Systems Development, Program Changes, and Application Controls
Discussion Questions
SHORT ANSWER
1. Contrast the source program library (SPL) management system to the database management system (DBMS).
ANS:
The SPL software manages program files, and the DBMS manages data files.
2. Describe two methods used to control the source program library.
ANS:
passwords, separation of development programs from maintenance programs, program management reports,
program version numbers, controlling maintenance commands
3. New system development activity controls must focus on the authorization, development, and implementation
of new systems and its maintenance. Discuss at least five control activities that are found in an effective
system development life cycle.
ANS:
System authorization activities assure that all systems are properly authorized to ensure their economic
justification and feasibility.
User specification activities should not be stifled by technical issues. Users can provide written description of the
logical needs that must be satisfied by the system.
Technical design activities must lead to specifications that meet user needs. Documentation is both a control and
evidence of control.
Internal audit involvement should occur throughout the process to assure that the system will serve user needs.
Program testing is to verify that data is processed as intended.
4. What are the three broad categories of application controls?
ANS:
input, processing, and output controls
5. How does privacy relate to output control?
ANS:
If the privacy of certain types of output, e.g., sensitive information about clients or customers, a firm could be
legally exposed.
6. What are the three categories of processing control?
ANS:
Batch controls, run-to-run controls, and audit trail controls.
7. What control issue is related to reentering corrected error records into a batch processing system? What are
the two methods for doing this?
ANS:
Errors detected during processing require careful handling, since these records may already be partially processed.
Simply resubmitting the corrected records at the data input stage may result in processing portions of these
transactions twice.
Two methods are: (1) reverse the effects of the partially processed transactions and resubmit the corrected records
to the data input stage. The second method is to reinsert corrected records into the processing stage at which the
error was detected.
8. Output controls ensure that output is not lost, misdirected, or corrupted and that privacy is not violated. What
are some output exposures or situations where output is at risk?
ANS:
output spooling, delayed printing, waste, report distribution
9. Input controls are programmed procedures (routines) that perform tests on transaction
data to ensure they are free from errors. Name four input controls and describe what they test
ANS:
1. numeric-alphabetic checks look for the correct type of character content in a field, numbers or letters;
2. limit checks verify that values are within preset limits;
3. range checks verify the values fall with in an acceptable range
4. reasonableness check determines if a value in one field, which has already passed a limit check and a range
check, is reasonable when considered along with data in other fields of the record.
10. A __________________________ fraud affects a large number of victims but the harm to each appears to be
very small.
ANS:
salami
11. Describe a test of controls that would provide evidence that only authorized program maintenance is
occurring.
ANS:
reconcile program version numbers, confirm maintenance authorizations
12. Auditors do not rely on detailed knowledge of the application's internal logic when they use the
__________________________ approach to auditing computer applications.
ANS:
black box or auditing around the computer
13. Describe parallel simulation.
ANS:
The auditor writes a program that simulates the application under review. The simulation is used to reprocess
production transactions that were previously processed by the production application. The results of the simulation
are compared to the results of the original production run.
14. What is meant by auditing around the computer versus auditing through the computer? Why is this so
important?
ANS:
Auditing around the computer involves black box testing in which the auditors do not rely on a detailed
knowledge of the application's internal logic. Input is reconciled with corresponding output. Auditing through the
computer involves obtaining an in-depth understanding of the internal logic of the computer application. As
transactions become increasingly automated, the inputs and outputs may become decreasingly visible. Thus, the
importance of understanding the programming components of the system is crucial.
15. What is an embedded audit module?
ANS:
EAM techniques use one or more specially programmed modules embedded in a host application to select and
record predetermined types of transactions for subsequent analysis. This method allows material transactions to be
captured throughout the audit period. The auditor's substantive testing task is thus made easier since they do not
have to identify significant transactions for substantive testing.
