06. The Nature and Evaluation of Application Controls

Similar to IT General Controls (ITGCs) discussed in the last chapter, application controls are vital to Information Systems (IS) auditing in ensuring the integrity, accuracy, and reliability of the data processed by IS. They are focused, specific, and specialized controls embedded in the software applications and information processing systems. We will start this chapter by discussing the nature, role, and significance of application controls for the organization and IS Auditors. Application controls efficiently safeguard information assets while widely varying across different applications; hence, understanding their nature and categories is crucial for effective IS auditing. We will also examine the repercussions of weak application controls, as they can range from minor data inaccuracies to significant financial losses and reputational damage.

Next, we will discuss the different types of application controls and how they interplay to create a robust control environment. We will primarily focus on the three most important categories of application controls: input controls, processing controls, and output controls. Input controls are designed to ensure the validity and accuracy of data at the point of entry. Processing controls maintain the integrity of data during various transformation processes. Output controls are designed to secure the dissemination of processed data.

We will also discuss how to evaluate these types of controls’ design and operating effectiveness. It is not just about knowing what controls exist but about understanding how well they function. We will discuss strategies to assess the design and implementation of controls, monitor their performance over time, and detect failures. Continuous improvement is a central theme here, emphasizing the dynamic nature of application controls in response to evolving technological landscapes and business needs. Lastly, we will dive into the practical aspects of auditing application controls. Designing an audit program for testing these controls is an art and a science. We will discuss the standard methods used to develop test scenarios, highlighting the increasing role of data analytics in auditing using practical examples and a case study approach.

Learning Objectives

By the end of this chapter, you should be able to

• Discuss the nature, role, and significance of application controls within IS.
• Distinguish between various types of application controls, including input, processing, and output controls.
• Assess the impact and potential risks of weak or ineffective application controls.
• Evaluate the design and operating effectiveness of application controls.
• Monitor and analyze the performance of application controls over time, identifying areas for improvement.
• Interpret the findings from application control testing to enhance the overall control environment.