aAPPLICATION CONTROLS
Application controls are programmed procedures designed to deal with potential exposures that threaten specific applications, such as payroll, purchases, and cash disbursements systems. Application controls fall into three broad categories: input controls, processing controls, and output controls.

Input Controls Input controls at this stage are designed to ensure that these transactions are valid, accurate, and complete. Data input procedures can be either source document-triggered (batch) or direct input (real time).

Source document input requires human involvement and is prone to clerical errors.
Some types of errors that are entered on the source documents cannot be detected and corrected during the data input stage. Dealing with these problems may require tracing the transaction back to its source (such as contacting the customer) to correct the mistake. Direct input, on the other hand, employs real-time editing techniques to identify and correct errors immediately, thus significantly reducing the number of errors that enter the system.

Classes of Input Control

a. Source Document Controls.
Careful control must be exercised over physical source documents in systems that use them to initiate transactions. Source document fraud can be used to remove assets from the organization.
In the absence of other compensating controls to detect this type of fraud, the system would create an account payable and subsequently write a check in payment.

Control Procedures over Source Documents:

a. Use Pre-numbered Source Documents. Source documents should come prenumbered from the printer with a unique sequential number on each document. Source document numbers permit accurate accounting of document usage and provide an audit trail for tracing transactions through accounting records. We discuss this further in the next section. b. Use Source Documents in Sequence. Source documents should be distributed to the users and used in sequence. This requires that adequate physical security be maintained over the source document inventory at the user site. When not in use, documents should be locked away. At all times, access to source documents should be limited to authorized persons.

c. Periodically Audit Source Documents. Reconciling document sequence numbers should identify missing source documents. Periodically, the auditor should compare the numbers of documents used to date with those remaining in inventory plus those voided due to errors. Documents not accounted for should be reported to management.

b. Data Coding Control
Coding controls are checks on the integrity of data codes used in processing. A customer’s account number, an inventory item number, and a chart of accounts number are all examples of data codes.

Three Types of Error: a. Transcription errors
Three Classes:
• Addition errors occur when an extra digit or character is added to the code. For example, inventory item number 83276 is recorded as 832766.
• Truncation errors occur when a digit or character is removed from the end of a code. In this type of error, the inventory item above would be recorded as 8327.
• Substitution errors are the replacement of one digit in a code with another. For example, code number 83276 is recorded as 83266. b. Transposition errors:
Two Types: * Single transposition errors- occur when two adjacent digits are reversed. For instance, 83276 are recorded as 38276. * Multiple transposition errors- occur when nonadjacent digits are transposed. For example, 83276 are recorded as 87236.

c. Check Digit One method for detecting data coding errors is a check digit. A check digit is a control digit (or digits) added to the code when it is originally assigned that allows the integrity of the code to be established during subsequent processing. The check digit can be located anywhere in the code: as a prefix, a suffix, or embedded someplace in the middle.
The use of check digits introduces storage and processing inefficiencies and therefore should be restricted to essential data, such as primary and secondary key fields. All check digit techniques require one or more additional spaces in the field to accommodate the check digit. In the case of modulus 11, if step three above produces a remainder of 1, the check digit of 10 will require two additional character spaces. If field length is a limitation, one way of handling this problem is to disallow codes that generate the check digit 10. This would restrict the range of available codes by about 9 percent.

d. Batch Controls Batch controls are an effective method of managing high volumes of transaction data through a system. The objective of batch control is to reconcile output produced by the system with the input originally entered into the system. This provides assurance that:
• All records in the batch are processed.
• No records are processed more than once.
• An audit trail of transactions is created from input through processing to the output stage of the system.
Batch control is not exclusively an input control technique. Controlling the batch continues through all phases of the system. We are treating this topic here because batch control is initiated at the input stage.
Achieving batch control objectives requires grouping similar types of input transactions (such as sales orders) together in batches and then controlling the batches throughout data processing. Two documents are used to accomplish this task: a batch transmittal sheet and a batch control log. Figure 7.1 shows an example of a batch transmittal sheet. The batch transmittal sheet captures relevant information such as the following about the batch.
• A unique batch number
• A batch date
• A transaction code (indicating the type of transactions, such as a sales order or cash receipt)
• The number of records in the batch (record count)
• The total dollar value of a financial field (batch control total)
• The total of a unique nonfinancial field (hash total)
Usually, the batch transmittal sheet is prepared by the user department and is submitted to data control along with the batch of source documents. Sometimes, the data control clerk, acting as a liaison between the users and the data processing department, prepares the transmittal sheet. Figure 7.2 illustrates the batch control process.
The data control clerk receives transactions from users assembled in batches of 40 to 50 records. The clerk assigns each batch a unique number, date-stamps the documents, and calculates (or recalculates) the batch control numbers, such as the total dollar amount of the batch and a hash total (discussed later). The clerk enters the batch control information in the batch control log and submits the batch of documents, along with the transmittal sheet, to the data entry department.

