Application Controls: Input, Processing, and Output
Master the three categories of application controls that CISA candidates must understand: input, processing, and output controls.
Application controls are specific controls built into software applications to ensure the completeness, accuracy, validity, and authorization of data. For CISA candidates, understanding input, processing, and output controls is fundamental because these controls directly protect data integrity.
Input Controls
Input controls ensure that data entering the system is accurate, complete, and authorized. They are the first line of defense against data quality issues.
Common Input Controls
- Data Validation: Checks that data conforms to expected formats, ranges, and types (e.g., date fields accept only valid dates).
- Sequence Checks: Verifies that transactions are processed in the correct order and that no transactions are missing.
- Limit and Range Checks: Ensures values fall within acceptable boundaries (e.g., working hours per week cannot exceed a defined maximum).
- Reasonableness Checks: Flags unusual values that may indicate errors (e.g., a salary that is ten times the department average).
- Check Digits: Mathematical calculations appended to identification numbers to detect transcription errors.
- Authorization Controls: Ensures that only authorized users can enter or approve transactions.
Processing Controls
Processing controls ensure that data is processed accurately and completely once it has been accepted into the system.
Common Processing Controls
- Run-to-Run Totals: Control totals carried forward between processing steps to verify that all records are processed.
- Balancing Controls: Comparisons between input totals, processing totals, and output totals to detect discrepancies.
- Exception Reports: Automated identification of transactions that fall outside normal parameters for review.
- Audit Trails: Logs that record who processed what data and when, enabling reconstruction of transaction history.
- Error Handling: Procedures for capturing, reporting, and correcting processing errors.
Output Controls
Output controls ensure that processing results are accurate, complete, and distributed only to authorized recipients.
Common Output Controls
- Output Reconciliation: Comparing output totals to input and processing totals to confirm completeness.
- Distribution Controls: Ensuring reports and data are delivered only to authorized recipients.
- Report Review: Designated personnel reviewing output for reasonableness before distribution.
- Retention Controls: Proper storage and archival of output according to retention policies.
Audit Approach
IS auditors testing application controls should:
- Review system documentation to identify designed controls
- Test controls using both valid and invalid data to verify proper functioning
- Evaluate error handling procedures and exception reporting
- Verify that control totals and reconciliation procedures are performed regularly
- Assess whether application controls are appropriate for the risk level of the data being processed
CISA Exam Relevance
The exam frequently presents scenarios where an auditor must identify the appropriate type of control for a given situation. Remember that input controls are preventive (stopping bad data from entering), processing controls are detective (finding errors during processing), and output controls verify the final results. Understanding this classification helps candidates select the correct answer quickly.