1.4 Application Controls: Input, Processing, Output & IT Segregation of Duties
Examine automated transaction-level business process controls, distinguishing input validation checks, processing run-to-run batch totals, and output security, while enforcing strict segregation of incompatible IT duties.
🎯 Essential Technical Takeaways
- Input validation controls include limit checks, range checks, validity checks against master tables, and field sign checks.
- Batch processing controls utilize financial totals (monetary values), hash totals (non-financial sums like SSNs), and record counts.
- Application developers must NEVER possess Database Administrator (DBA) privileges or direct write access to production.
- Direct SQL access bypasses application business rules; mitigating controls require Database Activity Monitoring (DAM) and independent logging.
While ITGCs secure the overall environment, Business Process Application Controls operate directly at the transaction level within specific business software (e.g., SAP, Oracle, Workday). They ensure that transactions are complete, accurate, valid, and authorized. Application controls are divided into three chronological stages: Input, Processing, and Output.
Input controls prevent bad data from entering the system. Limit checks verify that numerical values do not exceed ceiling thresholds; range checks ensure values fall between upper and lower bounds; validity checks compare inputted codes against approved master tables (e.g., verifying vendor IDs); and check digits detect transcription errors in identification numbers. Processing controls ensure data is processed completely and accurately: run-to-run control totals compare extraction metrics against target load metrics, and batch totals (financial sums, hash totals, record counts) verify that no items were added or dropped.
Segregation of Duties (SoD) in IT is critical to prevent fraud and unmonitored error. Individuals who write application source code must be strictly segregated from database administration and production deployment. A developer with DBA privileges could write malicious code and directly alter database balances or delete audit trails via native SQL, bypassing all application-level controls without detection.
⚠️ CPA Evolution Exam Traps & Control Pitfalls
- Confusing hash totals (sums of non-financial fields for integrity) with financial totals (sums of monetary amounts).
- Assuming input validation performed by client-side JavaScript is sufficient without server-side validation.
- Allowing developers to perform database administration tasks on the premise of operational efficiency.
Interactive Knowledge Checkpoint
An accounts payable accounting application automatically rejects any invoice where the invoice date is greater than 30 days in the future, where the vendor number does not exist in the approved vendor master table, or where the line-item quantity is negative. Which combination of automated application input controls does this represent?