You have just been appointed auditor of Q Limited (Q). As part of the audit planning process, your IT audit specialist has visited the premises and noted the following issues during her preliminary assessment:

Q's IT function is under the overall control of the Finance Director. However, the day-to-day operations are the responsibility of the IT Manager who has had signifi cant IT experience in a large multi-user environment.

The key modules of Q's Financial Management System (FMS) are currently undergoing signifi cant modifi cation. The systems analyst who initially implemented the FMS was recently dismissed as a result of a disagreement with the IT Manager.

A few days after the dismissal, the systems analyst returned to Q's IT department and made some unauthorised changes to the FMS.

Subsequent to the dismissal of the systems analyst, the FMS development work lost direction. The programmers, who received their detailed instructions from the systems analyst, had no written instructions or documented system specifi cations for the FMS modifi cations. All such instructions and specifi cations had been given by the systems analyst verbally.

Only IT department staff are allowed access to the IT department. When your IT audit specialist visited, however, she was able to enter the department, review existing FMS documentation, and make changes to a FMS program under development via a terminal which was logged on but not attended by a programmer. During this period, she was not asked for identifi cation and was left alone for long periods of time.

REQUIRED 1. From the information above, identify fi ve (5) signifi cant general control weaknesses.

2. For each weakness in 1 above, specify your recommendation to overcome the identifi ed risk.