programs from being made during or after testing. Further, programs in the testing library should only be able to be copied from approved developer libraries, with copying controlled by an employee independent of development and testing. This prevents insertion of untested programs. Programs that are used in daily business processes are run by IT operations staff. These staff should be limited to running programs that were copied into the production library after approval by independent testers. Logs of programs run should be kept and independently reviewed with changes agreed to original user requests. Computerized execution, recording and authorization of transactions Similar considerations apply when the computer program is directly responsible for the authorization of transactions (e.g., an input control comparing value of quantities ready for shipment to a credit limit), customer’s or when IT-generated reports such as online alerts, exception reports or summary reports are used by an employee to perform authorization. In both cases, the IT personnel who control the program must be treated as if they perform custody and authorization duties. In comparison to the previous setting, this introduces the risk that inappropriate custody transactions occur due to computer errors that are not detected due to a lack of independent authorization. For example, a programmer could alter the authorization program to ignore certain transactions from authorization rules or reporting. To address this, the scope of independent program testing should be expanded beyond custody and recording to include all programs supporting or performing the authorization duty. This SoD between programming, testing and operations within the IT function for programs involved in recording and authorization is necessary to provide a level of SoD consistent with the primary segregation of asset custody and authorization. Once this level of
programs from being made during or after testing. Further, programs in the testing library should only be able to be copied from approved developer libraries, with copying controlled by an employee independent of development and testing. This prevents insertion of untested programs. Programs that are used in daily business processes are run by IT operations staff. These staff should be limited to running programs that were copied into the production library after approval by independent testers. Logs of programs run should be kept and independently reviewed with changes agreed to original user requests. Computerized execution, recording and authorization of transactions Similar considerations apply when the computer program is directly responsible for the authorization of transactions (e.g., an input control comparing value of quantities ready for shipment to a customer’s credit limit), or when IT-generated reports such as online alerts, exception reports or summary reports are used by an employee to perform authorization. In both cases, the IT personnel who control the program must be treated as if they perform custody and authorization duties. In comparison to the previous setting, this introduces the risk that inappropriate custody transactions occur due to computer errors that are not detected due to a lack of independent authorization. For example, a programmer could alter the authorization program to ignore certain transactions from authorization rules or reporting. To address this, the scope of independent program testing should be expanded beyond custody and recording to include all programs supporting or performing the authorization duty. This SoD between programming, testing and operations within the IT function for programs involved in recording and authorization is necessary to provide a level of SoD consistent with the primary segregation of asset custody and authorization. Once this level of