7.6b. Network and data center operation controls a.

Automatic rollback
This feature manages to backed out the
Address the availability of information
incomplete transactions, so the database is
processing facilities when needed.
returned to the state it was in before the
Data Centers – an artifact of central site transaction began.
management of large mainframe systems.
running program prematurely terminates - biglaang
[Mainframe- A mainframe is a large, powerful namatay
computer used for high-speed data processing
b. Uninterruptible Power Supply
and critical applications1234. It can connect to
Uses batteries - to continue process during a
multiple users and devices simultaneously and
power outage.
handle large amounts of data transactions]
Will supply long enough for files to be properly
Systems migrating to “client-server” and closed and for users to log off
distributed processing c. Alternative Processing Facility
Use during main channel downtime
Data center operation controls are also
appropriate for network operation d. Disaster Recovery Plan
[Client-server - A server accepts the client’s documents detailed recovery procedures to
requests, processes them and provides the quickly and smoothly restore an organization's
required response. processing capabilities after a catastrophic event.

- is a communication model that enables the to reduce "business risk"

distribution of tasks within a network.]

Network and data service center operation 7.6c. System software acquisition, implementation,
controls need to be implemented: and maintenance controls
 Backup controls – All files should be backed up System software includes:
routinely and the backup copies should be stored in a
secure, off-site location and tested regularly for  Database management systems
readability.  Communication software
- It is necessary to backup program files only  Operating system
one time – done aft the programs installed  Utility programs
and all custom work completed. Data files  Security software
should be backed up frequently. –Transaction These control activities also regulate:
files - atleast once a day. Master files – once
per posting period. Files w/ real-time posting  Logging
– more often than once a day  Tracking
 Downtime Controls  Monitoring activities of the information system
The repair of computer hardware may take several
days and, occasionally, several weeks. Therefore, to
reduce the amount of downtime, maintenance 7.6d. Application software section, implementation,
schedules should be established for all computer and maintenance controls
hardware.
Control activities also should address the application
software selection, implementation, and maintenance of
 Recovery controls
application software.
deal with prompt recovery of equipment failure and
natural disasters that could put the information Specifications for new applications should be drawn up
processing facilities out of operation for an extended jointly by users and IT personnel
period.
Application software such as: Accounting systems  Input Verification Controls
As data are entered in a screen form, they are verified
 New applications and modifications to applications
for correctness in numerous ways.
should be properly:
Some commonly used checks are:
 Authorized
- Valid codes
 Tested
- Reasonableness of amounts
 Approved
- Valid data type
 Documented
- Valid field length
 Implementation of new software:
- Logical relationships
Representatives of user departments (Accounting and - Anticipated contents
Internal Auditing) should be involved in selection of new - Valid date
application software  Correction of Data-Entry Errors
Error correction follows error detection. It may be
External Auditors should be consulted - to ensure the possible to rekey a transaction to correct it. Correcting
auditability of the system or reversing entries must be made.

7.7 INFORMATION PROCESSING – APPLICATION 7.7b. Processing Controls

CONTROLS
Refer to accurate and complete processing of transactions
Information processing general controls relate to the and other events.
reliability and consistency of the overall information
processing environment, application controls apply to the These controls include:
flow.
 Written Procedures
Application controls can be separated into: All computerized accounting systems include some
manual procedure. They can serve as guide for
1. Input employees and ensure consistency of operations.
2. Processing  Prenumbered Documents
Provides a means to ensure hat all authorized
3. Output transactions and other events are processed once and
4. Master File only once.
 Batch Controls
Provide assurance that as a batch progresses through
the various processing stages it contains the same set
7.7a. Input Controls
of records – no records have been lost or added.
refer to the authorization, entry, and verification of
o Record Count – can be made at different
data entering the system. Most of the errors in an
accounting system occur at the data-entry point. points and remains the same. Helps guard
against the accidental loss of records.
 Data and Transaction Authorization Controls o Control Total – the sum of amount in the
Authorization is granted by the upper management transaction records. This total is compared
through general authorizations - cover a whole class with the change in the cash balance at the
of transactions terminal.
specific authorizations - applies to a single o Hash Total – is formed from data elements,
transaction and is granted on a case-by-case basis such as customer numbers. This has no
economic, accounting, or arithmetic
 Input Screen Controls significance nevertheless is should remain the
Keyboard entry of data should be made through same throughout processing.
computer screen forms that are supported with
controls
 Visual Checking  Parallel simulation
Visual checking of reports and documents for  Integrated test facility (ITF)
reasonableness can detect errors in processing.  Embedded audit module
 Comparisons
Comparison of amounts can detect errors in
processing. The prices charged for individual items on 7.9 IT GOVERNANCE
sales order should be compared with the selling
prices for the items in the inventory master file.
7.9a. Expectations
7.7c. Output controls
Relate to providing output to the appropriate people 7.9b. Responsible Handling of transactions, events,
and using the output appropriately. and decision making

 Disclosure
7.7d. Master File Maintenance Controls  Independent review and continuous
Are designed into the master file maintenance improvement
function, which is used to add records, change the  Change management
contents of certain fields in records, and detect
records.
7.10 COMPUTER FORENSICS
- Prohibiting a user from duplicating or
changing an existing primary key field
- Probihiting a user from changing an account
 Computer forensics
balance
 Data fingerprints

7.8 MONITORING

*Explain the purpose of and approaches to maintaining

internal control, including IT auditing

Internal control needs to be monitored to determine

whether it is adequate and effective

Conducted on an

- Ongoing basis (
- Separate project
- Combination of both

IT auditing: COBIT (chap 6)

 Auditing around the computer

 Auditing with the computer / CAATS “computer-
assisted audit techniques”
 Auditing through the computer
 TECHNIQUES:
 Test data