e. Hash Totals.
The term hash total, which was used in the preceding discussion, refers to a simple control technique that uses nonfinancial data to keep track of the records in a batch. Any key field, such as a customer’s account number, a purchase order number, or an inventory item number, may be used to calculate a hash total.

f. Validation Controls Input validation controls are intended to detect errors in transaction data before the data are processed. Validation procedures are most effective when they are performed as close to the source of the transaction as possible. However, depending on the type of technology in use, input validation may occur at various points in the system.

Three levels of input validation controls:
Field interrogation involves programmed procedures that examine the characteristics of the data in the field. The following are some common types of field interrogation * Field interrogation involves programmed procedures that examine the characteristics of the data in the field. * Numeric-alphabetic data checks determine whether the correct form of data is in a field. * Zero-value checks are used to verify that certain fields are filled with zeros. Some program languages require that fields used in mathematical operations be initiated with zeros prior to processing. This control may trigger an automatic corrective control to replace the contents of the field with zero if it detects a nonzero value. * Limit checks determine if the value in the field exceeds an authorized limit. For example, assume the firm’s policy is that no employee works more than 44 hours per week. The payroll system validation program can interrogate the hours-worked field in the weekly payroll records for values greater than 44. * Range checks assign upper and lower limits to acceptable data values. For example, if the range of pay rates for hourly employees in a firm is between 8 and 20 dollars, all payroll records can be checked to see that this range is not exceeded. The purpose of this control is to detect keystroke errors that shift the decimal point one or more places. It would not detect an error where a correct pay rate of, say, 9 dollars is incorrectly entered as 15 dollars. * Validity checks compare actual values in a field against known acceptable values. This control is used to verify such things as transaction codes, state abbreviations, or employee job skill codes. If the value in the field does not match one of the acceptable values, the record is determined to be in error. * Check digit controls identify keystroke errors in key fields by testing the internal validity of the code. We discussed this control technique earlier in the section. * Record Interrogation. Record interrogation procedures validate the entire record by examining the interrelationship of its field values. Some typical tests are discussed below. * Reasonableness checks determine if a value in one field, which has already passed a limit check and a range check, is reasonable when considered along with other data fields in the record. * Sign checks are tests to see if the sign of a field is correct for the type of record being processed. * Sequence checks are used to determine if a record is out of order. In batch systems that use sequential master files, the transaction files being processed must be sorted in the same order as the primary keys of the corresponding master file. * File Interrogation. The purpose of file interrogation is to ensure that the correct file is being processed by the system. These controls are particularly important for master files, which contain permanent records of the firm and which, if destroyed or corrupted, are difficult to replace.

* Internal label checks verify that the file processed is the one the program is actually calling for. Files stored on magnetic tape are usually kept off-line in a tape library.

* Version checks are used to verify that the version of the file being processed is correct. In a grandparent–parent–child approach, many versions of master files and transactions may exist. The version check compares the version number of the files being processed with the program’s requirements.

* Expiration date check prevents a file from being deleted before it expires. In a GPC system, for example, once an adequate number of backup files is created, the oldest backup file is scratched (erased from the disk or tape) to provide space for new files.

Input Error Correction.

When errors are detected in a batch, they must be corrected and the records resubmitted for reprocessing. This must be a controlled process to ensure that errors are dealt with completely and correctly.

Three common error handling techniques

a. Correct immediately
If the system is using the direct data validation approach (refer to 7-4(a) and (b), error detection and correction can also take place during data entry. Upon detecting a keystroke error or an illogical relationship, the system should halt the data entry procedure until the user corrects the error.

b. Create an error file
When delayed validation is being used, such as in batch systems with sequential files, individual errors should be flagged to prevent them from being processed. At the end of the validation procedure, the records flagged as errors are removed from the batch and placed in a temporary error holding file until the errors can be investigated. Some errors can be detected during data input procedures. However, as was mentioned earlier, the update module performs some validation tests.

c. Reject the entire batch
Reject the Batch. Some forms of errors are associated with the entire batch and are not clearly attributable to individual records. An example of this type of error is an imbalance in a batch control total.