| Risk Assessment |
RiskAssessmentProgramDevelopmentChangeQuestionnaireImportance |
| Listing of Significant Risks (By Cycle)
| |
|
|
|
| Valid From: |
3/1/20=
05 |
|
|
|
|
| Valid To: |
12/31/=
2005 |
|
|
|
|
|
|
|
| Cycle |
Process |
Ref # |
Risk=
|
Impor=
tance |
|
| Program Development and Program Change |
Acquire
or Develop Application Systems |
PDPC
1.1 |
Lack
of a comprehensive SDLC methodology could lead to improperly controlled
financial systems. |
High |
|
| |
=
; |
PDPC
1.2 |
Failure
to apply SDLC to changes impacting financial information could lead to
insufficient controls. |
High |
|
| |
|
PDPC
1.3 |
Lack
of a comprehensive SDLC methodology could lead to improperly controlled
financial systems. |
High |
|
| |
|
PDPC
1.4 |
Systems
acquisitions that are not in line with strategic direction could lead to
inefficient use of corporate assets. |
Low |
|
| |
|
PDPC
1.5 |
Lack
of user involvement in system implementations could lead to improperly
controlled financial systems. |
High |
|
| |
|
PDPC
1.6 |
Failure
to assess financial systems after information could lead to errors going
undetected. |
Medium |
|
| |
|
PDPC
1.7 |
Improper
implementation of systems software could lead to control breakdowns. |
High |
|
|
<=
/td>
| |
=
|
|
| Program
Development and Program Change |
Defi=
ne the
Information Architecture |
PDPC 2.=
1 |
Impro=
per
implementation of infrastructure systems could lead to control breakdowns=
. |
High
| |
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Program Development and Program Change |
Develop
and Maintain Policies and Procedures |
PDPC
3.1 |
Outdated
SDLC may not reflect changes in the business and/or in the technology are=
na. |
Low |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Program Development and Program Change |
Develop
and Maintain Policies and Procedures |
PDPC
3.2 |
SDLC
methodology may not be applied to financial system implementations, leadi=
ng
to a breakdown in controls. |
High |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Program Development and Program Change |
Intstall
and Test Application Software and Technology Infrastructure |
PDPC
4.1 |
Insufficient
testing could result in erroneous code being promoted into the production
environment. |
High |
|
| |
=
; |
PDPC 4.=
2 |
Lack of load and stres=
s testing
could lead to implementation of systems that do not perform properly under
true production conditions. |
High |
|
| |
|
PDPC 4.=
3 |
Insufficient testing of
interfaces could affect the completeness and accuracy of data transmitted=
in
the production environment. |
High |
|
| |
|
PDPC 4.=
4 |
Invalid, incomplete, a=
nd
inaccurate data could be loaded into the production environment. |
High |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Program
Development and Program Change |
Manage Changes |
PDPC 5.=
1 |
Unapproved code could =
be placed
into production. |
High |
|
| |
=
; |
PDPC 5.=
2 |
Unapproved code could =
be placed
into production. |
High |
|
| |
|
PDPC 5.=
3 |
Unapproved
code could be placed into production. |
High |
|
| |
|
PDPC 5.=
4 |
Impro=
per
implementation of systems software could lead to security breaches for
financial information and systems. |
High
| |
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Computer Ops and Access to Programs & Data |
Define
and Manage Service Levels |
CO
1.1 |
Financial
systems may not meet the performance needs of management. |
Low |
|
|
|
CO
1.2 |
Financial
systems may not meet the performance needs of management. |
Low |
|
| |
|
<=
/td>
| =
; |
=
|
|
| Computer Ops and Access to Programs & Data |
Manage
Third-Party Services |
CO
2.1 |
Financial
systems may not meet the performance needs of management. |
Low |
|
| |
=
; |
CO
2.2 |
Control
reliance may be placed on third party providers without the appropriate d=
ue
diligence. |
High |
|
| |
|
CO
2.3 |
Control
reliance may be placed on third party providers without the appropriate d=
ue
diligence. |
High |
|
| |
|
CO
2.4 |
Third
party providers may not meet the organization's requirements for internal
controls. |
High |
|
| |
|
CO
2.5 |
Third
party providers may not meet the organization's requirements for internal
