RHODES UNIVERSITY

DEPARTMENT OF ACCOUNTING
AUDITING 3
APPLICATION CONTROLS
TUTORIAL SOLUTIONS

Tutorial Marks Time

Tutorial 1: Graded Questions : Chapter 5,Question 15 27 Minutes
13,Input controls
Tutorial 2: Graded Questions: Chapter 5,Question 24 43 Minutes
14,Processing and Masterfile Controls
Tutorial 3: Le Mauritia – (Marked by student) 14 25 Minutes
Tutorial 4: Electrifying (Hand in) 25 45 Minutes
TOTAL 78 140 Minutes
TUTORIAL 1

CHAPTER 5,QUESTION 13

Application controls (input controls)

[Link] minimum information must be entered by the customer by using the

following:
a)Drop-down boxes (for the number of shirts ordered) (1)
b)Advance auto-complete search functions from its database for style of shirt (1)

[Link] transaction must only be accepted by the system if all compulsory fields,
such as customer name and quantity ordered, were entered. (1)

[Link] following validation tests need to be performed on the respective input fields:
Sign check: The quantity of shirts and size of shirts ordered should not be a
negative number.
Alpha-numeric tests: The name of the customer must, for example, contain only
alphabetic characters and the quantity only numeric characters.
A field length test: This is to ensure that the username contains the correct number
of characters.
Descriptive data echo test: A picture and/or description of the shirt ordered must
appear on the screen to allow the customer to check the accuracy of the product
ordered.
Limit test: The total value of the purchase should be checked against the available
credit on the customer’s credit card.
Reasonableness test: This is to test a limit on the number of shirts a customer can
order of a certain product code. (max 3)

[Link] any of the validation tests identify invalid inputs, an error message should appear
on the screen requesting the customer to check the details entered. (1)

[Link] the order can be accepted and processed, the following must take place:
a)The total order (product selected, quantities entered etc.) must be displayed on the
screen (echoed back) and the customer must be prompted to check the accuracy
and completeness of the information entered. (1)
b)The system must be linked to the bank to confirm immediately that the payment is
received.(1)

[Link] receipt of the shirts, the customer must be requested by the kiosk assistant
to compare the shirts received against his receipt and he must sign the picking slip.
(1)

[Link] the order is handed over to the customer, the kiosk assistant must collect
the receipt from the customer, comparing the details with that of the picking slip.
These should be filed together. (1)

[Link] a customer make a capturing error, the transaction must be rejected via
showing an error message on the screen. (1)
[Link] customer must be required to correct the error immediately (i.e. no further
entries are allowed until the error is corrected).(1)

[Link] an error be identified or differences arise between shirts ordered and

received:
a)The shift manager should be required to address the error. (1)
b)All system amendments by the shift manager should require a high-level
password, before any correction can take place. (1)
c)The incorrect shirts must be returned by the kiosk assistant to the warehouse (to
the individual who prepared the shirts) with the picking slip while the customer waits.
(1)

Available marks [19]

Maximum marks [15]
TUTORIAL 2

QUESTION 14

Processing and Masterfile

1.
a)Risk that data could be lost during processing(1)
b)Risk that invalid data could be added during processing(1)
c)Risk that data could be changed during processing(1)
d)Risk that calculation or accounting errors could occur(1)
e)Risk that logic and other errors could exist in the program(1)
f)Risk that the wrong program or version of the data file could be used(1)
g)Risk that the repetition of errors in data processing could occur owing to
incorrect programming( 1)
h)Risk that multiplying errors could occur(1)
i)Risk that errors could influence other parts of the system(1)

2.
a)The control totals calculated after the update of the transaction data should be
reconciled with the control totals that have been recalculated (by hand or by
computer).(1)
b)A control total of the masterfile should be maintained on an independent file and
updated with the transaction data (file balancing/shadow balances). After the
processing cycle, it should be compared to the actual masterfile total.(1)
c)The console log should be checked regularly by the data control group (e.g. after
each run) in order to identify any processing disruptions, which should be
investigated.(1)
d)The administrator should inspect the output and control reports for any errors or
duplicated items.(1)
e)Errors should be reported on an automatically generated exception report.(1)
f)All the above-mentioned computer-generated reports should be reviewed and
investigated by a responsible staff member.(1)

