General vs. Application Controls

Two layers

IT general controls (ITGCs)

ITGCs apply across the whole IT environment. They keep systems, and the controls inside them, working as intended. The four usual areas:

Some frameworks also include IT governance, security management and business continuity at this level.

Application controls

Application controls sit inside a specific application and the business process it supports:

• Input controls: validation and edit checks, approvals, batch totals
• Processing controls: correct calculations, run-to-run totals, sequence and limit checks
• Output controls: reconciliations, controlled report distribution, review of exceptions
• Application security: roles and segregation of duties inside the application

Why ITGCs come first

Application controls depend on ITGCs:

• If change management is weak, an edit check or calculation could be altered without approval. The auditor can’t assume it worked the same way all year.
• If access controls are weak, users could bypass the application, change its configuration, or edit data directly in the database.
• If operations are weak, the scheduled jobs that carry out processing checks might not run, or might run only partly.

So the auditor normally tests ITGCs first.

The “test of one”

An automated control does exactly the same thing every time. If the ITGCs over change and access were effective all period, nobody could have altered it, so the auditor can test it once and rely on it for the whole period. This is sometimes called a test of one, or benchmarking.

Without effective ITGCs, that shortcut disappears. The auditor must test across the period, or rely on substantive testing instead.

Example. The ERP blocks a payment unless the order, the delivery and the invoice all match. The auditor tests it once with a few transactions and it works. Then change management testing shows developers can deploy straight to production. The auditor can no longer assume the three-way match worked all year, and tests a much larger sample of payments.

How the exam asks about it

In short

• IT general controls (ITGCs) apply across the IT environment: access, change management, development and acquisition, and operations.
• Application controls work inside one application: input checks, processing checks, output reconciliations, and roles within the application.
• Application controls depend on ITGCs. If ITGCs are weak, automated application controls can't be trusted.
• Auditors test ITGCs first, then use them to test application controls efficiently.
• An automated control can be tested once and relied on all year, but only if access and change ITGCs were effective.
• Weak ITGCs mean more substantive testing of the application's results.

Exam traps

• Strong edit checks don't make up for weak change management: the edit could be changed without anyone knowing.
• Backup, continuity and security management belong to ITGCs, not application controls.
• Roles inside an application are application controls; the process that gives users access is usually an ITGC.
• A 'test of one' for an automated control is only valid if ITGCs were effective all year.

Slides

Click the slide and use the arrow keys. F toggles full screen.