{"id":2737,"date":"2026-04-08T04:11:45","date_gmt":"2026-04-08T04:11:45","guid":{"rendered":"https:\/\/gmsisuccess.in\/?p=2737"},"modified":"2026-04-08T04:11:45","modified_gmt":"2026-04-08T04:11:45","slug":"system-control-very-important-notes","status":"publish","type":"post","link":"https:\/\/gmsisuccess.in\/?p=2737","title":{"rendered":"System Control.Very important Notes"},"content":{"rendered":"

\"\"<\/p>\n

 <\/p>\n\n\n\n
<\/td>\nGMSi Gmsisuccess <gmsi2022cia@gmail.com><\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n
control application notes<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n\n\n
GMSi Gmsisuccess\u00a0<\/strong><gmsi2022cia@gmail.com><\/td>\nWed, Apr 8, 2026 at 9:06 AM<\/td>\n<\/tr>\n
To: GMSi Gmsisuccess <gmsi2022cia@gmail.com><\/td>\n<\/tr>\n
\n\n\n\n
System controls<\/strong>\u00a0<\/strong>ensure the integrity of IT environments through two main layers:\u00a0General Controls<\/a>\u00a0 (ITGCs)<\/strong>\u00a0 and\u00a0\u00a0Application Controls<\/a>\u00a0(ITACs)<\/strong>. ITGCs (e.g., security, backups, change management) apply\u00a0broadly to all systems, while application controls (e.g., data validation, authorization) are\u00a0specific, input-output checks for particular applications. Both are essential for accuracy and security<\/p>\n

General controls<\/u>\u00a0(ITGC) are\u00a0broad policies\u00a0safeguarding the entire IT infrastructure (security, systems, development), while\u00a0application controls\u00a0<\/u>are\u00a0specific, automated controls within software ensuring\u00a0data integrity for specific transactions.\u00a0General controls support the reliable operation of application controls, which focus on input, processing, and output.<\/strong><\/p>\n

IT General Controls (ITGC)<\/a><\/strong>
\nITGCs apply to all IT systems and support the overall IT environment<\/strong>. Key areas include:<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Access Controls:<\/strong>\u00a0Managing user access to systems, data, and programs.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Change Management:<\/strong>\u00a0Ensuring authorized, tested changes to systems.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Backup and Recovery:<\/strong>\u00a0Protecting against data loss.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Physical Security:<\/strong>\u00a0Securing data centers and hardware.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0IT Operations:<\/strong>\u00a0Managing data center operations and backups.<\/p>\n

IT Application Controls (ITAC)<\/a><\/strong>
\nITACs are embedded in business applications (like ERP or billing systems) to ensure transaction accuracy and completeness. They typically focus on three areas:<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Input Controls:<\/strong>\u00a0Validation checks, data formatting, and authorization checks (e.g., ensuring fields are not blank, dropdown menus).<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Processing Controls:<\/strong>\u00a0Ensuring authorized transactions are processed accurately and completely.<\/p>\n

Output Controls:<\/strong>\u00a0Verifying that output reports and data are complete, accurate, and properly distributed.<\/p>\n

Key Differences<\/strong><\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Scope:<\/strong>\u00a0ITGC covers the broad IT infrastructure; ITAC covers specific application transactions.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Purpose:<\/strong>\u00a0ITGC maintains a reliable operating environment; ITAC ensures accuracy of data.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Responsibility:<\/strong>\u00a0ITGC is managed by IT staff; ITAC is often managed by business process owners.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Nature:<\/strong>\u00a0ITGC often includes manual procedures, while ITAC is usually automated.<\/p>\n

 <\/p>\n

Case-based questions, scenarios, and answers analyzing IT System Controls, General Controls (ITGC), and Application Controls, based on auditing standards and scenarios.<\/p>\n

