Application Controls

Overview and Scope of Application Controls

• Accounting Information Systems (AIS) heavily rely on preventive, detective, and corrective controls embedded directly within the system.
• Controls in an organizational environment are categorized across distinct operational hierarchies:
  • Entity-level or enterprise-level controls.
  • Process-level controls.
  • Transaction-level controls.
• Application controls operate specifically at either the process level or the transaction level.
• An application control is defined as a control that pertains directly to the scope of individual business processes or specific application systems.
• The primary objectives of application controls include:
  • Ensuring input data is complete, accurate, authorized, and correct.
  • Ensuring data is processed as intended within an acceptable time period.
  • Ensuring data is stored accurately and completely.
  • Ensuring system outputs are accurate and complete.
  • Establishing a robust audit trail, enabling the complete tracing of processing from initial input, through the transformation that occurs during processing, to the final output.
  • Providing logging and monitoring mechanisms to evaluate issues or discrepancies when they arise.

The CIA Framework in Information Systems

• All application control objectives align directly with the broader CIA triad framework (Confidentiality, Integrity, and Availability), which defines the overarching control objectives of an information system.
• Confidentiality:
  • Focuses on ensuring that data stored within the information system and the information it produces remain confidential.
  • Restricts access so that only authorized individuals are permitted to access, transform, and view data and information.
• Integrity:
  • Focuses on maintaining the reliability, trustworthiness, accuracy, completeness, and correctness of data and information.
  • Just as a person lacking integrity cannot be trusted or relied upon, data or information lacking integrity cannot be relied upon for decision-making purposes.
• Availability:
  • Focuses on ensuring that information systems, infrastructure, applications, and the data stored or created by them are accessible when needed.
  • Establishes the expectation that systems, websites, and applications are operational, up, and running whenever users log on or attempt access.

Structural Levels of Application Controls

• Application controls function across four distinct operational levels:
  • Input Controls
  • Processing Controls
  • Output Controls
  • Storage Controls

Detailed Analysis of Application Control Levels

• Input Controls:
  • Address data entering the information system.
  • Directly tackle the "garbage in" component of the Garbage In, Garbage Out (GIGO) principle.
  • Consist of program procedures, commonly referred to as edits or edit checks, that perform tests on transaction data to ensure freedom from errors.
  • Control goals focus on ensuring incoming data is complete, accurate, timely, authorized, correct, and error-free.
• Processing Controls:
  • Address the transformation phase where raw data is converted into meaningful information.
  • Consist of program procedures designed to ensure that an application's logical algorithms function accurately.
  • Primary control goals require data to be transformed under three strict criteria:
  • Completely: Processed in its entirety without hiccups or omissions.
  • Accurately: Mathematical calculations and logical steps are executed correctly (e.g., ensuring a multiplication logic like $2 \times 4 = 8$ is calculated accurately).
  • Only Once: Prevents duplicate processing of transactions.
  • Practical implications of the "only once" requirement:
  • Duplicate processing of a disbursement results in erroneous cash outflows (sending extra money out the door).
  • Duplicate processing of a revenue transaction results in overstating financial revenues.
• Output Controls:
  • Address information generated following transformation, making it available to end users for decision-making purposes.
  • Consist of a combination of program routines and procedures (both manual and automated).
  • Control goals ensure system output is not lost, misdirected, or corrupted, and that user privacy is strictly preserved without violation.
  • Encompasses both historical manual control practices (such as those managed by accountants in the late 1980s and early 1990s) and modern technological implementations.
• Storage Controls:
  • Address the methods and protocols used to safely store and secure data and information within the system environment over time.