3.
a)An authentication matrix should be used that will ensure that:(1)
i. access and rights (writing, reading, altering, deleting etc.) to certain files and
programs are restricted by linkage to usernames (and, in so doing, to the user’s job
description)(1)
ii. access to certain programs and files is acquired from the mainframe computer
only and not from terminals.(1)
b)Password controls should be employed by requiring correct passwords in order to
obtain access to the main-frame computer and the Masterfile:(1)
i. The passwords should be unique.(1)
ii. Staff should have alphanumerical passwords containing at least five characters.
(1)
[Link] passwords should be changed regularly.(1)
iv. The passwords should not appear on the screen.(1)
v. Passwords should not have obvious links to the users.(1)
vi. The passwords of staff who resign should be removed from the file. (1)
vii. Secrecy with regard to passwords is essential. (1)
c) The terminal should disconnect after three unsuccessful attempts as access (e.g.
by inputting the wrong password). (1)
d) In the event of a security breach, the system should disconnect automatically. (1)
e) When the system has not been in use for a certain period, users should be
deregistered and access to the system should require that the password be
recaptured. (1)
f) Access to the mainframe computer should be limited electronically by allowing
authorised staff only to use the system during office hours. (1)
 TUTORIAL 3 : Le Mauritia (14 Marks, 25 Minutes)
(Adapted from Advanced Case Studies, Frans Prinsloo)

State two possible control procedures that could have been implemented by Le
Mauritia (Pty) Ltd to address each of the risk factors listed above
Unauthorised intruder accessing information

a) Hackers (from outside the company) accessing data stored on the

company’s computer systems:

The management of Le Mauritia should consider implementing certain access

controls for example:
• the setting up and use of access profiles, which only permits authorised
terminals and users to access applications and files;
• A user should only be permitted access to an application on entering his
confidential password;

In order to prevent and detect unauthorised data they should implement the
following additional controls:
• To identify whether the source of the messages received is from an EDI trading
partner, use should be made of a dial back facility OR the digital signature
contained in the message should be verified;

• Management should consider the use of a firewall to control flow of messages

b) Reading of message during transmission:

• Management should make use of Encryption of messages in order to protect data from
being stolen, changed or compromised;
• Physically protecting cables from unauthorised access;
• Use of fiber optic cables as communication medium;
• Management should consider the use of traffic padding - adding additional data in your
network traffic to make it more difficult to identify the sender, receiver, and/or the data
being transmitted.

Unavailability of system due to:

a) Fire, flood or earthquakes:

• Management should ensure that there’s a disaster recover plan which is properly
documented, communicated and tested;
• This plan should include provision for suitable alternative processing facilities;

• Proper backup and off-site storage of all programs and data files;

• Environmental controls (e.g. CO2 fire extinguishers in areas where essential

components of the system are located).
b) Sabotage by employees:

• Proper controls over hiring of employees (to ensure that only honest, competent
employees are hired); (Control Environment)
*Least privileged controls – so employees do not have access to confidential information
that they should not have.
• Proper controls over dismissal of employees (once dismissed, employees’ usernames
should be terminated immediately and they should not be allowed any further access to
the computer facilities).
*Emphasize policies on consequence management so employees are aware of actions
that will take place if there’s a misconduct

Loss of data integrity

a) Loss of message during transmission:

 Correct use of headers and trailers.

 Use of encryption

b) Messages modified during transmission:

 Control totals / checksums established over message (verified by receiver);
 Edit checks carried out by receiver on message (e.g. verification of check
digits contained in message);
 Echo checks (when message received, it is echoed back to sender for
comparison);
 Packet sequence checks to help detect lost, duplicated, missing or mis-
sequenced data;
Lack of legal guidance (uncertainties in the law):
 Obtain legal advice from an internal legal team if applicable or external legal team
to identify and pre-empt problems or ;
 Ensure that the company have polices in place that align with legislation and these
policies should be easily accessible to all employees
 Enter into interchange agreements with trading partners and VAN specifying
responsibilities and obligations.
 Obtain SA Revenue Service directive about acceptability of computer
records to evidence transaction details.
MARK PLAN 1 mark per valid point max: 2
marks per risk factor
TUTORIAL 4

Electrifying (25 Marks, 45 Minutes)

