Consideration of Internal Control in an IT Environment

1. Consideration of Internal Control in an IT Environment

2. Input/Output Devices Central Processing Unit Auxiliary Storage Card Readers Arithmetic Unit Magnetic Disks Terminals Control Unit Magnetic Drums Electronic Cash Primary Storage Magnetic Tapes Registers Optical Compact Optical Scanners Disks Magnetic Tape Drives Magnetic Disk Drives Optical Compact Disks Computer Hardware

3. Stand-alone accounting systems Integrated enterprise wide systems (e.g., SAP) Types of Systems

4. Batch processing On-line capabilities Database storage Computer networks End user computing System Characteristics

5. Information systems management Systems anslysis Applications programming Data base administration Data entry Computer operations Program and file library Data control Telecommunications Systems programming Organizational Structure—IT Environment

6. General Control Activities Developing new programs and systems Changing existing programs and systems Access to programs and data Computer operations Application Control Activities Programmed application control activities Manual application control activities User Control Activities Manual testing of output Reconciliations to input documents IT Control Activities

7. Input validation checks Limit test Validity test Self-checking number Batch controls Item count Control total Hash total Processing controls Programmed Control Activities

8. Auditing Around the Computer--Manually processing selected transactions and comparing results to computer output Manual Tests of Computer Controls--Inspection of computer control reports and evidence of manual follow-up on exceptions Auditing Through the Computer--Computer assisted techniques Test Decks Integrated Test Facility Controlled Programs Program Analysis Techniques Tagging and Tracing Transactions Parallel Simulation Techniques for Testing Application Controls