controls. |
High |
|
| |
|
CO
2.6 |
Third
party providers system of control may break down over time. |
High |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Computer Ops and Access to Programs & Data |
Ensure
Systems Security |
CO
3.1 |
Lack
of an information security policy could result in improper levels of secu=
rity
over financial systems and information. |
High |
|
| |
=
; |
CO
3.2 |
Lack
of an information security framework could result in inconsistent applica=
tion
of security policies, affecting security over financial systems and
information. |
High |
|
| |
|
CO
3.3 |
Lack
of a tie between the information security plan and overall IT strategic p=
lan
could lead to inefficient security implementation. |
Low |
|
| |
|
CO
3.4 |
Lack
of updates to the IT security plan could lead to degradation of system and
network security over time. |
High |
|
| |
|
CO
3.5 |
Improper
access could be provided to key financial transactions. |
High |
|
| |
|
CO
3.6 |
Lack
of mechanisms such as password changes could lead to weak security over t=
ime. |
High |
|
| |
|
CO
3.7 |
Improper
access could be provided for financial systems and data. |
High |
|
| |
|
CO
3.8 |
Improper
access could be provided for financial systems and data. |
High |
|
| |
|
CO
3.9 |
Transactions
may be improperly received or rejected between the company and outside
parties. |
High |
|
| |
|
CO
3.10 |
Improper
access could be provided for financial systems and data. |
High |
|
| |
|
CO
3.11 |
Management
may not be notified in a timely fashion when system resources are under
attack. |
Medium |
|
| |
|
CO
3.12 |
Improper
access could be provided for financial systems and data. |
High |
|
| |
|
CO
3.13 |
Improper
access could be provided to physical IT assets that support financial sys=
tems
and data. |
High |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Computer Ops and Access to Programs & Data |
Manage
the Configuration |
CO
4.1 |
Unauthorized
software could introduce errors and/or lead to a breakdown in controls ov=
er
financial systems and data. |
High |
|
| |
=
; |
CO
4.2 |
Improper
access could be obtained from external sources. |
High |
|
|
|
CO
4.3 |
Improper
access could be granted to financial data and applications kept in data
storage systems. |
High |
|
|
|
CO
4.4 |
Computer
viruses could lead to the corruption of financial systems and data. |
High |
|
| |
|
CO
4.5 |
System
configurations may change over time, leading to possible breakdowns in
control. |
Medium |
|
| |
=
; |
<=
/td>
| =
; |
=
|
|
| Computer Ops and Access to Programs & Data |
Manage
Problems and Incidents |
CO
5.1 |
Improper
follow-up and resolution of identified problems could lead to a breakdown=
in
controls over time. |
High |
|
| |
=
; |
CO
5.2 |
Improper
follow-up and resolution of identified problems could lead to a breakdown=
in
controls over time. |
High |
|
| |
|
CO
5.3 |
Improper
follow-up and resolution of security incident could lead to unauthorized
access to financial systems and data. |
High |
|
| |
|
|
|
|
|
| Computer Ops and Access to Programs & Data |
Manage
Data |
CO
6.1 |
Financial
information may be improperly disclosed or destroyed. |
High |
|
| |
=
; |
CO
6.2 |
Financial
information may be improperly disclosed or destroyed. |
High |
|
| |
|
CO
6.3 |
Financial
information may not be available when needed by business unit management.=
|
High |
|
| |
|
CO
6.4 |
Financial
information may not be available when needed by business unit management.=
|
High |
|
| |
|
CO
6.5 |
Financial
information may not be available when needed by business unit management.=
|
High |
|
| |
|
CO
6.6 |
Improper
changes to data structures could lead to errors in financial systems or d=
ata. |
High |
|
| |
|
|
|
|
|
| Computer Ops and Access to Programs & Data |
Manage
Operations |
CO
7.1 |
Lack
of procedures for problem management could lead to control breakdowns bei=
ng
undetected. |
High |
|
|
CO 7.2
| Lack
of sufficient system event history could make it difficult to reconstruct
financial system and data processing. |
Low |
|
|
CO 7.3
| Lack
of sufficient system event data could cause incomplete or untimely proces=