16. What are the audit’s objectives relating to systems development?
ANS:
The auditor’s objectives are to ensure that (1) systems development activities are applied consistently and in
accordance with management’s policies to all systems development projects; (2) the system as originally
implemented was free from material errors and fraud; (3) the system was judged necessary and justified at various
checkpoints throughout the SDLC; and (4) system documentation is sufficiently accurate and complete to
facilitate audit and maintenance activities.
ESSAY
1. Outline the six controllable activities that relate to new systems development
ANS:
Systems Authorization Activities: All systems should be properly authorized to ensure their economic justification
and feasibility. This requires a formal environment in which users submit requests to systems professionals in
written form.
User Specification Activities: Users need to be actively involved in the systems development process. Users
should create a detailed written description of their needs. It should describe the user’s view of the problem, not
that of the systems professionals.
Technical Design Activities: The technical design activities translate user specifications into a set of detailed
technical specifications for a system that meets the user’s needs. The scope of these activities includes systems
analysis, feasibility analysis, and detailed systems design.
Internal Audit Participation: To meet the governance-related expectations of management under SOX, an
organization’s internal audit department needs to be independent, objective, and technically qualified. As such, the
internal auditor can play an important role in the control of systems development activities.
Program Testing: All program modules must be thoroughly tested before they are implemented. This involves
creating hypothetical master files and transactions files that are processed by the modules being tested. The results
of the tests are then compared against predetermined results to identify programming and logic errors.
User Test and Acceptance Procedures: Prior to system implementation, the individual modules of the system need
to be formally and rigorously tested as a whole. The test team should comprise of user personnel, systems
professionals, and internal auditors. The details of the tests performed and their results need to be formally
documented and analyzed. Once the test team is satisfied that the system meets its stated requirements, the system
can be transferred to the user.
2. Explain the three methods used to correct errors in data entry.
ANS:
Immediate Correction. In the direct data validation approach, error detection and correction take place during data
entry. When an error or illogical relationship is entered, the system should halt the data entry procedure until the
error is corrected.
Creation of an Error File. In the delayed data validation approach, errors are flagged and placed in an error file.
Records with errors will not be processed until the error is investigated and corrected.
Rejection of the Entire Batch. Some errors are associated with the entire batch and are not attributable to
individual records. An example of this is a control total that does not balance. The entire batch is placed in the
error file and will be reprocessed when the error is corrected.
3. The presence of an audit trail is critical to the integrity of the accounting information system. Discuss three of
the techniques used to preserve the audit trail.
ANS:
Transaction logs list all transactions successfully processed by the system and serve as journals, permanent
records. Transactions that were not processed successfully should be recorded in an error file.
After processing transactions, a paper transaction listing should be produced and used by appropriate users to
reconcile input.
Logs and listings of automatic transactions should be produced for transactions received or initiated internally by
the system.
Error listing should document all errors and be sent to appropriate users to support error correction.
4. Define each of the following input controls and give an example of how they may be used:
a. Missing data check
b. Numeric/alphabetic data check
c. Limit check
d. Range check
e. Reasonableness check
f. Validity check
ANS:
Missing data check. Some programming languages are restrictive as to the justification (right or left) of data
within the field. If data are not properly justified or if a character is missing (has been replaced with a blank), the
value in the field will be improperly processed. For example, the presence of blanks in a numeric data field may
cause a system failure. When the control routine detects a blank where it expects to see a data value, the error is
flagged.
Numeric-alphabetic check. This control identifies when data in a particular field are in the wrong form. For
example, a customer’s account balance should not contain alphabetic data and the presence of it will cause a data
processing error. Therefore, if alphabetic data are detected, the error record flag is set.
Limit check. Limit checks are used to identify field values that exceed an authorized limit. For example, assume
the firm’s policy is that no employee works more than 44 hours per week. The payroll system input control
program can test the hours-worked field in the weekly payroll records for values greater than 44.
