Skip to content

Audit and Assurance · The use and evaluation of systems of internal control by auditors

Internal Controls in Computerised Environments for ACCA Audit and Assurance

Updated 11 October 2026 · Fact-checked

Controls in a computerised environment fall into two groups. General IT controls cover the whole IT environment: access, change management, operations and backup. Application controls work inside one program to check input, processing and output. You identify the IT risks, match each to a control, then test them, often using CAATs.

Understand Internal Controls in Computerised Environments

Most entities now run their accounting on computers. This does not change what the auditor wants to know. You still need to understand the system, assess the risk of material misstatement and decide whether controls can be relied on. What changes is where the risks sit and how you test.

There are two types of IT control. General IT controls apply across the whole IT environment and support the continued, proper operation of applications. Typical areas are access security (passwords, user rights, segregation of duties), program change controls, system development and acquisition, computer operations (job scheduling, backups) and disaster recovery. Application controls are specific to one application, such as the sales ledger or payroll. They aim to make input, processing and output complete, accurate and authorised.

The two types depend on each other. If general controls are weak, you cannot rely on application controls, because someone could change the program or data and the control might stop working without anyone noticing. Strong general controls give comfort that application controls work consistently throughout the period.

IT also brings risks. Examples are unauthorised access to data and programs, unauthorised or untested program changes, data loss or corruption, system failure, over-reliance on the system, loss of segregation of duties because one person can do many tasks, and fewer visible paper trails. Computers do bring benefits: they apply the same rules every time, process large volumes quickly and reduce random human error. But a wrong program rule will be applied wrongly every time.

The auditor responds by understanding the IT environment, testing general controls and application controls where reliance is planned, and using computer-assisted audit techniques (CAATs). CAATs include audit software, which runs tests on the client's live data, and test data, which feeds dummy transactions through the client's program to see whether controls catch errors. Where controls are weak, the auditor does more substantive testing.

Key rules to remember

General IT controls (areas)
Access + Program changes + Development/acquisition + Operations + Backup/recovery
Apply to the whole IT environment. Use these as headings when a question asks for general controls.
Application controls (stages)
Input + Processing + Output + Master file/standing data
Specific to one application. Aim: complete, accurate, authorised.
Dependency rule
Weak general controls → application controls cannot be relied on
Always state this link when explaining why general controls matter.
CAAT types
Audit software (tests the client's data) and test data (tests the client's program)
Name the type and say what it tests.

How to solve Internal Controls in Computerised Environments questions

Use this method for any question on IT controls, IT risks or CAATs.

  1. 1Read the requirement. Decide if it asks for general controls, application controls, risks, CAATs or the audit approach.
  2. 2Pick a structure. For general controls use access, changes, operations, backup. For application controls use input, processing, output.
  3. 3Tie each point to the scenario. Use the system, the business and the facts given, not generic lists.
  4. 4For each control, state what it is and what it prevents. For a test, state what you would do and what you would look for.
  5. 5For CAATs, name the technique, say what it tests and give a specific use, such as recalculating depreciation or finding duplicate invoices.
  6. 6Link back to the audit: reliance on controls, effect on substantive work, and any deficiency to report.
  7. 7Check your answer has the number of points the marks suggest, usually one mark per well-made point.

Quickest way: Two-box method: General and Application

When to use it: Use it when time is short and the question names no specific structure.

  1. Draw two boxes on the scratch pad: General and Application.
  2. General box: write Access, Changes, Operations, Backup.
  3. Application box: write Input, Processing, Output.
  4. Put one scenario-specific point under each heading.
  5. Add one line on how a CAAT or test would check it.
  6. Write the answer using the headings as paragraph openers.

Common mistakes in Internal Controls in Computerised Environments

  • Mixing up general and application controls, for example calling passwords for the entire network an application control.

    Both are described as IT controls and the line between them is not clear.

    Fix: Ask: does it apply across all systems, or to one program's transactions? Across all systems is general. One program is application.

  • Listing controls with no explanation of what risk they address.

    Students memorise lists and write them out.

