Control activities and IT controls

A supermarket's till system adds up each cashier's takings and sends the total to head office. A clerk keys a supplier's code with one digit wrong and the system refuses to post it. A weekly report lists every sale dispatched but not invoiced, and an accounts clerk clears each line. The store has a safe with limited access and different people order, receive and pay for stock.

These are control activities: the everyday procedures that stop errors and fraud or catch them quickly. Because most businesses now run on computers, many of the controls are written into software.

This topic covers the categories of control activity in International Standard on Auditing (ISA) 315, the Dolally example, general and application information technology (IT) controls with detailed examples, segregation of duties, the checklist for control weaknesses in an exam scenario, and the specific IT controls: control totals, check digits, range and existence checks, batch totals and on-screen prompts. The previous topic covered the other four components.

Key terms in plain English

Syllabus check

This topic is in syllabus area B, the nature and use of internal control (20% of marks). It covers:

• the types of internal control and control activities
• internal controls in a computerised accounting environment
• how to evaluate internal controls in a given scenario

CAMA 2020 and control activities

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

Control activities

Control activities are the policies and procedures, other than the control environment, used to make sure the entity's objectives are achieved. They apply the internal controls. They are the specific procedures designed to prevent errors arising in processing, or to detect and correct them. ISA 315 groups them into four categories. In the examination this list is a useful checklist when asked to suggest controls for a given system.

The Dolally example

In Dolally's sales system, a clerk keys a telephone order; the system checks stock and e-mails a dispatch note; the distribution centre packs and sends the goods with two copies of the note; the customer signs and one copy returns to accounts; accounts flags the note on the system as delivered and the system automatically produces and e-mails an invoice; and a weekly exception report lists un-invoiced dispatch notes. Controls under each category are:

• Performance review: management compares budgeted sales with actual sales each month; if the budget is reliable, this detects sales not recorded.
• Information processing, application: manual follow-up of the exception report of un-invoiced dispatch notes.
• Information processing, general IT: controls over the development and testing of the sales system and the documentation and testing of changes to programs.
• Physical: access to the sales price master file only through a high-level password known to senior staff, since invoices are produced automatically and the file's integrity is vital.
• Segregation of duties: different people take and input orders, dispatch goods and flag the dispatch note.

Internal controls in IT systems: general and application controls

General IT controls are policies and procedures that relate to many applications, such as revenue, purchases and payroll. They support the proper working of application controls by making sure the IT systems keep operating properly. If general controls are weak, it is unlikely that processing is complete and accurate.

The auditor therefore reviews and tests the general controls first to conclude on control risk for the IT systems as a whole. If control risk is low, the auditor then tests application controls to decide whether to rely on specific systems and reduce substantive testing. General controls apply to large bespoke systems, and also to smaller entities using off-the-shelf accounting software.

Application controls apply to the processing of individual applications. They help ensure that transactions occurred, are authorised and are completely and accurately recorded and processed. They can be manual or computerised. Examples are:

• authorisation of all significant transactions at an appropriate level;
• arithmetic checks on the accuracy of records, such as checking supplier invoices;
• accounting controls such as control account reconciliations of receivables and payables;
• edit checks of input data;
• numerical sequence checks; and
• manual follow-up of exception reports.

In an IT system the common features of application controls fall into four groups.

The May 2026 examination described Mount Pisgah Supermarkets Limited, a fast-growing retail chain that had computerised its accounting with a point-of-sale system and an enterprise resource planning system.

For such a business the auditor first tests the general controls over the system, namely access, program changes, back-up and continuity, then the application controls in the till system: each sale is recorded once, sales are posted to the ledger completely, price changes are authorised, cash takings agree to system totals, and exception reports are followed up.

If the general controls are weak, the auditor cannot rely on the application controls and must do more substantive testing, supported by data analysis of the sales files.

Segregation of duties

Segregation of duties means dividing work between two or more people so that one person's work checks another's. It makes errors easier to spot, because people see others' mistakes more easily than their own. Makes fraud harder, because a colleague may notice suspicious transactions. The purchasing cycle shows how.

Risks without segregation are that stock is ordered that is not needed, that the supplier does not deliver or delivers the wrong quantity, and that the supplier is overpaid or paid for goods not delivered. Authorisation controls are added: orders and payments are approved at an appropriate level of management.

Control weaknesses and the exam

A case study may ask the candidate to identify weaknesses, explain why each is a weakness and the risk it creates, and suggest improvements. The ISA 315 categories above are one framework. Another looks for weaknesses in nine areas.

1. Control environment: weak leadership and no risk awareness culture; if senior management show little concern, the whole system is probably weak.
2. Lack of checks and controls: suitable controls simply do not exist.
3. Segregation of duties: could error or fraud be reduced by separating tasks?
4. Physical controls: assets and records not protected against theft, loss or unauthorised access.
5. Personnel: inexperienced or unqualified staff doing work that needs skill.
6. Management and organisation structure: lack of supervision; unclear lines of responsibility; poor performance and control reporting.
7. IT controls: weaknesses in general and application controls.
8. Computational work: weak procedures for calculating and checking, for example time-based fees.
9. Lack of internal audit.

For each weakness, state the weakness, the risk, and the recommended control.

The May 2026 examination described Ninalowo Microfinance Bank Limited, where a supervisory visit by the Central Bank of Nigeria found many internal control deficiencies, including failure to meet capital adequacy and regulatory ratios.

