Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Orchid Retail's payroll application rejects any record where the hours worked exceed 80 per week and flags employee numbers that do not exist on the master file. A board member asks how these controls should be classified. Which classification is correct?

They are application input controls: the hours limit is a limit check and the employee number test is a validity check. They operate within the payroll application on transactions entered, unlike general controls that govern the wider IT environment.

  1. AIT general controls over access to programs and data
  2. BApplication input controls, specifically a limit check and a validity checkCorrect
  3. CApplication output controls, specifically distribution controls
  4. DMonitoring controls over third-party service providers

Explanation

Controls built into the payroll application that test data as it is entered are application input controls. Rejecting hours above a threshold is a limit (reasonableness) check, and checking employee numbers against the master file is a validity check. General controls apply across the IT environment rather than to a single transaction type.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions