Computer-Assisted Audit Tools and Techniques

Application Controls

Application controls are programmed procedures designed to deal with potential exposures that
threaten specific applications, such as payroll, purchases, and cash disbursements systems. It falls into
three broad categories: input controls, processing controls, and output controls.

Input Controls
The data collection component of the information system is responsible for bringing data into the
system for processing. Input controls at this stage are designed to ensure that these transactions are
valid, accurate, and complete. Data input procedures can be either source document-triggered (batch)
or direct input (real time).

Classes of Input Control

 Source document controls

 Data coding controls
 Batch controls
 Validation controls
 Input error correction
 Generalized data input systems

Source Document Controls

Use Pre-numbered Source Documents. Source document numbers permit accurate accounting of
document usage and provide an audit trail for tracing transactions through accounting records.

Use Source Documents in Sequence. This requires that adequate physical security be maintained over
the source document inventory at the user site. When not in use, documents should be locked away.

Periodically Audit Source Documents. The auditor should compare the numbers of documents used to
date with those remaining in inventory plus those voided due to errors.

Data Coding Controls

A customer’s account number, an inventory item number, and a chart of accounts number are all
examples of data codes. Three types of errors can corrupt data codes and cause processing errors:
transcription errors, single transposition errors, and multiple transposition errors.

Transcription errors fall into three classes:

Addition errors occur when an extra digit or character is added to the code. For example, inventory item
number 83276 is recorded as 832766.
Truncation errors occur when a digit or character is removed from the end of a code. In this type of
error, the inventory item above would be recorded as 8327.

Substitution errors are the replacement of one digit in a code with another. For example, code number
83276 is recorded as 83266

There are two types of Transposition errors. Single transposition errors occur when two adjacent digits
are reversed. For instance, 83276 is recorded as 38276. Multiple transposition errors occur when
nonadjacent digits are transposed. For example, 83276 is recorded as 87236.

Check Digits. A check digit is a control digit added to the code when it is originally assigned that allows
the integrity of the code to be established during subsequent processing.

The simplest form of check digit is to sum the digits in the code and use this sum as the check digit.
Example: for the customer account code 5372, the calculated check digit would be
5+3+7+2=17

By dropping the tens column, the check digit is 7 is added to the original code to produce new code
53727. This becomes the customer account number. Substitution errors will be easily detected but
transposition errors will not be revealed.

There are many check-digit techniques for dealing with transposition errors. A popular method is
modulus 11 that can be seen in our photocopies. Enjoy!

Batch Controls are an effective method of managing high volumes of transaction data through a system.
The objective of batch control is to reconcile output produced by the systems with the input originally
entered into the system. This provides assurance that:

 All records in the batch are processed.

 No records are processed more than once.
 An audit trail of transactions is created from input through processing to the output stage of the
system.

Hash Totals refers to a simple control technique that uses nonfinancial data to keep track of the records
in a batch.

Validation Controls are intended to detect errors in transaction data before the data are processed.
Validation procedures are most effective when they are performed as close to the source of the
transaction as possible.

There are three levels of input validation controls:

Field interrogation involves programmed procedures that examine the characteristics of the data in the
field. The following are some common types of field interrogation:

Missing data checks are used to examine the contents of a field for the presence of blank spaces.

Numeric-alphabetic data checks determine whether the correct form of data is in a field.

Zero-value checks are used to verify that certain field are filled with zeros.

Limit checks determine if the value in the field exceeds an authorized limit.

Range checks assign upper and lower limits to acceptable data values.

Validity checks compare actual values in a field against known acceptable values

Check digit controls identify keystroke errors in key fields by testing the internal validity of the code.