Control category Definition and Threats/ Risks Examples of Controls purpose Source data control Controls which control Invalid, Sequentially prenumbered forms data entry at the initial incomplete, Segregation of duties level or inaccurate Visual scanning source data Check-digit verification. input Input controls/ Input Responsible for Invalid or Edit programs check key data fields validation routines ensuring the accuracy inaccurate data using these edit checks. For instance, and completeness of sequence, field, sign, validity, limit, data and instructions range, reasonableness checks. input into an Prompting operators during data entry application system. Completeness test. Data Processing Data processing Inaccurate or Reconciliation of database totals with controls controls perform incomplete externally maintained totals (Batch validation checks to totals) identify errors during Exception reporting processing of data. Responsible for computing, sorting, classifying and summarizing data. Database controls Responsible to provide Weak database Chronological recording of transactions. functions to define, create, modify, delete and read data in an information system. Output controls To provide functions Inaccurate or Reconciliation of batch totals that determine the incomplete Proper distribution of output data content computer Confidential outputs being delivered available to users, output are protected from unauthorised access, data format, modification, and misrouting timeliness of data and how data is prepared and routed to users Data transmission To ensure controls Unauthorised Monitor network to detect weak points controls over data transmission access to data Multiple communication paths between being network components transmitted or to Preventive maintenance the system itself; Data encryption system failures; errors in data transmission Data integrity policies Virus-Signature Updating: Virus signatures must be updated immediately when they are made available from the vendor. Software Testing: All software must be tested in a suitable test environment before installation on production systems.
Control category Definition and purpose Threats/ Risks Examples of Controls Source data control Controls which control data entry at the initial level Invalid, incomplete, or inaccurate source data input Sequentially prenumbered forms Segregation of duties Visual scanning Check-digit verification. Input controls/ Input validation routines Responsible for ensuring the accuracy and completeness of data and instructions input into an application system. Invalid or inaccurate data Edit programs check key data fields using these edit checks. For instance, sequence, field, sign, validity, limit, range, reasonableness checks. Prompting operators during data entry Completeness test. Data Processing controls Data processing controls perform validation checks to identify errors during processing of data. Responsible for computing, sorting, classifying and summarizing data. Inaccurate or incomplete Reconciliation of database totals with externally maintained totals (Batch totals) Exception reporting Database controls Responsible to provide functions to define, create, modify, delete and read data in an information system. Weak database Chronological recording of transactions. Output controls To provide functions that determine the data content available to users, data format, timeliness of data and how data is prepared and routed to users Inaccurate or incomplete computer output Reconciliation of batch totals Proper distribution of output Confidential outputs being delivered are protected from unauthorised access, modification, and misrouting Data transmission controls To ensure controls over data transmission Unauthorised access to data being transmitted or to the system itself; system failures; errors in data transmission Monitor network to detect weak points Multiple communication paths between network components Preventive maintenance Data encryption Data integrity policies Virus-Signature Updating: Virus signatures must be updated immediately when they are made available from the vendor. Software Testing: All software must be tested in a suitable test environment before installation on production systems.
1311494623ISCA%20Notes.docx