Identify four risks associated with IT systems in accounting. For each of the four risks, identify whether they are mitigated by IT general controls or IT application controls. Identify a specific control that mitigates the risk (for each of the four IT risks identified) and explain how it mitigates the risk identified.

LEARNING OBJECTIVE 4

Explain and evaluate information technology (IT) controls.

Benefits and Risks of IT Systems

In order to understand internal control in an IT environment, it is important to understand the benefits and risks of IT systems.

The major benefits of IT systems over manual systems include the following:

• IT systems can provide greater consistency in processing than manual systems because they uniformly subject all transactions to the same controls.
• More timely software-generated accounting reports may provide management with more effective means of analyzing, supervising, and reviewing the operations of the company.
• IT systems enhance the ability to monitor the entity's performance and activities.

Important risks of IT systems over manual systems include the following:

• The IT system may produce a transaction trail that is available for audit for only a short period of time.
• There is often less documentary evidence of the performance of control procedures in IT systems.
• Files and records in IT systems are usually in machine-sensible form and cannot be read without a computer.
• The decrease of human involvement in IT processing can obscure errors that might be observed in manual systems.
• IT systems may be more vulnerable to physical disaster, unauthorized manipulation, and mechanical malfunction than information in manual systems.
• Various functions may be concentrated in IT systems, with a corresponding reduction in the traditional segregation of duties followed in manual systems.
• Changes in the system are often more difficult to implement and control in IT systems than in manual systems.
• IT systems are vulnerable to unauthorized changes in programs, systems, or data in master files.
• Reliance is placed on systems that process inaccurate data, process data inaccurately, or both.
• Unauthorized access to data may result in the destruction of data or improper changes to data, including the recording of unauthorized or nonexistent transactions, or inaccurate recording of transactions.
• There may be inappropriate or unauthorized manual intervention.