Consideration of Internal Control in an IT Environment

McGraw-Hill/Irwin © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 8-2 Computer Hardware Input/Output Devices Central Processing Unit Auxiliary Storage Card Readers Arithmetic Unit Magnetic Disks Terminals Control Unit Magnetic Drums Electronic Cash Primary Storage Magnetic Tapes Registers Optical Compact Optical ScannersDisks Magnetic Tape Drives Magnetic Disk Drives Optical Compact Disks

McGraw-Hill/Irwin © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 8-3 Types of Systems Stand-alone accounting systems Integrated enterprise wide systems (e.g., SAP)

McGraw-Hill/Irwin © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 8-4 System Characteristics Batch processing On-line capabilities Database storage Computer networks End user computing

McGraw-Hill/Irwin © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 8-5 Organizational Structure—IT Environment Information systems management Systems anslysis Applications programming Data base administration Data entry Computer operations Program and file library Data control Telecommunications Systems programming

McGraw-Hill/Irwin © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 8-6 IT Control Activities General Control Activities Developing new programs and systems Changing existing programs and systems Access to programs and data Computer operations Application Control Activities Programmed application control activities Manual application control activities User Control Activities Manual testing of output Reconciliations to input documents

McGraw-Hill/Irwin © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 8-7 Programmed Control Activities Input validation checks Limit test Validity test Self-checking number Batch controls Item count Control total Hash total Processing controls

McGraw-Hill/Irwin © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 8-8 Techniques for Testing Application Controls Auditing Around the Computer--Manually processing selected transactions and comparing results to computer output Manual Tests of Computer Controls--Inspection of computer control reports and evidence of manual follow-up on exceptions Auditing Through the Computer--Computer assisted techniques Test Decks Integrated Test Facility Controlled Programs Program Analysis Techniques Tagging and Tracing Transactions Parallel Simulation