sing
to go undetected. |
Low |
|
|
CO 7.4
| Insufficient
end user computing policies and procedures could lead to a control breakd=
own
for end user tools such as spreadsheets. |
High |
|
|
CO 7.5
| End
user computing tools may have control breakdowns over time that go
undetected. |
High |
|
|
CO 7.6
| End
user computing tools may not be recoverable. |
High |
|
|
CO 7.7
| End
user computing tools may be exposed to improper access. |
High |
|
|
CO 7.8
| End
user computing tools may be exposed to improper access. |
High |
|
|
CO 7.9
| End
user computing tools may have control breakdowns over time that go
undetected. |
High |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| <=
/td>
| |
|
|
|
|
|
|
|
------=_NextPart_01C5BAEF.C5C3A2D0
Content-Location: file:///C:/011B0290/_mnt_RiskAssessmentProgramDevelopmentChangeQuestionnaireImportanceIT_RCM_03_30_sheet002.htm
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"
|
|
|
|
|
|
|
|
|
|
|
| Compan=
y-level
Questionnaire |
|
|
N |
| Information and Communication |
|
|
COSO stat=
es that
information is needed at all levels of an organization to run the business
and achieve the company’s control objectives. However, the
identification, management and communication of relevant information
represents an ever-increasing challenge to the IT department. The
determination of which information is required to achieve control objecti=
ves
and the communication of this information in a form and time frame that a=
llow
people to carry out their duties support the other four components of the
COSO framework. |
|
|
Points=
to
Consider |
Response
(Y/N) |
Comments |
|
|
Inform=
ation
Architecture |
|
| 24 |
=
; Has IT
management defined information capture, processing and reporting
controls—including completeness, accuracy, validity and
authorization—to support the quality and integrity of information u=
sed
for financial and disclosure purposes? |
<=
/td>
| =
; |
|
| Has IT management defined information classification
standards in accordance with corporate security and privacy policies? |
<=
/td>
| =
; |
|
| 26 |
=
; Has IT
management defined, implemented and maintained security levels for each of
the data classifications? Do these security levels represent the appropri=
ate
(minimum) set of security and control measures for each of the
classifications? Are they reevaluated periodically and modified according=
ly? |
<=
/td>
| =
; |
|
| Communication of Management Aims and Direct=
ions |
|
| 27 |
=
; Has IT
management formulated, developed and documented policies and procedures
governing the IT organization’s activities? |
<=
/td>
| =
; |
|
| Has IT management communicated policies and procedures
governing the IT organization’s activities? |
<=
/td>
| =
; |
|
| 29 |
=
; Does IT
management periodically review its policies, procedures and standards to
reflect changing business conditions? |
<=
/td>
| =
; |
|
| Does IT management have processes in place to investi=
gate
compliance deviations and introduce remedial action? |
<=
/td>
| =
; |
|
| 31 |
=
; Does IT
management have a process in place to assess compliance with its policies,
procedures and standards? |
<=
/td>
| =
; |
|
| Does IT management understand its roles and
responsibilities related to the Sarbanes-Oxley Act? |
<=
/td>
| =
; |
|
| =
|
| Risk
Assessment |
|
|
Risk
assessment involves the identification and analysis by management of rele=
vant
risks to achieve predetermined objectives, which form the basis for
determining control activities. It is likely that internal control risks
could be more pervasive in the IT organization than in other areas of the
company. Risk assessment may occur at the company level (for the overall
organization) or at the activity level (for a specific process or business
unit). |
|
|
Points=
to
Consider |
Response
(Y/N) |
Comments |
|
|
Assess=
ment of
Risks |
|
| 33 |
=
; Does the
IT organization have an entity- and activity-level risk assessment framew=
ork
that is used periodically to assess information risk to achieving business
objectives? Does it consider the probability and likelihood of threats?
