3.2 Preventative vs. Detective Controls & General / Application IT Controls

3.2 Preventative vs. Detective Controls & General / Application IT Controls

In modern business environments, internal controls operate across physical, manual, and information technology domains. Audit professionals must classify controls according to their timing, objective, and underlying technology to evaluate control risk accurately under ISA 315 (Revised).

Classification of Controls: Preventative vs. Detective

Internal control activities are primarily divided into two functional categories based on when they intervene in transaction processing: preventative controls and detective controls.

Preventative Controls in Practice

Preventative controls are proactive. They act as barriers to stop unauthorized or inaccurate data from entering financial systems. Examples include:

• Dual Signatures: Requiring two authorized signatories for bank transfers exceeding BDT 500,000.
• System Access Controls: Restricting payroll system access so that only authorized HR officers can create new employee profiles.
• Pre-formatted Input Screens: System screens that require mandatory fields (e.g., Tax Identification Number / TIN) before a vendor profile can be saved.

Detective Controls in Practice

Detective controls are reactive. They monitor outcomes to identify exceptions, errors, or fraudulent activities that bypassed preventative controls. Examples include:

• Bank Reconciliations: Monthly comparison between bank statements and ledger accounts to catch unrecorded bank charges, timing differences, or fraudulent checks.
• Inventory Count Variance Analysis: Comparing physical stock counts against perpetual inventory ledger records to detect shrinkage or unrecorded damage.
• Audit Trails and Exception Logs: Reviewing automated log files for unauthorized system access attempts or price override transactions.

---

Segregation of Duties (SoD) & Compensation Controls

Segregation of Duties (SoD) is the fundamental preventative control designed to prevent fraud and errors by ensuring that no single employee has control over all phases of a key business transaction.

The Four Incompatible Functions

To achieve effective segregation, an entity must assign four distinct functions to different personnel:

• Authorization: Management approval of transactions (e.g., approving purchase orders or credit limits).
• Custody: Holding or having access to physical assets (e.g., cash handling, storekeeping).
• Recording: Entering transactions into accounting ledgers or journal vouchers.
• Reconciliation: Comparing records with physical assets or external statements.

Exam Trap Scenario: If a storekeeper (Custody) also maintains the perpetual inventory ledger (Recording), they could steal inventory and write off the loss in the ledger without detection. If a payroll officer approves overtime (Authorization) and enters payroll data (Recording), unauthorized wage inflation can occur.

Compensating Controls in Small Entities

Small companies in Bangladesh often lack sufficient staff to fully segregate duties. In such cases, management must implement compensating controls, such as:

• Direct, active supervision and review by owner-managers.
• Mandatory independent monthly bank reconciliation reviews by directors.
• Unannounced cash counts and physical inventory checks by external advisors.

---

IT Control Frameworks under ISA 315

As organizations automate financial reporting through Enterprise Resource Planning (ERP) systems (e.g., SAP, Oracle, Tally), auditors categorize IT controls into General IT Controls (GITCs) and Application Controls.

---

General IT Controls (GITCs)

General IT Controls are policies and procedures that apply to all or broad segments of an entity's IT infrastructure, ensuring the continued, proper operation of computer systems.

Major GITC Domains include:

1. Logical Access Controls: Password complexity policies, multi-factor authentication (MFA), role-based access rights, and prompt revocation of access for terminated employees.
2. Program Development and Acquisition: Standards for buying or building new software, rigorous user acceptance testing (UAT), and formal sign-off before implementation.
3. Program Change Management: Strict controls over modifications to existing code, separation of development and production environments, and emergency patch approval procedures.
4. Computer Operations & Data Backup: Job scheduling, error log monitoring, regular data backups (off-site or cloud storage), and tested Business Continuity Plans (BCP).

---

Application IT Controls

Application IT Controls are automated or manual procedures that operate at the specific business process level (e.g., sales, accounts payable, payroll) to ensure that processing is authorized, complete, and accurate.

---

Interdependence: GITCs vs. Application Controls

A critical audit rule under ISA 315 is that automated application controls rely on effective GITCs.

• If GITCs are strong (e.g., unauthorized code changes are prevented and access security is secure), the auditor can rely on automated application controls and test them only once or via sampling.
• If GITCs are weak (e.g., programmers can alter production code without authorization), automated application controls cannot be trusted, as system logic may have been altered. The auditor must perform extensive substantive procedures.