1. Auditing Application Controls
Alexandria Hartig

2. About Application Controls
Defining application controls
Objective of application controls
Types of application controls
Input controls
Processing controls
Output controls
Integrity controls
Management trail

3. Application Controls vs. ITGCs
Information Technology General Controls
applies to ALL systems components, processes, and data present in an organization or systems environment.
Application controls
relates to the transactions and data pertaining to each computer-based application system. They are specific to each individual application.

4. Complex vs. Non-complex Environments
Complex IT
Infrastructure
Non-Complex
Changes to existing applications & systems
Few changes to existing IT environment
Creation of source code for in-house software
Implementation with no significant changes
Customized software that is adapted to needs
User options that do not alter functionality
Deployment of applications, changes, & code into production
Lack of IT development projects

5. Benefits of Application Controls
Reliability
Application controls are more reliable than manual controls
Benchmarking
PCAOB standard No. 5
“benchmarking of application controls can be used because these controls are generally not subject to breakdowns due to human failure.”

6. Benefits of Application Controls
Time and Cost Savings
Application controls take less time to test than manual controls

7. Assessing Risk
Risk Assessment techniques to identify critical vulnerabilities
The review’s nature, timing, & extent
The critical business functions supported by application controls
The extent of time and resources to be expended on the review
There are 4 key questions auditors should ask when determining the review’s appropriate scope

8. Four Key Questions should be asked when determining the review’s appropriate scope
What are the biggest organization wide risks and concerns that need to be assessed and managed while taking management’s views into account?
Which business processes are impacted by these risks?
Which systems are used to perform these processes?
Where are processes performed?

9. Example of Risk Assessment

10. Determining the review of scope
Business Process Method
Evaluate application controls present in all systems the support a business process
Most common and widely accepted
Single Application Method
Review application controls within a single application or module
Most effective in a non-ERP or non-integrated environment

11. Executing Review Planning Need for Specialized Audit Resources
Business Process Method
Documentation Techniques
Flowcharts
Process Narratives
Testing
Computer-Assisted Audit Techniques

12. Questions??