Range check. Many times data have upper and lower limits to their acceptable values. For example, if the range of
pay rates for hourly employees in a firm is between 8 and 20 dollars, this control can examine the pay rate field of
all payroll records to ensure that they fall within this range.
Reasonableness check. The test determines if a value in one field, which has already passed a limit check and a
range check, is reasonable when considered along with data in other fields of the record. For example, assume that
an employee’s pay rate of 18 dollars per hour falls within an acceptable range. This rate is excessive, however,
when compared to the employee’s job skill code of 693; employees in this skill class should not earn more than 12
dollars per hour.
Validity check. A validity check compares actual field values against known acceptable values. For example, this
control may be used to verify such things as valid vendor codes, state abbreviations, or employee job skill codes.
If the value in the field does not match one of the acceptable values, the record is flagged as an error.
5. After data is entered into the system, it is processed. Processing control exists to make sure that the correct
things happen during processing. Discuss processing controls.
ANS:
Processing controls take three forms–batch controls, run-to-run controls, and audit trail controls.
Batch controls are used to manage the flow of high volumes of transactions through batch processing systems. The
objective of batch control is to reconcile output produced by the system with the input originally entered into the
system. This provides assurance that:
_ All records in the batch are processed.
_ No records are processed more than once.
_ An audit trail of transactions is created from input through processing to the output stage of the system.
Run-to-run controls use batch figures and new balances to monitor the batch as it goes through the system–i.e.
from run-to-run. These are to assure that no transactions are lost and that all are processed completely.
Audit trail controls are designed to document the movement of transactions through the system. The most
common techniques include the use of transaction logs and transaction listings, unique transaction identifiers, logs
and listings of automatic transactions, and error listings.
6. If input and processing controls are adequate, why are output controls needed?
ANS:
Output controls are designed to ensure that system output is not lost, misdirected, or corrupted and that privacy is
not violated. Great risk exists if checks are misdirected, lost, or stolen. Certain types of data must be kept private–
trade secrets, patents pending, customer records, etc.
7. Describe and contrast the test data method with the integrated test facility.
ANS:
In the test data method, a specially prepared set of input data is processed; the results of the test are compared to
predetermined expectations. To use the test data method, a copy of the current version of the application must be
obtained. The auditor will review printed reports, transaction listings, error reports, and master files to evaluate
application logic and control effectiveness. The test data approach results in minimal disruption to the
organization's operations and requires little computer expertise on the part of auditors.
The integrated test facility (ITF) is an automated approach that permits auditors to test an application's logic and
controls during its normal operation. ITF databases contain test records integrated with legitimate records. During
normal operations, test transactions are entered into the stream of regular production transactions and are
processed against the test records. The ITF transactions are not included with the production reports but are
reported separately to the auditor for evaluation. The auditor compares ITF results against expected results.
In contrast to the test data approach, the ITF technique promotes ongoing application auditing and does not
interfere with the normal work of computer services employees. In the test data approach, there is a risk that the
auditor might perform the tests on a version of the application other than the production version; this cannot
happen in the ITF approach. Both versions are relatively costly to implement. The major risk with the ITF
approach is that ITF data could become combined with live data and the reports would be misstated; this cannot
happen in the test data approach.
8. Contrast Embedded Audit Modules with Generalized Audit Software.
ANS:
Both techniques permit auditors to access, organize, and select data in support of the substantive phase of the
audit. The Embedded Audit Module (EAM) technique embeds special audit modules into applications. The EAM
captures specific transactions for auditor review. EAMs reduce operational efficiency and are not appropriate for
environments with a high level of program maintenance.
Generalized Audit Software (GAS) permits auditors to electronically access audit files and to perform a variety of
audit procedures. For example, the GAS can recalculate, stratify, compare, format, and print the contents of files.
The EAM is an internal program that is designed and programmed into the application. The GAS is an external
package that does not affect operational efficiency of the program. GASs are easy to use, require little IT
background on the part of the user, are hardware independent, can be used without the assistance of computer
service employees, and are not application specific. On the other hand, EAMs are programmed into a specific
application by computer service professionals.
