Internal Controls in a Computerised Environment: Information Processing, Operating, and Master File Controls

Comprehensive practice flashcards covering operating controls, transaction processing controls, batch controls, error correction procedures, output safeguards, and master file amendments.

How should a company mitigate disaster impact if it cannot afford expensive backup facilities?

The company must ensure sufficient and appropriate insurance cover is in place covering all pertinent risks (including loss of profits from business interruption) and avoid over-reliance on staff by having sufficient qualified backup personnel.

What is the primary focus of operating controls and system maintenance controls?

They deal specifically with the technical manner in which the computer information system (CIS) operates and set standards on managing IT resources, rather than internal controls around information.

Who is responsible for formulating and maintaining operating and system maintenance controls?

The IT manager is responsible for formulating, setting up, and implementing standards, while IT technicians are mainly responsible for implementing and maintaining these controls.

What is the primary objective of information processing controls?

To prevent, or detect and correct, misstatements from arising when a transaction is input to, processed by, or output is generated by an application program.

What are independent manual controls, and what is an example of one?

User controls performed independently of the computer system's operations and in no way dependent on system output, such as authorising hard-copy purchase orders or maintaining custody over assets.

What are IT-dependent manual controls?

User controls that are dependent on output produced by the computer system, such as a manager reviewing an access log or a register extracted from the computer.

What is the difference between implied authorisation and explicit authorisation in an application?

Implied authorisation occurs when the program proceeds only if pre-set parameters or algorithms are met; explicit authorisation requires approval granted by a senior staff member capturing credentials like a username, password, or PIN.

What is a data echo test (closed-loop verification)?

A screen aid where entering minimal identifying data (such as a debtor number) causes the application to retrieve and display underlying master file details on screen for user visual confirmation.

How does a limit test differ from a sign test in logical programmed controls?

A limit test (range check) tests data against a threshold or benchmark (e.g., checking against a credit limit), whereas a sign test requires an entered field to be strictly positive or negative (e.g., flagging negative inventory quantities).

What are the three types of control totals calculated during batch input preparation?

Financial totals (sum of financial values like sales amounts), hash totals (sum of non-financial numeric fields like account or document numbers), and record counts (total number of documents or items in a batch).

What minimum data must be contained on a batch control sheet?

A unique batch number, all calculated control totals, and a description of the transaction and related details.

What process occurs when an error is identified on an original source document during capturing?

The system deletes the transaction, transfers it to an error suspense/temporary file, prints a report, and the capturer logs it in an error register and returns the document to the preparer for correction.

What is file balancing (shadow balancing)?

A processing control where master file control totals scheduled to be updated by an independent transaction file are compared against the actual updated master file totals to detect discrepancies.

Which four stages of output must be addressed by an entity's written distribution policy?

At generation, during distribution, on receipt, and after use.

What specific text markers should a recipient verify on report pages to confirm completeness?

Confirm that blank pages contain the words 'empty page' and that the end of the report contains the words 'end of report'.

Why do master file changes carry higher risk than ordinary transaction processing?

Master file data is stored and re-used across many subsequent transactions and programs; therefore, a single error in the master file will corrupt all dependent transactions and calculations.

What access restrictions and review rules apply to the master file changes register?

Only read-only rights are granted, restricted to management and senior staff, who regularly review it against authorised request forms to ensure valid, complete, and authorized amendments.

Which five measures provide data communication control according to section 5.9.3.5?

Processing-style validation controls, specialized software (encryption, firewalls, anti-malware), communication management software, physical cable protection, and advanced networking technologies such as VPNs.