Case 1: The “Too-Busy” Administrator (General Control Focus)<\/strong><\/p>\n

Scenario:<\/strong>\u00a0A company, XYZ Ltd., has a high-turnover IT department. Due to limited staff, the Database Administrator (DBA) not only manages database security but also develops and changes the application code. An internal audit reveals that while password policies are enforced, there is no formal log review of the DBA\u2019s actions, and the DBA has approved their own code changes in the production environment.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Q1: Which general control principle is violated here?<\/strong><\/p>\n

o\u00a0\u00a0\u00a0\u00a0Answer:<\/strong>\u00a0Segregation of Duties (SoD). The roles of system development\/change management and system administration (access control) must be separate.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Q2: What is the risk associated with this scenario?<\/strong><\/p>\n

o\u00a0\u00a0\u00a0\u00a0Answer:<\/strong>\u00a0Risk of unauthorized or malicious changes to the production system (sabotage or fraud) going undetected, as the developer is also the auditor of their own work.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Q3: Recommend a general control to mitigate this risk.<\/strong><\/p>\n

o\u00a0\u00a0\u00a0\u00a0Answer:<\/strong>\u00a0Implement a strict change management process where developers have read-only access to production and code changes are approved by a separate, authorized user or change manager.<\/p>\n

Case 2: The Erroneous Invoice (Application Control Focus)<\/strong><\/p>\n

Scenario:<\/strong>\u00a0A distribution company uses an ERP system to process customer orders. A new order taker mistakenly enters an order for 100,000 units instead of the usual 1,000 units. The system accepts the order, generates an invoice, and posts the revenue. The customer calls to complain.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Q1: What type of application control failed here?<\/strong><\/p>\n

o\u00a0\u00a0\u00a0\u00a0Answer:<\/strong>\u00a0Input Controls\u2014specifically, a reasonable check or validity check.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Q2: How could this have been prevented?<\/strong><\/p>\n

o\u00a0\u00a0\u00a0\u00a0Answer:<\/strong>\u00a0A “reasonableness test” (e.g., comparing the current order against historical order data) would have flagged the transaction as anomalous and paused it for manual review.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Q3: Is this a “Preventive” or “Detective” control issue?<\/strong><\/p>\n

o\u00a0\u00a0\u00a0\u00a0Answer:<\/strong>\u00a0It is a failure of a\u00a0preventive<\/em>\u00a0control (stopping bad data entry).<\/p>\n

Case 3: The Untraceable Data (General & Application Controls)<\/strong><\/p>\n

Scenario:<\/strong>\u00a0A financial services company finds that a batch processing run for payroll resulted in incorrect totals. Upon investigation, they cannot determine which transactions were processed or if the input file was altered.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Q1: What application control was missing?<\/strong><\/p>\n

o\u00a0\u00a0\u00a0\u00a0Answer:<\/strong>\u00a0Run-to-run totals (processing control) and check digits (input control). These ensure that data is not lost or changed during processing.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Q2: Why does the system lack accountability?<\/strong><\/p>\n

o\u00a0\u00a0\u00a0\u00a0Answer:<\/strong>\u00a0Lack of adequate audit trails (a General Control), which should log which user or process modified the data, and when.<\/p>\n

 <\/p>\n

Summary: Key Contrasts<\/strong><\/p>\n\n\n\n\n\n
Control Type\u00a0<\/strong><\/td>\nFocus Area<\/strong><\/td>\nExample<\/strong><\/td>\nScenario<\/strong><\/td>\n<\/tr>\n
General Control<\/strong><\/td>\nEnvironment-wide<\/td>\nPassword policies, Access Control, Change Management<\/td>\nA terminated employee still has access to the network.<\/td>\n<\/tr>\n
Application Control<\/strong><\/td>\nTransaction Specific<\/td>\nInput Validation, Processing Check, Output Reconciliation<\/td>\nA negative amount is entered in a salary field.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Important Case-Based Takeaways<\/strong><\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ITGC Failure Impact:<\/strong>\u00a0If General Controls (e.g., access security) are weak, application controls (e.g., password restrictions within an app) cannot be trusted.<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Real-life Failures:<\/strong>\u00a0Many frauds result from no segregation of duties (e.g., same person onboarded vendors and paid them).<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Configuration vs. Manual:<\/strong>\u00a0Automated controls (like system configurations) are often stronger than manual procedures because they are consistent.<\/p>\n

\ud83d\udd37\u00a01. SYSTEM CONTROLS \u2013 OVERVIEW<\/h1>\n

System controls ensure:<\/p>\n