Application and transaction controls

While application and transaction controls focus on specific transaction flows and individual systems, general controls (discussed in the previous chapter) are broader and support the overall functioning and security of IT environments.

Example: A payroll batch

A company processes a weekly payroll batch of 50 employees.

• Input: As timecards are entered, the system records a record count (50) and a hash total (the sum of the 50 employee ID numbers) so later stages can confirm no records were added or lost. A range check also rejects any timecard showing more than 24 hours in a day.
• Processing: After payroll is calculated, a run-to-run total confirms that 50 records are still present and that the batch’s hash total hasn’t changed - if a record were dropped or altered during processing, the totals wouldn’t match.
• Output: The payroll register’s total is reconciled back to the batch total carried from input, and the report is distributed only to authorized payroll and HR staff.

Answer: Each stage’s control catches a different kind of error: input controls catch bad data at entry, processing controls confirm nothing was lost or changed during calculation, and output controls confirm the final report is both accurate and reaches only authorized people.

Input controls

Input controls catch data entry errors, omissions, or fraudulent inputs before they can compromise the integrity of the system’s output.

Input controls can be both manual and automated, and are tailored to the nature of the input process. They are essential because once incorrect data is entered and accepted by the system, it can be difficult to detect and may affect downstream processing and reporting.

Examples of input controls

1. Field validation checks: These ensure that only data of the correct type, length, or format can be entered into each field. For example, a date field may only accept entries in the format “MM/DD/YYYY,” and a numeric field will reject alphabetic characters.
2. Pre-numbered forms: These are used to prevent duplicate or missing entries by assigning sequential numbers to documents like invoices or purchase orders. When a sequence is broken, the system or user is alerted to a potential error or omission.
3. Drop-down menus and selection lists: Limit input to predefined choices, reducing variability and preventing data entry errors (e.g., selecting from a list of approved departments).
4. Edit checks (including range/limit checks): Edit checks are the umbrella term for programmed tests applied to data as it’s entered - format checks, validity checks, completeness checks, range/limit checks, check-digit checks, and closed-loop (key) verification. For example, a range check rejects salary entries outside $30,000–$300,000 or negative invoice amounts. Field validation (item 1) and mandatory fields (item 5) are themselves types of edit checks.
5. Mandatory fields: Require certain fields to be filled out before the form can be submitted, ensuring completeness of data (e.g., account number or transaction date).
6. Batch totals and hash totals: Confirm that a batch of data wasn’t altered during entry. A financial total sums a meaningful field, such as the total dollar amount of a payroll batch; a record count counts the number of documents, such as the number of timecards; a hash total sums a field that has no meaningful total, such as employee ID numbers, purely to detect missing or altered records.
7. System access controls for input screens: Restrict who can enter or modify specific types of input data, based on user roles or approval levels.

Why input controls are necessary

Input controls stop erroneous or fraudulent data from ever entering the system, which keeps downstream processing and financial reporting reliable.

Processing controls

Processing controls detect and prevent errors during the transformation of input into output, and are essential for maintaining the integrity of system-generated data.

Processing controls operate within both batch and real-time environments and may be automated within software or performed manually. They monitor the flow of data through the system and ensure that the processes function as intended.

Examples of processing controls

1. Run-to-run totals: These verify that data totals (e.g., number of transactions or financial amounts) remain consistent from one processing stage to the next.
2. Control totals: Re-verify the batch and hash totals established at input, confirming that no records were lost or altered during processing.
3. Sequence checks: Ensure that records are processed in the correct order and that no transactions are missing or duplicated.
4. Error detection and exception reports: Automatically flag anomalies, incorrect data, or processing exceptions for review and correction, typically through system-generated exception reports.
5. Recalculation checks: Recompute formulas or logic during processing to verify that calculations are performed correctly.
6. Reasonableness checks: Evaluate processed results against expected norms (e.g., gross margins or transaction volumes) to flag anomalies.
7. Audit trails: Record every step of data processing, enabling traceability and accountability.
8. Redundant processing (dual systems): Critical systems may be run in parallel for reconciliation to ensure reliability and accuracy.

Why processing controls are necessary

Processing controls catch errors or malfunctions during calculation before they reach the output stage, and confirm that business rules and compliance requirements are applied consistently.

Output controls

Output controls apply after processing is complete, checking that system-generated reports, documents, and communications are reliable and secure.

Examples of output controls

1. Reconciliation of output to input totals: Verifies that the number of records and totals in output reports match those from earlier processing stages.
2. Distribution and access controls: Role-based authentication restricts who can generate, retrieve, or receive reports, so sensitive information reaches only authorized individuals.
3. Error reporting and exception logs: Flag missing, incomplete, or anomalous output records for investigation.
4. Print controls: Limit or restrict who can print reports, often requiring secure login or printer location.
5. Electronic output encryption: Ensures that digital files sent via email or other networks are encrypted to protect confidentiality.
6. Audit trails for report access: Track who accessed, viewed, or downloaded system outputs.
7. Archiving procedures: Ensure that important outputs (e.g., financial statements, regulatory reports) are retained securely and can be retrieved when needed.
8. Version control of reports: Prevents outdated or incorrect versions of outputs from being used.

Why output controls are necessary

Output controls protect the integrity and confidentiality of reports, preventing flawed or incomplete data from reaching decision-makers and keeping sensitive information out of unauthorized hands.