    Fix: Write control then purpose, for example: user IDs and passwords restrict access to authorised staff, preventing unauthorised changes to data.

  • Saying computers remove the risk of error.

    Students think automation means accuracy.

    Fix: State that a wrong program rule is applied consistently and at scale, so errors can be systematic and large.

  • Confusing test data with audit software.

    Both are CAATs and the names sound similar.

    Fix: Test data tests the client's program with dummy transactions. Audit software tests the client's real data files.

  • Ignoring the link between general and application controls.

    Each is learned separately.

    Fix: Say that weak general controls reduce reliance on application controls and increase substantive testing.

  • Suggesting the auditor should do all testing by computer.

    CAATs sound efficient.

    Fix: Mention limits: cost, need for IT skills, risk of corrupting live data, and the need to confirm the data is complete before testing.

Worked examples

Example 1

A retailer has just introduced a new automated sales and receivables system. Describe four application controls over the input of sales invoices that you would expect to find. (4 marks)

Show the solution
  1. Focus on input only, because the question asks for input controls.
  2. Control 1: a sequence check or automatic numbering of invoices, so that missing or duplicate invoices are detected.
  3. Control 2: validation checks on entry, such as a format check on customer codes and a range check on quantities, rejecting invalid data.
  4. Control 3: a reasonableness or limit check on invoice values, so unusually large amounts are queried before posting.
  5. Control 4: authorisation of credit limits or price changes, with the system blocking invoices that exceed the limit without approval.
  6. Each point states the control and its purpose.

Answer: Four input controls: (1) automatic sequential numbering with checks for gaps and duplicates; (2) format and range validation on customer codes and quantities; (3) limit or reasonableness checks on invoice values with exceptions reported for review; (4) system-enforced authorisation of credit limits and price changes.

Example 2

You are auditing a manufacturer whose receivables ledger holds 40,000 customer accounts. Explain how you could use audit software and what it would achieve. (4 marks)

Show the solution
  1. Name the CAAT: audit software runs on the client's real data files.
  2. Give a specific use 1: recalculate the aged analysis of receivables to check the ageing used for the allowance is accurate.
  3. Give a specific use 2: list accounts that exceed credit limits, or have credit balances, for follow-up.
  4. Give a specific use 3: select a sample of balances for the receivables circularisation, saving manual effort over 40,000 accounts.
  5. Add a caution: confirm the data file is complete and agrees to the ledger total before relying on the results.

Answer: Audit software can recalculate the receivables ageing, identify accounts over credit limit or with credit balances, and select a sample for confirmation from 40,000 accounts. It tests the whole population quickly and accurately. First reconcile the file to the ledger total to ensure it is complete.

Exam tips

  • In Section C written answers, use headings (general, application, input, processing, output) so the marker can find your points easily.
  • In OT cases, check whether the question asks for a general or an application control before choosing the answer. The options are often built to test this.
  • Link every IT point to the scenario. Generic lists score less than points about the client's actual system.
  • When asked about CAATs, state what is tested and give a specific use. Naming 'audit software' alone scores little.
  • Mention the effect on the audit approach: weak controls mean more substantive procedures.

Internal Controls in Computerised Environments in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Controls in Computerised Environments: frequently asked questions

What is the difference between general controls and application controls?

General controls cover the whole IT environment, such as access, program changes, operations and backup. Application controls work within one program to make input, processing and output complete, accurate and authorised. Reliance on application controls needs effective general controls.

What are CAATs in ACCA Audit and Assurance?

CAATs are computer-assisted audit techniques, where the auditor uses computers to carry out audit work. The main types are audit software, which analyses the client's data, and test data, which checks how the client's program handles dummy transactions.

What are the main risks of computerised accounting systems?

Key risks include unauthorised access, unauthorised program changes, data loss or corruption, system failure, loss of segregation of duties and over-reliance on the system. Errors in programs can also be repeated systematically across many transactions.

Do I need to know IT in detail for AA?

No. You need a clear grasp of the types of control, the risks and the audit response, applied to the scenario. Technical detail is not required.