Question

27. Distinguish between ‘General controls’ and ‘Application controls’ in a computerized environment.

Answer 1

Difference Between General Controls and Application Controls

General Controls

These are the policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper

operation of information systems. These controls apply to mainframe, server, and end-user environments.

General IT controls commonly include:

# System software acquisition, change and maintenance

# Controls over data center and network operations

# Application system acquisition, development, and maintenance

# Access security

# Physical security of assets, including adequate safeguards such as secured facilities over access to assets and records

1)

General controls apply to a wide range of exposures that systematically threaten the integrity of all applications processed within the CBIS environment.

Some examples of general controls are controls against viruses and controls to protect the hardware from vandalism.

Application Controls

These are the controls that relate to specific computer software applications and the individual transactions.

For example, a company would usually place restrictions on which personnel have authorization to access its general ledger so as to revise its chart of accounts,

posting / approving journal entries etc.

In order to enact this policy and restrict access, the general ledger software package would require the necessary functionality.

The literature and regulations pertaining to the review and testing of IT Application controls by auditors and management, addresses 3 types of application controls :-

1) Input Controls

transactions captured, accurately recorded, and properly authorized

2) Processing Controls

transaction processing has been performed as intended

2) Output Controls

accuracy of processing result

These control tests are typically performed when a new system has been implemented.

Application controls are narrowly focused on exposures within specific systems.

Some examples of application controls are controls to make sure that each employee onlyreceives one paycheck per pay period and controls to ensure that each invoice gets paid only once