| <=
/td>
| =
; |
|
| Does the IT organization’s risk assessment
framework measure the impact of risks according to qualitative and
quantitative criteria, using inputs from different areas including, but n=
ot
limited to, management brainstorming, strategic planning, past audits and
other assessments? |
<=
/td>
| =
; |
|
| 35 |
=
; Is the
IT organization’s risk assessment framework designed to support
cost-effective controls to mitigate exposure to risks on a continuing bas=
is,
including risk avoidance, mitigation or acceptance? |
<=
/td>
| =
; |
|
| Is a comprehensive security assessment performed for
critical systems and locations based on their relative priority and
importance to the organization? |
<=
/td>
| =
; |
|
| 37 |
=
; Where
risks are considered acceptable, is there formal documentation and accept=
ance
of residual risk with related offsets, including adequate insurance cover=
age,
contractually negotiated liabilities and self-insurance? |
<=
/td>
| =
; |
|
| Is the IT organization committed to active and contin=
uous
risk assessment processes as an important tool in providing information on
the design and implementation of internal controls, in the definition of =
the
IT strategic plan, and in the monitoring and evaluation mechanisms? |
<=
/td>
| =
; |
|
| 39 |
=
; Is
access to the data center restricted to authorized personnel, requiring
appropriate identification and authentication? |
<=
/td>
| =
; |
|
| Has a business impact assessment been performed that
considers the impact of systems failure on the financial reporting proces=
s? |
<=
/td>
| =
; |
|
| |
Manage
Facilities |
|
| Are data center facilities equipped with adequate
environmental controls to maintain systems and data, including fire
suppression, uninterrupted power service (UPS), air conditioning and elev=
ated
floors? |
<=
/td>
| =
; |
|
| =
|
| Monitoring |
|
|
Monitorin=
g, which
covers the oversight of internal control by management through continuous=
and
point-in-time assessment processes, is becoming increasingly important to=
IT
management. There are two types of monitoring activities: continuous
monitoring and separate evaluations. |
|
|
Points=
to
Consider |
Response
(Y/N) |
Comments |
|
|
Compli=
ance With
External Requirements |
|
| 42 |
=
; Does the
organization monitor changes in external requirements for legal, regulato=
ry
or other external requirements related to IT practices and controls? |
<=
/td>
| =
; |
|
| Are control activities in place and followed to ensure
compliance with external requirements, such as regulatory and legal rules=
? |
|
=
; |
|
| 44 |
=
; Are
internal events considered in a timely manner to support continuous
compliance with legal and regulatory requirements? |
|
=
; |
|
| Management of Quality |
|
| 45 |
=
; Is
documentation created and maintained for all significant IT processes,
controls and activities? |
<=
/td>
| =
; |
|
| Does a plan exist to maintain the overall quality
assurance of IT activities based on the organizational and IT plans? |
|
=
; |
|
| 47 |
=
; Are
documentation standards in place, have they been communicated to all IT
staff, and are they supported with training? |
|
=
; |
|
| Does a quality plan exist for significant IT functions
(e.g., system development and deployment) and does it provide a consistent
approach to address both general and project-specific quality assurance
activities? |
|
=
; |
|
| 49 |
=
; Does the
quality plan prescribe the type(s) of quality assurance activities (such =
as
reviews, audits, inspections) to be performed to achieve the objectives of
the quality plan? |
|
=
; |
|
| Does the quality assurance process include a review of
adherence to IT policies, procedures and standards? |
|
=
; |
|
| 51 |
Have =
data
integrity ownership and responsibilities been communicated to the appropr=
iate
data owners and have they accepted these responsibilities? |
|
=
; |
|
|
Manage
Performance and Capacity |
|
| 52 |
Does =
IT
management monitor the performance and capacity levels of the systems and
network? |
<=
/td>
| =
; |
|
| Does IT management have a process in place to respond to
suboptimal performance and capacity measures in a timely manner? |
|
=
; |
|
| 54 |
Is pe=
rformance
and capacity planning included in system design and implementation
activities? |
|
=
; |
|
|
Monito=
ring |
|
| 55 |
Have
performance indicators (e.g., benchmarks) from both internal and external
sources been defined, and are data being collected and reported regarding
achievement of these benchmarks? |
<=
/td>
| =
; |
|
| Has IT management established appropriate metrics to effecti=
vely
manage the day-to-day activities of the IT department? |
|
=
; |
|
| 57 |
Does =
IT
management monitor IT’s delivery of services to identify shortfalls=
and
does IT respond with actionable plans to improve? |
|
=
; |
|
|
Adequa=
cy of
Internal Control |
|
| 58 |
Does =
IT
management monitor the effectiveness of internal controls in the normal
course of operations through management and supervisory activities,
comparisons and benchmarks? |
<=
/td>
| =
; |
|
| Are serious deviations in the operation of internal control,
including major security, availability and processing integrity events,
reported to senior management? |
|
=
; |
|
| 60 |
Are i=
nternal
control assessments performed periodically, using self-assessments or
independent audits, to examine whether or not internal controls are opera=
ting
satisfactorily? |
|
=
; |
|
|
Indepe=
ndent
Assurance |
|
| 61 |
Does =
IT
management obtain independent reviews prior to implementing significant IT
systems that are directly linked to the organization’s financial
reporting environment? |
<=
/td>
| =
; |
|
| Does IT management obtain independent internal control revie=
ws
of third-party service providers (e.g., by obtaining and reviewing copies=
of
SAS 70, SysTrust or other independent audit reports)? |
|
=
; |
|
| 63 |
Is
documentation retained in a manner that can be used by the independent
auditor or examiner as a basis for reliance? |
|
=
; |
|
| Internal Audit |
|
| 64 |
Does =
the
organization have an IT internal audit department that is responsible for
reviewing IT activities and controls? |
<=
/td>
| =
; |
|
| Is the audit plan based upon a risk assessment that includes=
IT?
