Information Technology and Controls
Core concepts
IT controls are divided into general IT controls (access management, change management, backup and recovery, operations, program development) and application controls (input, processing, output). General controls support the reliable functioning of applications; if general controls fail, application controls cannot be trusted. Candidates must understand the control environment as the foundation for all other components of internal control, and the distinction between preventive, detective and corrective controls.
Know the input-processing-output model. Input controls include authorization, validation checks (field, range, format, check digit), and batch totals. Processing controls include run-to-run totals, reasonableness checks, and reconciliation. Output controls include distribution logs and review of exception reports. Segregation of duties in IT separates development, testing, production deployment, and access administration.
Understand risks: unauthorized access, data leakage, ransomware, phishing, and inadequate backup. Know the role of the IT general controls audit and the concept of complementary user controls-manual checks that compensate for system limitations. Business continuity and disaster recovery plans differ in scope: continuity keeps critical operations running, recovery restores systems after an outage.
Traps
- Relying on application controls when general IT controls are weak.
- Calling a log review a preventive control; log review is detective.
- Assuming automated controls need no testing; they can change without notice.
- Confusing backup with disaster recovery testing.
- Ignoring that a developer with production access defeats segregation of duties.
Worked example / rule of thumb
Rule of thumb: prevent, detect, correct - name the category before judging the control. Example: a system rejects a purchase order above an approved limit. That is a preventive input control (validation and authorization). A monthly review of all orders above the limit is detective. If the review finds an exception, the corrective action is reversal and re-approval. A question that offers "review of exception reports" as a preventive control is testing exactly this classification.