Guide to Using International Standards on Auditing in - IFAC

69
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
General IT Controls
Access <strong>to</strong>
Programs
and Application
Data
Program
Development and
Program Changes
Moni<strong>to</strong>ring of IT
Operations
Issuance/removal and security of user passwords and IDs.
Internet firewalls and remote-access controls.
Data encryption and cryp<strong>to</strong>graphic keys.
User accounts and access-privilege controls.
User profiles that permit or restrict access.
Acquisition and implementation of new applications.
System development and quality-assurance methodology.
The maintenance of existing applications, including controls over program changes.
Policies, procedures, inspections, and exception reports ensuring:
• That information users are receiving accurate data for decision-making;
• Ongoing compliance with general IT controls; and
• That IT is serving the entity’s needs and aligned with the business requirements.
IT Application Controls
IT application controls relate <strong>to</strong> a particular software application used at the business process level.
Application controls can be preventive or detective in nature, and are designed <strong>to</strong> ensure the integrity of the
accounting records.
Typical application controls relate <strong>to</strong> procedures used <strong>to</strong> initiate, record, process, and report transactions or
other financial data. These controls help ensure that transactions occurred, are authorized, and are completely
and accurately recorded and processed. Examples include edit checks of input data with correction at the
point of data entry, and numerical sequence checks with manual follow-up of exception reports.