Auditing 378
Application Controls
Introduction [The computer logs all your activities and this log can be reviewed.
[If asked in a question for application controls also include a few general controls that are relevant. But if youre asked general
controls, only give general controls]
Application controls set specific internal controls over the use of the ‘accounting application’ and provide
reasonable assurance as to the completeness, timeliness, accuracy and validity of all processed transactions. (eg:
sale/ purchases/ wages)
They also set the controls over the maintenance of the relevant masterfile data.
Primary Objective: To prevent, detect and correct errors arising in a transaction, throughout the various stages of
the application process.
Control objectives do not change, the basic principles and methods (STORMM) are still applicable.
Application controls consist of:
o Independent user controls (ie. Totally user dependent)
o User controls dependent on the computerised information
o Programmed (logical) controls [passwords]
NB!And these controls can be classified as either:
o Preventative controls (prevents problems before they occur = errors and ommissions);
o Detective controls (to detect and report errors and ommissions = log bank recon to show mistakes and
correct them); or
o Corrective controls
To correct problems and errors (identified)
To identify the cause of the problem
To minimize the effect of the error
RELATIONSHIP BETWEEN GENERAL AND APPLICATION CONTROLS
Every program has its own
application controls General controls affect every
aspect of the system
Application
Specific
General
Controls
Processing Methods
There are 3 ways to enter & process data in a computerised system, namely:
o Batch entry and batch processing
Transactions (source docs) are collected together and then entered and processed in bundles at a
specific time (and the Masterfile is updated at a later stage)
, o On-line entry and batch processing
Transactions are entered into the system as they occur, but wait until a certain total accumulates,
where after they are processed together (bundle) - (and the Masterfile is updated at a later stage)
o On-line entry and real-time processing
Transactions are entered into the system as they occur and all processed immediately, with the
Masterfile updated automatically after each transaction.
Overview Detail as per notes
Input
General controls on General controls (training, documentation, access controls, SoD)
application level
Capturing & documentation Source documents: efficient design, pre-numbered
Sequential numbering
IC on the screen Screen design
Standard, user friendly (eg only enough spaces)
Resembles the source document
Capturing of transactions
By data control group (from source doc) of user (on-line)
Minimum data entered – if possible extract information from other
sources
Computer
Computer prompting
Compulsory fields
Descriptive data echo tests
Visual verification
Computer/Logical controls Validation tests
Validity tests (eg debtor account, number vs masterfile data)
Limit test (eg >limit, authorisation)
Alphabetic/ alphanumeric/ numeric characteristics
Sign tests (+ or -)
Related data/ matching tests (eg GRN no)
Field length test/ field size tests (# characters, eg date)
Reasonability test
Field length test/ field size tests (eg ID no)
Application Controls
Introduction [The computer logs all your activities and this log can be reviewed.
[If asked in a question for application controls also include a few general controls that are relevant. But if youre asked general
controls, only give general controls]
Application controls set specific internal controls over the use of the ‘accounting application’ and provide
reasonable assurance as to the completeness, timeliness, accuracy and validity of all processed transactions. (eg:
sale/ purchases/ wages)
They also set the controls over the maintenance of the relevant masterfile data.
Primary Objective: To prevent, detect and correct errors arising in a transaction, throughout the various stages of
the application process.
Control objectives do not change, the basic principles and methods (STORMM) are still applicable.
Application controls consist of:
o Independent user controls (ie. Totally user dependent)
o User controls dependent on the computerised information
o Programmed (logical) controls [passwords]
NB!And these controls can be classified as either:
o Preventative controls (prevents problems before they occur = errors and ommissions);
o Detective controls (to detect and report errors and ommissions = log bank recon to show mistakes and
correct them); or
o Corrective controls
To correct problems and errors (identified)
To identify the cause of the problem
To minimize the effect of the error
RELATIONSHIP BETWEEN GENERAL AND APPLICATION CONTROLS
Every program has its own
application controls General controls affect every
aspect of the system
Application
Specific
General
Controls
Processing Methods
There are 3 ways to enter & process data in a computerised system, namely:
o Batch entry and batch processing
Transactions (source docs) are collected together and then entered and processed in bundles at a
specific time (and the Masterfile is updated at a later stage)
, o On-line entry and batch processing
Transactions are entered into the system as they occur, but wait until a certain total accumulates,
where after they are processed together (bundle) - (and the Masterfile is updated at a later stage)
o On-line entry and real-time processing
Transactions are entered into the system as they occur and all processed immediately, with the
Masterfile updated automatically after each transaction.
Overview Detail as per notes
Input
General controls on General controls (training, documentation, access controls, SoD)
application level
Capturing & documentation Source documents: efficient design, pre-numbered
Sequential numbering
IC on the screen Screen design
Standard, user friendly (eg only enough spaces)
Resembles the source document
Capturing of transactions
By data control group (from source doc) of user (on-line)
Minimum data entered – if possible extract information from other
sources
Computer
Computer prompting
Compulsory fields
Descriptive data echo tests
Visual verification
Computer/Logical controls Validation tests
Validity tests (eg debtor account, number vs masterfile data)
Limit test (eg >limit, authorisation)
Alphabetic/ alphanumeric/ numeric characteristics
Sign tests (+ or -)
Related data/ matching tests (eg GRN no)
Field length test/ field size tests (# characters, eg date)
Reasonability test
Field length test/ field size tests (eg ID no)
