring information to be input twice for comparison by the system. Its purpose is to check for accuracy in input. ## Footnote Key verification is often used when changing a password, to confirm that the password has been typed accurately.

Question 39

Hash totals are a type of edit test, which is an input control, one of the categories of application controls in a systems environment. In system controls, what is a hash total?

Answer 39

A control total of nonmonetary information such as customer account numbers in a batch of transactions. ## Footnote A hash total can be run on a group of records to be input before processing and again after processing. If the hash total changes during processing, it indicates something has changed or some transactions may be lost

Question 40

In system controls, what is the purpose of processing controls?

Answer 40

They are a classification of application controls. They are designed to provide reasonable assurance that processing has occurred properly and that no transactions have been lost or incorrectly added.

Question 41

In system controls, what are the two classifications of processing controls?

Answer 41

Processing controls are a classification of application controls. They include: * Data access controls - processing controls at the time of data access * Data manipulation controls - controls involving data manipulation later in the processing

Question 42

In system controls, batch control totals are input controls, —but what else are they?

Answer 42

They are any type of total or count applied to a specific group of transactions. They are calculated manually, and as the computer processes the batch, it compares the processed total with the manual batch control total. If they match, the batch is posted. If they do not match, the posting is rejected, and the difference must be investigated.

Question 43

In system controls, what is a record count and what is it used for?

Answer 43

It is a type of processing control. The number of transaction items is counted twice, once when preparing the transactions in a batch and again when performing the processing, to confirm that the number of transactions has not changed during processing.

Question 44

In system controls, what is system testing and what is its purpose?

Answer 44

It is a type of data manipulation control, a classification of processing controls. Output from one program is often input to another, and system testing tests the linkages between the programs.

Question 45

In system controls, what is the purpose of activity, or proof, listings?

Answer 45

They are a type of validating control, one of two categories of output controls. Activity, or proof, listings document processing activity, provide detailed information about all changes to master files, and create an audit trail. When the proof listings are compared with the batch control totals that went along with the input and processing functions, they can be used to confirm that all the transactions were processed correctly.

Question 46

In system controls, what is the purpose of printed output controls?

Answer 46

Printed output controls are one of two categories of output controls. They are used to provide reasonable assurance that the printed output is accurate and complete, that it is sent to the right people, that it is sent in a timely manner, and that the proper reports are retained for the appropriate length of time.

Question 47

In system controls, what controls are necessary to maintain physical control over pre-numbered forms such as blank checks, and why?

Answer 47

1. Pre-numbered forms should be kept under lock and key, and only authorized persons should be permitted access. 2. The preprinted number on each form that is printed by the system must match the system-generated number for that form. If it does not, one or more blank forms could be missing, and an investigation is needed.

Question 48

What is the difference between preventive controls and detective controls, and what are examples of each in a systems environment?

Answer 48

* **Preventive controls** prevent errors and fraud before they occur. Examples are segregation of duties, job rotation, and dual access controls. * **Detective controls** uncover errors and fraud after they have occurred. Examples are batch control totals, completeness checks, hash totals, check digits, and validity checks.

Question 49

In system controls, what are feedback controls?

Answer 49

They produce feedback that can be monitored and evaluated to determine if the system is functioning as it is supposed to. ## Footnote Feedback controls help create a self-monitoring, self-regulating system.

Question 50

What is a feedback loop in an information system?

Answer 50

It is a self-monitoring system, which uses feedback to measure differences between actual output and desired output. The output is then fed back into the system as input, adjusting the operation according to those differences. Thus, it self-corrects. ## Footnote A self-monitoring system is sometimes called a cybernetic system.

Question 51

What is a system flowchart in an information system?

Answer 51

A **flowchart** is a diagram that creates a visual representation of processes or events. A **system flowchart** explains the functionality of a whole system. It documents the manual processes as well as the computer processes and the input, output, and processing steps.

Question 52

What is the role of a flowchart in assessing controls?

Answer 52

It assists in properly identifying risks at each point in the process or system, identifying controls necessary to address the risks, and assessing the effectiveness of existing controls.

Question 53

System and program development and change controls are a general operating procedure. What are the reasons for instituting system development controls during the development stage of an information system?

Answer 53

1. To ensure that all changes are properly authorized 2. To prevent errors in the resulting system 3. To limit the potential for other problems during the development process and after its completion. 4. To enhance accuracy, validity, safety, security, and adaptability of a new system's functions.

Question 54

What is the importance of a cost-benefit analysis during the Investigation and Feasibility Study stage of development of an information system?

Answer 54

To evaluate all possible solutions, determine the technological feasibility of each potential solution, determine whether the new system will provide an adequate payback for its cost, and identify potential risks. ## Footnote This analysis helps determine if a project should proceed before major investments are made.

Question 55

In an information systems environment, what are the benefits of well-managed system changes?

Answer 55

* Reduced errors and disruptions * Reduced resources and time required for changes * Reduced number of emergency fixes

Question 56

What is a feedforward control system in a systems environment?

Answer 56

It attempts to predict problems and deviations before they happen so that necessary changes or actions to prevent the problem or deviation from occurring can be planned, such as system capacity planning to anticipate demand and prevent system slowdowns. ## Footnote Feedforward controls guide actions to prevent or minimize the effects of potential problems.

Question 57

In information system development, what is the conceptual design?

Answer 57

It defines user expectations and system specifications, reducing interoperability problems and future modification costs. ## Footnote Proper conceptual design ensures better integration with existing systems.

Question 58

What should be included in an implementation plan for a new information system?

Answer 58

Plans for: * Site preparation * Equipment acquisition and installation * User training * Installation of operating software changes * Implementation of operating procedures and conversion procedures

Question 59

What are the types of documentation required for the implementation of a new information system?

Answer 59

* System documentation * Program documentation * Operating documentation * Procedural documentation * User documentation

Question 60

What are the benefits of good documentation and controls during implementation of a new information system?

Answer 60

More seamless integration of the new system into existing business processes and greater user proficiency and satisfaction.

Question 61

What are the methods of conversion to a new information system?

Answer 61

* Parallel * Phased * Pilot * Direct ## Footnote **Parallel** - running the old and the new systems together for a period of time **Phased** - converting only parts of the application or only a few locations at a time **Pilot** - testing the new system in one work site before full implementation **Direct** - changing over immediately from the old system to the new

Question 62

What is the purpose of continuous monitoring and evaluation after implementation of a new or changed information system?

Answer 62

To determine what is working and what needs improvement, supporting continuous improvement of the system.

Question 63

In an information systems environment, what are the concerns related to vendor package maintenance procedures?

Answer 63

1. Updates released by the vendor should be installed on a timely basis to ensure system compatibility. 2. If vendor-supplied software has had custom changes made to the vendor’s source code and the changes are not properly reinstalled on top of new releases, erroneous processing can result. 3. The organization should maintain change controls to verify that all custom changes are properly identified.