Does it cover the full range of IT audits, e.g., general and application
controls, systems development life cycle? |
|
=
; |
|
| 66 |
Are p=
rocedures
in place to follow up on IT control issues in a timely manner? |
|
=
; |
|
|
|
|
|
|
|
|
|
|
|
|
------=_NextPart_01C5BAEF.C5C3A2D0
Content-Location: file:///C:/011B0290/_mnt_RiskAssessmentProgramDevelopmentChangeQuestionnaireImportanceIT_RCM_03_30_sheet003.htm
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"
| Cobit
Guidelines |
|
|
|
| Field Name |
Field Description |
| Control Ref. |
Refer=
ence codes
that tie into the IT Governance Institute's guidelines (e.g., PDPC 1.1 is=
the
first control under Program Development and Program Change, Objective 1)<=
/td>
|
| Cyc=
le /
Process |
Indicates
which cycle/process the control falls into, per the IT Governance Institu=
te's
structure. The two main
cycles/processes are "Program Development and Program Change", =
and
"Computer Operations and Access to Programs and Data". |
| Ill=
ustrative
Controls |
These
are typical controls that exist to satisfy the control objectives laid ou=
t by
IT Governance Institute's document.
These controls serve as an example only - other controls may be
acceptable, and in some cases they may not apply to a given organization's
actual situation. |
| Con=
trol
Importance |
This
is an evaluation by management of the importance of this control to achie=
ving
the overall control objective. |
| Ris=
k |
This
describes the actual risk of a financial statement error if the control w=
as
not in place or not functioning as intended. |
| Cont=
rol |
This
is the actual control management has put in place to address the risk. Note that some controls may addr=
ess
multiple risks. |
| Cont=
rol Type
(PDC) |
This
optional field indicates the type of control management has put in
place. "P", or
preventive controls, stop an error from occurring (e.g., field edits, acc=
ess
controls). "D", or
detective controls, notify appropriate personnel of a possible error (e.g=
.,
notification of a possible hacker attack). "C", or corrective con=
trols,
fix an error after it occurs (e.g., automatic retransmission upon a failed
file transfer). |
| Vali=
dation
Approach |
This
field explains the steps to be taken by the organization's management to
ensure controls are functioning as intended over time. |
| Vali=
dation
Results |
Documents
the actual findings upon completion of the validation steps. If errors were identified in the
validation process, remediation and retesting may be required. |
| Area=
for
Improvement |
This
field shows either insufficient control design, or controls that have been
put in place but are not functioning as intended. |
| Act=
ion Items |
This
is an optional field that can be used to as a project management tool,
allowing the user to input open items. |
| Test=
of
Controls Time Estimate |
This
is an optional field that allows the user to input the estimated number of
hours needed to validate the control.&nb=
sp;
This information is important for project planning and resource
management. |
| Cont=
rol
Maturity Assessment |
Allows
the organization's management to assess whether the control is strong eno=
ugh
to provide reasonable assurance that a material misstatement of the finan=
cial
statements will not occur. =
One
possible guideline is the IT Governance Institute, which recommends
evaluating controls on a scale from 1 - 5. Controls rated less than 3 may r=
equire
remediation. |
| Cont=
rol
Effective Date |
Field
that indicates the date the control went into effect. This is used primarily in situat=
ions
where new controls have been added recently. |
| Rea=
dy to
Test? |
This
is an evaluation based on the control maturity assessment and the control
effective date that indicates whether validation testing can occur. For controls to be properly asse=
ssed,
they need to have been in operation long enough for sufficient evidence of
performance to be accumulated. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
------=_NextPart_01C5BAEF.C5C3A2D0
Content-Location: file:///C:/011B0290/_mnt_RiskAssessmentProgramDevelopmentChangeQuestionnaireImportanceIT_RCM_03_30_sheet004.htm
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"
| IT Application Controls Matrix: |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Client: |
Comsys |
|
| Valid From: |
3/1/200=
5 |
|
| Valid To: |
12/31/2=
005 |
|
|
|
|
| Control
Ref. |
Cycle / Process |
Control Objectives |
Financial Statement Assertions |
Illustrative Controls |
Control Importance |
Risk |
Control
(Peoplesoft) |
Control
(Application 1) |
Control
(Application 2) |
Control Type |
Validation Approach |
Validation Results |
Area for Improvement |
Action Items |
Validation Estimate |
