4.

8 Internal Controls in a CIS Environment

Internal control is an essential prerequisite for efficient and effective
management of any organization. Basically, they are the policies and
procedure adopted by a management to achieve the entity's specific
objectives like, physical verification of assets, periodic review and
reconciliation of accounts, specific control on computer generated data
etc.
An internal control in a CIS system depends on the same principal as
that of manual system.
Thus, the plan of organization, delegation of powers, system authorization,
distribution of duties etc., are determined on similar consideration as in a
manual system. However, in a CIS environment, due to difference in
approach there is various other types of controls which are quite specific
to CIS environment.
In setting up an internal control system in a CIS environment, the
overall CIS operation need to be broken down into defined subsystem
and controls established accordingly, addressing each function
separately so that auditors can place reliance on them. The basic
components that can be identified in a CIS environment are:
♦ Hardware (CPU, Monitor, Printers etc.)
♦ Software (Operating system, application programs, Data base
management system etc.)
♦ People (Data entry operator, CIS organization, end users)
♦ Transmission media
Once components have been identified, auditors must evaluate their
reliability with respect to each type of error or irregularity that might
occur.
The reliability of a component is a function of the controls that act on the
component. A control is stated to be a set of activities designed to prevent,
detect or correct errors or irregularities that affect the reliability of the
components. The set of all control activities performed in a system
constitutes the control subsystem within a system. Its function is to
establish execute modify and maintain control activities so that the
reliability of the system in maintained at an acceptable level. In a
computer system many different types of controls are used to enhance
component reliability. Major classes of control that the auditor must
evaluate are:

(1) Authenticity Controls - Authenticity control are exercised to verify

the identify of the individuals or process involved in a system (e.g.
password control, personal identification numbers, digital signatures)

(2) Accuracy Control - Accuracy control ensure the correctness of data

and processes in a system (e.g. program validation cheek that a numeric
field contains only numeric, overflow checks, control totals, hash total
etc.)

(3) Completeness Control – Completeness control attempt to ensure that

no data is missing and that all processing is carried through to its proper
conclusion. (e.g. program validation Check, sequence check etc.)
(4) Redundancy Control – Redundancy controls attempts to ensure that a
data is processed only once. (e.g. batch cancellation stamp, circulating
error files etc.)

(5) Privacy Controls – Privacy controls ensure that data is protected from
inadvertent or unauthorized disclosure. (e.g. cryptograph, data
compaction, inference control etc.)

(6) Audit Trail Controls – Audit trail control ensure traceability of all
events occurred in a system. This record is needed to answer queries, fulfil
statutory requirements, minimize irregularities, detect the consequences of
error etc. The accounting audit trail shows the source and nature of data
and process that update the database. The operations audit trail
maintains a record of attempted or actual resource consumption within a
system.

(7) Existence Controls – Existence controls attempt to ensure the ongoing

availability of all system resources (e.g., database dump and logs for
recovery purposes duplicate hardware, Preventive maintenance, check
point and restart control)

(8) Asset Safeguarding Controls – Asset safeguarding control attempt to

ensure that all resources within a system are protected from destruction or
corruption (e.g. physical barriers, Libraries etc.)
(9) Effectiveness Controls – Effectiveness control attempt to ensure that
systems achieve their goals. (e.g. monitoring of user satisfaction, post
audits, periodic cost benefit analysis etc.)

(10) Efficiency Controls – Efficiency controls attempt to ensure that a

system uses minimum resources to achieve its goals.

4.9 Consideration of Control Attributes by the Auditors

In evaluating the effects of a control, the auditor needs to assess the
reliability by considering the various attributes of a control. Some of the
attributes are:
(1) Whether the control is in place and is functioning as desired.
(2) Generality versus specificity of the control with respect to the
various types of errors and irregularities that might occur.
• General control inhibit the effect of a wide variety of errors and
irregularities as they are more robust to change controls in the application
sub-system which tend to be specific control because component in these
sub-system execute activities having less variety.
(3) Whether the control acts to prevent, detect or correct errors.
The auditor focuses here on
i) Preventive controls: Controls which stop errors or
irregularities from occurring.
ii) Detective controls: Controls which identify errors and
irregularities after they occur.
iii) Corrective controls: Controls which remove the effects of
errors and irregularities after they have been identified.
Auditors expect to see a higher density of preventive controls at the
early stages of processing or conversely they expect to see more
detective and corrective controls later in system processing.
(4) The number of components used to execute the control.
Multi-component controls are more complex and more error prone but
they are usually used to handle complex errors and irregularities.

4.10 Internal Control Requirement under CIS Environment

The requirement of internal control under CIS environment may cover
the following aspects:
(1) Organisation And Management Control – Controls are
designed to establish an organisational frame work for CIS activities
including:
a) Policies and procedures relating to control functions.
b) Appropriate segregation of incompatible functions.

(2) Application System Development and Maintenance Control

– Control are designed to provide reasonable assurance that systems
are developed and maintained in an authorised and efficient manner,
to establish control over:
a) Testing, conversion, implementation and documentation of new
revised system.
b) Changes made to application system.
c) Access to system documentation.
d) Acquisition of application system from third parties.
(3) Computer Operation Controls – Designed to control the
operation of the system and to provide reasonable assurance that:
a) The systems are used for authorized purposes only.
b) Access to computer operation is restricted to authorized
personnel.
c) Only authorized programs are to be used.
d) Processing errors are detected and corrected.

(4) System Software Control – Controls are designed to provide

reasonable assurance that system software is acquired or developed in
an authorised and efficient manner including:
a) Authorization, approval, testing, implementation and
documentation of new system software and system software
modification.
b) Restriction of access to system software and documentation
to authorized personnel.

(5) Data Entry And Program Control – Designed to provide

assurance:
a) An authorization structure is established over transaction
being entered into the system.
b) Access to data and program is restricted to authorized
personnel.

(6) Control Over Input – Control are designed to provide

reasonable assurance that:
a) Transactions are properly authorized before being processed
by the computer.
 b) Transactions are accurately converted into machine readable
form and recorded in the computer data files.
c) Transaction are not lost, added, duplicated or improperly
changed.
d) Incorrect transactions are rejected, corrected and if
necessary, resubmitted on a timely basis.

(7) Control Over Processing and Computer Data Files – Controls

are designed to provide reasonable assurance that:
a) Transactions including system generated transactions are
properly processed by the computer.
b) Transaction are not lost, added duplicated or improperly
changed.
c) Processing errors are identified and corrected on a timely
basis.

(8) Control Over Output – Designed to provide reasonable

assurance that:
a) Results of processing are accurate.
b) Access to output is restricted to authorized personnel.
c) Output is provided to appropriate authorized personnel on a
timely basis.

(9) Other Safeguards – Other safeguards include:

a) Offsite back-up of data and program.
b) Recovery procedures for use in the event of theft, loss or
intentional or accidental destruction.
c) Provision of offsite processing in the event of disaster.