IT Application Controls for the CPA BAR Exam
Master IT application controls for the CPA BAR section. Covers input controls, processing controls, output controls, data validation techniques, and error handling.
What Are Application Controls?
Application controls are automated procedures within individual software applications that ensure the completeness, accuracy, authorization, and validity of data processing. While IT general controls apply to the entire IT environment, application controls are specific to individual business processes and applications. They operate at the transaction level and directly affect the reliability of the data processed by the application.
Application controls are categorized into three types based on where they operate in the data processing cycle: input controls, processing controls, and output controls. The CPA BAR exam tests your understanding of these control categories and common techniques used within each.
Input Controls
Input controls ensure that data entering the system is complete, accurate, authorized, and valid. They are critical because errors introduced during input propagate through the entire system. The principle of garbage in, garbage out underscores the importance of catching errors at the point of entry.
Data Validation Checks
Validity checks verify that entered data is a legitimate value. For example, a state code field might be checked against a table of valid state abbreviations. Range checks verify that entered values fall within acceptable limits (e.g., hours worked between 0 and 80). Reasonableness checks evaluate whether data makes sense in context (e.g., an employee's pay rate falling within an expected range for their job classification).
Check digits are calculated values appended to identification numbers (such as account numbers or product codes) that allow the system to detect transcription errors. The system recalculates the check digit from the entered number and compares it to the appended digit; a mismatch indicates an input error.
Batch Controls
When transactions are processed in batches, batch controls help ensure all transactions are processed and none are added, lost, or duplicated. A batch control total is the sum of a numeric field across all transactions in a batch (e.g., total dollar amount). A hash total is the sum of a non-meaningful numeric field (e.g., the sum of account numbers) used solely for control purposes. A record count is the number of transactions in the batch. These totals are calculated before processing and compared to system-generated totals after processing.
Authorization Controls
Authorization controls ensure that only approved transactions are entered and processed. These may include digital signatures, password-protected access to transaction entry screens, approval workflows that require management authorization before processing, and transaction limits that flag or block transactions exceeding specified thresholds.
Processing Controls
Processing controls ensure that data is processed correctly and completely once it enters the system. Key processing controls include run-to-run totals, which track batch totals through successive processing stages to ensure no transactions are lost or duplicated during processing.
Sequence checks verify that records are processed in the correct order, which is important for sequential file processing. Balancing controls compare output totals to input totals plus or minus expected changes, ensuring the mathematical accuracy of processing. Limit checks during processing can flag calculated results that fall outside expected ranges, indicating potential processing errors.
Error Handling
Effective error handling procedures are essential processing controls. Rejected transactions should be written to a suspense file or error report for investigation and correction. The system should generate error logs documenting the nature and cause of each error. Procedures should ensure that all rejected transactions are investigated, corrected, and resubmitted in a timely manner, and that no transactions are lost during error correction.
Output Controls
Output controls ensure that processing results are complete, accurate, and distributed only to authorized recipients. Key output controls include reviewing output reports for reasonableness, reconciling output totals to input totals, controlling the distribution of sensitive reports (ensuring they reach only authorized users), and securing printed output until it is distributed.
Report distribution logs track who receives each report and when. Exception reports highlight unusual transactions or results that require management review. Retention and destruction policies ensure that output is retained for the required period and then securely destroyed.
Automated vs. Manual Controls
Application controls are typically automated (built into the software) and operate consistently without human intervention. This is an advantage over manual controls, which are subject to human error, fatigue, and circumvention. However, automated controls must be properly designed and tested, and they depend on effective IT general controls. Changes to applications could inadvertently disable or modify automated controls, making change management and testing critical.
Application Controls and Financial Reporting
Application controls directly affect the reliability of financial data. For example, input validation controls on the accounts payable system help ensure that only valid vendor invoices are recorded. Processing controls in the payroll system help ensure that employee pay is calculated correctly. Output controls on financial reports help ensure that the data presented to management and external users is accurate and complete.
Exam Preparation Tips
- Know the three categories of application controls (input, processing, output) and examples within each category.
- Understand common data validation techniques: validity checks, range checks, reasonableness checks, and check digits.
- Be able to distinguish between batch control totals, hash totals, and record counts.
- Know how application controls relate to IT general controls and why both are necessary.
- Understand error handling procedures and why timely resolution of rejected transactions is important.
Practice What You Learned
Study with 1,200+ flashcards and 140 practice exams across all 4 CPA sections.