9. What is the purpose of the auditor's review of SDLC documentation?
ANS:
In reviewing the SDLC documentation, the auditor seeks to determine that completed projects now in use reflect
compliance with SDLC policies including:
proper authorization of the project by users and computer service management,
a preliminary feasibility study showed that the project had merit,
that a detailed analysis of user needs was conducted,
that a cost-benefit analysis was performed,
that the project can be demonstrated to solve the users' problem, and
that the system was thoroughly tested.
10. Microcomputers have traditionally been difficult to control, leaving auditors with special problems in
verifying physical controls. Discuss what an auditor's objectives might be in testing microcomputer controls.
ANS:
The auditor must investigate several things: 1) that adequate supervision and operating procedures exist to
compensate for the lack of segregation of duties that occur when users are functioning also as programmers and
operators; 2) that access to hardware, data and software is limited to authorized personnel; 3) that backup
procedures are in place and implemented to prevent data and program loss; and 4) that procedures for systems
selection and acquisition assure high quality, error free, applications. This is far from an ideal situation.
11. Contrast the "black box" approach to IT auditing and the "white box" approach. Which is preferred?
ANS:
The black box approach is not concerned with the application's internal workings. The auditor examines
documentation of the system, interviews personnel, and bases the evaluation on the logical consistency between
input and output. This method is often referred to as "auditing-around-the-computer" because there is no
examination of data as it is processed.
The white box approach, also called "auditing-through-the-computer," relies on knowledge of the internal
workings of the systems and actually tests the application in action with test data having known results. Several
white box techniques are available. These include the test data method, base case evaluation, tracing, the
integrated test facility, and parallel simulation. This method makes the computer a tool of the audit as well as its
target.
End of Discussion Questions
TRUE / FALSE
1. Achieving batch control objectives requires grouping similar types of input transactions (such as sales orders)
together in batches and then controlling the batches throughout data processing.
2. The "white box" tests of program controls are also known as auditing through the computer.
3. The presence of a SPLMS effectively guarantees program integrity.
4. When using the test data method, the presence of multiple error messages indicates a flaw in the preparation of test
transactions.
5. Generalized audit software packages are used to assist the auditor in performing substantive tests.
6. The results of a parallel simulation are compared to the results of a production run in order to judge the quality of
the application processes and controls
7. Use of the integrated test facility poses no threat to organizational data files.
8. A run-to-run control is an example of an output control.
9. Input controls are intended to detect errors in transaction data after processing.
10. A check digit is a method of detecting data coding errors.
MULTIPLE CHOICE
1. Which of the following is correct?
a. check digits should be used for all data codes
b. check digits are always placed at the end of a data code
c. check digits do not affect processing efficiency
d. check digits are designed to detect transcription and transposition errors
2. Which statement is not correct? The goal of batch controls is to ensure that during processing
a. transactions are not omitted
b. transactions are not added
c. transactions are free from clerical errors
d. an audit trail is created
3. Which input control check would detect a payment made to a nonexistent vendor?
a. missing data check
b. numeric/alphabetic check
c. range check
d. validity check
4. An inventory record indicates that 12 items of a specific product are on hand. A customer purchased two of the items, but
when recording the order, the data entry clerk mistakenly entered 20 items sold. Which check could detect this error?
a. numeric/alphabetic data checks
b. limit check
c. range check
d. reasonableness check
5. Which check is not an input control?
a. reasonableness check
b. validity check.
c. spooling check
d. missing data check
6. A computer operator was in a hurry and accidentally used the wrong master file to process a transaction file. As a result,
the accounts receivable master file was erased. Which control would prevent this from happening?
