Slide 1
Organization Controls, Personal Practices, and Standard
Operating ProceduresKrisca E. Depalubos
Organization Controls
Personnel Practices
Systems development & documentation controls
Standard Operating Procedures
Organization ControlsRelate to the segregation of duties within
EDP systems and with the EDP itselfCover the assignment and
division of responsibility for control over EDP systemsPurpose is
to reduce the risk of error or fraud
Personnel PracticesProvide control over the quality of work by
ensuring that the EDP staff are competent and honest, and they
provide policies that encourage the EDP staff to comply with
managements policies
Standard Operating ProcedureIdentify procedures for the
operation of the computer that ensure high quality processing and
limit the opportunity for errors and unauthorized use of files,
programs, and reports
Systems Development and documentation controlStandard practices
relating to the design, development, programming, maintenance, and
documentation of application systems
Encourage the proper design of systems and increase the chances
that systems will operate reliably when completed
Segregation of EDP and User FunctionSeparation of the
incompatible functions of authorizing transactions, executing
transactions, recording transactions, and maintaining
accountability over assets involved in the transactions
EDP ResponsibilityControlling the processing of data within the
departmentDetection of errors during processing, correction of
errors originating within the EDP department, and control over the
resubmission of transactions after correction
User Department ResponsibilityResponsible for errors that
originate outside the EDP departmentResponsible for correcting
these errors and resubmitting the corrected transactions to EDP for
processing
4 Primary Functions1. Authorization Function general rule, EDP
should not be permitted to authorize transactions2. Executing
Function execution of steps in the transaction processing cycle,
and changes to master files, should normally be performed outside
EDP3. Recording Transactions only performed by EDP4. Maintaining
Accountability - EDP should not have custody of, or control over,
non-EDP assets. Separation of the recording function, and physical
custody or control of assetsSegregation of Incompatible
Functions
Understanding and Tests of ControlsReview Organization
ChartsReview Job descriptionsObserve Actual OperationsInterview EDP
managementReview available management reports, studies, or
evaluation of the error handling processPrepare a system flowchart
for each transaction processing cycle and review segregation of
functionsReview the reconciliation of control totals maintained
outside the EDP departmentTest-check reconciliationsExamine
evidences like memo, working papers, error listingsReview controls:
processing, postprocessing, and programmed controlsTest
controls
