Information technology controls

Welcome to the World of IT Controls!

Hello there! Welcome to one of the most important chapters in your Business Assurance journey. In today's digital age, almost every business uses computers to record transactions and generate financial reports. As a future CPA, you don't need to be a computer programmer, but you must understand how to evaluate whether a company’s computer systems are reliable. If the IT system is "broken" or insecure, the financial numbers it produces cannot be trusted. In this chapter, we will break down IT controls into simple, bite-sized pieces that are easy to remember and apply in your exam.

Don't worry if technology isn't your "thing" – we are going to use plenty of everyday analogies to make these concepts stick!

1. The Big Picture: Why IT Controls Matter

In a manual system, an auditor looks at paper invoices and physical signatures. In a computerized system, everything happens behind a screen. Information Technology Controls are the "rules" and "safeguards" put in place to make sure the data stays accurate, complete, and private.

Quick Review: Why do we care? Because if the IT controls are weak, there is a high risk of Material Misstatement. Errors could happen automatically and repeatedly without anyone noticing!

2. General IT Controls (GITCs): The "Foundation"

Think of General IT Controls as the security guards and the structural integrity of a bank building. They don't look at individual transactions; instead, they create a safe environment for all the bank's activities to happen.

Definition: GITCs are policies and procedures that apply to all or many applications and support the effective functioning of application controls.

The Four Pillars of GITCs (Mnemonic: D-A-C-O)

1. Development and Acquisition (D):
This is about how the company gets its software. Did they test it before using it? Is there documentation?
Example: Before a new accounting software goes "live," the company should run a "pilot" version to make sure it calculates tax correctly.

2. Access to Programs and Data (A):
This is about security. Who can get into the system?
Key controls: Passwords, multi-factor authentication (MFA), and removing access for employees who have resigned.
Analogy: You wouldn't give every employee the key to the main vault, right? Only specific people should have "write access" to the general ledger.

3. Changes to Systems (C):
Once a system is running, any updates or "patches" must be controlled.
The Gold Rule: The person who writes the code should not be the same person who moves it into the live system. This is called Segregation of Duties.

4. Operations (O):
This covers the day-to-day "housekeeping."
Key controls: Backing up data every night, having a Disaster Recovery Plan (DRP), and monitoring for system failures.

Did you know? Many massive data breaches happen not because of "hacking" in the movies, but because a company forgot to "patch" (update) their software—a failure of General IT Controls!

Key Takeaway: If GITCs are weak, you cannot trust the software, even if the software itself seems to work fine. The foundation is shaky!

3. Application Controls: The "Individual Locks"

While GITCs cover the whole building, Application Controls are like the locks on specific filing cabinets. They relate to the processing of individual transactions (like sales orders or payroll).

Application controls ensure that transactions are Authorized, Complete, and Accurate. We usually group them into three stages:

A. Input Controls

This is the most critical stage. There is a famous saying in IT: "Garbage In, Garbage Out" (GIGO). If you enter the wrong data, the system will produce the wrong report.

Common Input Checks:

• Format Checks: Ensuring a date field only accepts numbers (e.g., YYYY-MM-DD).
• Range Checks: Ensuring a value falls within a sensible limit (e.g., an employee's age shouldn't be 150).
• Presence Checks: Ensuring a required field (like a Customer Name) isn't left blank.
• Check Digits: A mathematical formula to ensure an ID number (like a HKID or Credit Card) is valid.

B. Processing Controls

These make sure the data isn't lost or changed while the computer is "thinking."
Example: Batch Totals. If you upload 50 invoices totaling \( \$100,000 \), the system should check at the end of processing that it still has 50 invoices totaling \( \$100,000 \).

C. Output Controls

This ensures the results reach the right people and are correct.
Example: A report showing sensitive executive salaries should only be printed to a secure printer in the HR Manager's office.

Quick Review Box:
GITC: Protects the whole environment (e.g., Passwords).
Application Control: Protects a specific task (e.g., Checking if an invoice amount is too high).

4. The Relationship Between GITCs and Application Controls

As an auditor, you must understand how these two work together. This is a very common exam topic!

1. GITCs are the prerequisite. If the GITCs are ineffective (e.g., anyone can change the software code without permission), then the Application controls (e.g., a range check) could be secretly turned off or bypassed.
2. The "Top-Down" Approach: Auditors usually test GITCs first. If GITCs are strong, the auditor can have more confidence in the Application controls and may perform less substantive testing.

5. Common Pitfalls and Mistakes to Avoid

Mistake 1: Confusing GITCs with Application Controls.
Tip: Ask yourself, "Does this control affect everything in the IT department?" If yes, it's a GITC. If it only affects one specific form or process, it's an Application Control.

Mistake 2: Thinking "IT Controls" means "The computer does it automatically."
IT controls can be Manual (e.g., a manager reviewing a system-generated exception report) or Automated (e.g., the system blocking a transaction over a credit limit). Both are part of the IT control environment!

6. Summary Checklist for Students

When you are given a case study in the exam, look for these "Red Flags":

- Lack of Segregation of Duties: Does the IT manager also have the power to change financial data? (GITC Weakness)
- No Testing: Did they just install the software and hope for the best? (GITC Weakness)
- Shared Passwords: Are staff members using "Admin123" or sharing logins? (GITC Weakness)
- Manual Data Entry without Verification: Is there a risk of typos that the system doesn't catch? (Application Control Weakness)

Final Encouragement: IT controls might seem abstract because you can't "touch" them, but they follow the same logic as any other internal control. Just keep thinking: "How could someone accidentally or intentionally break this system, and what rule would stop them?" You've got this!