A good answer groups the deficiencies under these headings, explains the risk of each, for example regulatory sanction and loss of licence, and recommends controls such as a compliance function that monitors the ratios, board oversight through a risk committee, authorisation limits for loans, periodic reporting to the regulator and follow-up by internal audit.

Specific IT controls explained

Control totals. When several transactions are input together, a total of their values is calculated manually and recorded. After processing, the program's own total is compared with it. If an accounts clerk processes 20 purchase invoices, the manual total of the 20 is compared with the computer's total, and any difference is investigated.

Check digits. A check digit is an extra digit added to a code, calculated from the other digits, that lets the program detect errors in keying. With a Modulus 11 system the code digits are weighted and the check digit, with weight 1, is chosen so that the total is a multiple of 11. For the five-digit code 23467:

The next multiple of 11 is 77, so the check digit is 77 − 75 = 2, and the full code is 234672. The program tests every code input. If the weighted total is not a multiple of 11, the code is wrong, the transaction is not processed and an error report is produced.

Range checks and existence checks. A range check tests that a value falls in a valid range, for example inventory codes between 2000 and 3999. An existence check tests that a code exists, for example that a department code is B, C or P. If the value is invalid, the program prints an error report and does not process the transaction.

Batch totals. A form of control total. Transactions are input in batches, a total, often a count, is calculated manually and input, and the program compares it with its own. A discrepancy is reported. This ensures that every transaction in the batch was input and processed.

On-screen prompts. The screen tells the user what to input or do next, which helps make sure that transactions are fully processed and that operators do not leave a transaction half done.

Control activities by transaction cycle

An exam answer often asks for controls in a named cycle. Use the four ISA 315 categories and think of the stages of the cycle.

Controls in point-of-sale and enterprise resource planning systems

A point-of-sale system records each sale at the till and may link to inventory, cash and the general ledger. An enterprise resource planning system joins sales, purchases, inventory, payroll and finance in one database, so one weak control can affect many processes. The particular controls to look for are:

• User access: each user has a unique login and a profile that matches the job, so that nobody both enters a sale and approves a refund or changes the price file. Access rights are reviewed and removed when staff leave or change roles.
• Authorisation of overrides: refunds, voids, discounts and price changes need a supervisor's code and appear on an exception report that a manager reviews.
• Interfaces: totals passed from the till system to the ledger are reconciled automatically, and failed transfers are reported and cleared.
• Cash-up: each cashier's system total is compared with the cash counted, and differences are investigated.
• Audit trail: the system keeps a log of who did what and when, with the log protected from alteration.
• Change control: upgrades and changes to the system are authorised, tested and documented, with a separate test and live environment.
• Back-up and recovery: data is backed up and the recovery process is tested, because a failure at a busy chain stops sales.

Information security controls

Information security aims to protect the confidentiality, integrity and availability of data. Controls include unique user identification and strong passwords, multi-factor authentication for sensitive access, encryption of data in storage and transit, firewalls and monitoring of network traffic, anti-virus and anti-malware software, regular software updates, restricted physical access to servers, staff training on phishing, an incident response plan and secure disposal of equipment.

The auditor considers them because a breach can lead to theft of funds, loss of data, regulatory fines and a doubt about the reliability of the accounting records.

How the auditor tests controls

The auditor tests controls to confirm that they operate as designed. Common tests are inquiry of the staff who operate the control, observation of the control being performed, inspection of the evidence that it was performed, such as a signature or system log, and reperformance of the control.

For automated controls, the auditor may test one instance of the control, such as an invoice with a missing authorisation code that the system rejects, if the general IT controls are effective and the program has not changed. For manual controls the auditor uses a sample of occurrences across the period. A later topic describes the tests of controls cycle by cycle.

A control that is tested and found to be effective allows less substantive work. A control that is found not to operate is reported to management as a deficiency.

Information technology and the revised ISA 315

The revised ISA 315 asks the auditor to understand the entity's use of IT, the IT environment, the risks that arise from it and the general IT controls that deal with those risks. The auditor identifies the controls that address risks of material misstatement and, for those that depend on IT, the related general IT controls over access, program changes and IT operations.

This ties the work on application controls to the work on general controls: the auditor cannot rely on an automated control unless the controls over the system that runs it are effective.

Worked examples

1. (a) Performance review.
2. (b) Physical control.
3. (c) Segregation of duties.

1. (a) General IT control: continuity of operations.
2. (b) Application control: an input accuracy check.

1. Weakness: no segregation of duties over cash.
2. Risk: she can take cash and hide it, or hide an error.
3. Improvement: someone else banks the cash; a manager prepares or reviews the reconciliation.

1. The digits with weights 6, 5, 4, 3, 2 and 1 give 12 + 15 + 16 + 18 + 4 + 7 = 72.
2. 72 is not a multiple of 11, so the program rejects the code and prints an error report.

1. The manual count of 50 does not agree with the computer's count of 48.
2. An error report is produced and two missing invoices are traced and processed.

How to score full marks

• Use the four ISA 315 categories to structure a control answer.
• Separate general IT controls from application controls with an example of each.
• For a weakness question give weakness, risk and recommendation.
• Show the working of a check digit calculation.

Common mistakes in the exam

• Giving manual controls for a computerised system.
• Listing a control without saying what error it prevents.
• Confusing general controls with application controls.
• Forgetting that segregation covers authorise, record and custody.

Quick revision

• Four categories: performance reviews, information processing, physical, segregation.
• General IT: development, changes, unauthorised changes, correct programs, data files, continuity.
• Application: input, processing, master files, output.
• Weakness checklist of nine areas.
• Check digit, range, existence, batch total, control total, prompt.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.