Auditing & Assurance Services 6th Edition by Timothy Louwers

Exercise 112

General Controls. For each of the following examples of general controls, classify the control based on appropriate category (program development controls, program change controls, computer operations controls, and access to programs and data controls). In addition, for each, provide the objective of the control and one example of how audit teams might test the operating effectiveness of the control.
a. The entity requires the use of passwords and requires these passwords to be modified every three months.
b. Proper documentation exists for "emergency" change requests for programs.
c. Important files, programs, and documentation are backed up and stored in a safe, off-site location.
d. The entity involves users in the design of programs and selection of prepackaged software.
e. The entity resolves failures for transactions processed in a real-time environment on a timely basis.
f. All program development activities are consistent with the entity's needs and objectives.
g. All modifications to existing programs are properly documented.
h. The functions of systems analyst, computer programmer, and computer operator are performed by different individuals.
i. The entity monitors which individuals access various programs and cross-checks this use against an authorized user listing.