(Adapted from University of The Free State, 2016 Exam)

a) Describe the controls that should be in place to ensure that all amendments to the
employee masterfile occurred and are authorised, accurate and complete.
 Masterfile amendment forms must be designed i.t.o sound document design
principles and accompany each amendment made. [1]
 All changes to the employee master file must be recorded on pre-numbered,
sequenced master file amendment forms (MAF) [1]
• Unused MAF must be subject to strict stationery controls. [1]
• Sequence check the amendments for gaps/duplicates/missing
numbers. [1]

These MAF's must be authorised by senior person and cross referenced to

supporting documentation, e.g. wage agreements. [1]

Only limited staff in an office should have write access to the employee master file
[1]

Write access to the master file must be restricted to one of the personnel clerks only,
by the use of passwords and user ID's [1]

A log must be generated by the computer for all changes to MF. [1]
A senior person should:
• reconcile each entry on the log to the supporting approved MAF [1]
• reconcile each MAF to the log (completeness) [1]
• sequence check the logs [1]

The following programmed input validation checks/controls must be in place to

ensure that all changes have been accurately recorded [3]

• alphanumeric checks; e.g. on name

• range checks; e.g. pay rates
• limit checks; e.g. pay rates
• Reasonableness checks; e.g. pay rates in relation to status and mandatory field
checks; e.g. employee number
• sequence checks; e.g. MAF number
• screen formatting

MAX 3 for validation/edit checks MUST give examples of edit checks, cannot merely
list all the edit/validation checks without making it applicable to masterfile
amendment form.

AVAILABLE MARKS 15
MAXIMUM 11
b) With regards to the clock cards, describe batch controls that should be
implemented to ensure that all valid clock cards are accurately captured on the PIV
system.
Clock cards should be divided into workable batches of approximately 50. [1]

Each batch should be accompanied by a batch control sheet. [1]

Each batch control sheet should have a unique, sequenced number. [1]

Each batch control sheet should be recorded onto a batch register. The register
should be signed when it is accepted by Izak upon collection. [1]

When Lucy received the batches, control sheets and register, she should:
• Reconcile the batches to the register [1]
• Sign for acknowledgement of receipt [1]
Batch control sheets should be completed by including:
• Hash totals e.g. employee numbers [1]
• Control totals e.g. hours worked [1]
• Record count e.g. number of clock cards in each batch. [1]
(½ for mentioning total, ½ for example)

Clock cards must be read into PIV per batch. [1]

The system should request batch, hash and control totals per the batch control
sheet. [1]

The system should recalculate totals for batch, hash and control totals [½]

• If the totals agree to the totals read in, the batch should be accepted. [½]

• If the totals disagree with the totals read in, the batch must be rejected. [½]

AVAILABLE MARKS 12 ½
MAXIMUM 9

2. Based on the information provided in attachment 1 (page 6), respond to the

senior accountant, explaining whether the business risks identified by the
audit committee is of relevance to the audit firm.

Auditing standards require the auditor to perform risk assessment

procedures as a basis for the identification and assessment of the risk of
material misstatement at the overall financial statement and assertion level. 1
Risk assessment procedures are defined as audit procedures performed to
obtain an understanding of the entity and its environment, including the 1
internal control within the entity.

As part of obtaining an understanding of the entity and its environment, the

auditor is required to obtain an understanding of the entity’s objectives and 1
strategies, and those related business risks that may result in risks of
material misstatement.
An understanding of the business risks facing the entity increases the
likelihood that the auditors will identify risk of material misstatement. Most 1
business risks will eventually have financial consequences and therefore
affect the financial statements.
The auditors however do not have the responsibility to identify and assess
all business risks as not all business risk gives rise to risk of material 1
misstatement.
Most of the business risks identified by the audit committee can potentially
affect the financial statements and will therefore be relevant to the audit. 1
All of the business risks identified by the audit committee may indicate that
the preparation of the financial statements on the going concern basis 1
might not be appropriate.
Please note that the abovementioned is to ensure that it is a
complete solution. The available marks are much more than the max
marks of
1.3 to 1. This is to ensure that all possible options that students
could address, are included in the solution, you would not have
needed to mention everything. You should however have noted the
points below.
The business risks will only be relevant if it result in risk at financial
statement level or risk at assertion level: 1
 Decrease in client satisfaction due to regular load shedding – will
not affect the financial statements 1
 Relaxation of credit terms in the current financial year; risk of
valuation of debtors 1
 Ongoing strikes by employees in the rural areas where power
stations are located – risk at financial statement level if it could
result in going concern risk.