a. header label check
b. expiration date check
c. version check
d. validity check
7. Run-to-run control totals can be used for all of the following except
a. to ensure that all data input is validated
b. to ensure that only transactions of a similar type are being processed
c. to ensure the records are in sequence and are not missing
d. to ensure that no transaction is omitted
8. Methods used to maintain an audit trail in a computerized environment include all of the following except
a. transaction logs
b. Transaction Listings.
c. data encryption
d. log of automatic transactions
9. Risk exposures associated with creating an output file as an intermediate step in the printing process (spooling) include
all of the following actions by a computer criminal except
a. gaining access to the output file and changing critical data values
b. using a remote printer and incurring operating inefficiencies
c. making a copy of the output file and using the copy to produce illegal output reports
d. printing an extra hardcopy of the output file
10. Which statement is not correct?
a. only successful transactions are recorded on a transaction log
b. unsuccessful transactions are recorded in an error file
c. a transaction log is a temporary file
d. a hardcopy transaction listing is provided to users
11. Input controls include all of the following except
a. check digits
b. Limit check.
c. spooling check
d. missing data check
12. Which test of controls will provide evidence that the system as originally implemented was free from material errors and
free from fraud? Review of the documentation indicates that
a. a cost-benefit analysis was conducted
b. the detailed design was an appropriate solution to the user's problem
c. tests were conducted at the individual module and total system levels prior to implementation
d. problems detected during the conversion period were corrected in the maintenance phase
13. Which statement is not true?
a. An audit objective for systems maintenance is to detect unauthorized access to application databases.
b. An audit objective for systems maintenance is to ensure that applications are free from errors.
c. An audit objective for systems maintenance is to verify that user requests for maintenance reconcile to program version
numbers.
d. An audit objective for systems maintenance is to ensure that the production libraries are protected from unauthorized
access.
14. When the auditor reconciles the program version numbers, which audit objective is being tested?
a. protect applications from unauthorized changes
b. ensure applications are free from error
c. protect production libraries from unauthorized access
d. ensure incompatible functions have been identified and segregated
15. When auditors do not rely on a detailed knowledge of the application's internal logic, they are performing
a. black box tests of program controls
b. white box tests of program controls
c. substantive testing
d. intuitive testing
16. All of the following concepts are associated with the black box approach to auditing computer applications except
a. the application need not be removed from service and tested directly
b. auditors do not rely on a detailed knowledge of the application's internal logic
c. the auditor reconciles previously produced output results with production input transactions
d. this approach is used for complex transactions that receive input from many sources
17. Which test is not an example of a white box test?
a. determining the fair value of inventory
b. ensuring that passwords are valid
c. verifying that all pay rates are within a specified range
d. reconciling control totals
18. All of the following are advantages of the test data technique except
a. auditors need minimal computer expertise to use this method
b. this method causes minimal disruption to the firm's operations
c. the test data is easily compiled
d. the auditor obtains explicit evidence concerning application functions
19. All of the following are disadvantages of the test data technique except
a. the test data technique requires extensive computer expertise on the part of the auditor
b. the auditor cannot be sure that the application being tested is a copy of the current application used by computer services
personnel
c. the auditor cannot be sure that the application being tested is the same application used throughout the entire year
d. preparation of the test data is time-consuming
20. All of the following statements are true about the integrated test facility (ITF) except
a. production reports are affected by ITF transactions
b. ITF databases contain "dummy" records integrated with legitimate records
c. ITF permits ongoing application auditing
d. ITF does not disrupt operations or require the intervention of computer services personnel
21. Which statement is not true? Embedded audit modules
a. can be turned on and off by the auditor.
b. reduce operating efficiency.
c. may lose their viability in an environment where programs are modified frequently.
d. identify transactions to be analyzed using white box tests.
22. Generalized audit software packages perform all of the following tasks except
a. recalculate data fields
b. compare files and identify differences
c. stratify statistical samples
d. analyze results and form opinions
ANS:
01 TTFFT TFFFT
ANSWER:
01 DCDBC AACBC
11 CCAAA DACAA
21 DD