Control Maturity Assessment |
Control Effective Date |
Ready to Test? |
Illustrative Test of Controls |
|
| IT1 |
Sales |
Orders
are processed only within approved customer credit limits. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT2 |
Sales |
Orders
are approved by management as to prices and terms of sale. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT3 |
Sales |
Orders
and cancellations of orders are input accurately. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT4 |
Sales |
Order
entry data are transferred completely and accurately to the shipping and
invoicing activities. |
Valuation,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT5 |
Sales |
All
orders received from customers are input and processed. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT6 |
Sales |
Only
valid orders are input and processed. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT7 |
Sales |
Invoices
are generated using authorized terms and prices. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT8 |
Sales |
Invoices
are accurately calculated and recorded. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT9 |
Sales |
Credit
notes and adjustments to accounts receivable are accurately calculated and
recorded. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT10 |
Sales |
All
goods shipped are invoiced. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT11 |
Sales |
Credit
notes for all goods returned and adjustments to accounts receivable are
issued in accordance with organization policy. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT12 |
Sales |
Invoices
relate to valid shipments. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT13 |
Sales |
All
credit notes relate to a return of goods or other valid adjustments. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT14 |
Sales |
All
invoices issued are recorded. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT15 |
Sales |
All
credit notes issued are recorded. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT16 |
Sales |
Invoices
are recorded in the appropriate period. |
Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT17 |
Sales |
Credit
notes issued are recorded in the appropriate period. |
Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT18 |
Sales |
Cash
receipts are recorded in the period in which they are received. |
Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT19 |
Sales |
Cash
receipts data are entered for processing accurately. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT20 |
Sales |
All
cash receipts data are entered for processing. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT21 |
Sales |
Cash
receipts data are valid and are entered for processing only once. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT22 |
Sales |
Cash
discounts are accurately calculated and recorded. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT23 |
Sales |
Timely
collection of accounts receivable is monitored. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT24 |
Sales |
The
customer master file is maintained. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT25 |
Sales |
Only
valid changes are made to the customer master file. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT26 |
Sales |
All
valid changes to the customer master file are input and processed. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT27 |
Sales |
Changes
to the customer master file are accurate. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT28 |
Sales |
Changes
to the customer master file are processed in a timely manner. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT29 |
Sales |
Customer
master file data remain up-to-date. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT30 |
Purchasing
| Purchase
orders are placed only for approved requisitions. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT31 |
Purchasing
| Purchase
orders are accurately entered. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT32 |
Purchasing
| All
purchase orders issued are input and processed. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT33 |
Purchasing
| Amounts
posted to accounts payable represent goods or services received. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT34 |
Purchasing
| Accounts
payable amounts are accurately calculated and recorded. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT35 |
Purchasing
| All
amounts for goods or services received are input and processed to accounts
payable. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT36 |
Purchasing
| Amounts
for goods or services received are recorded in the appropriate period.
| Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT37 |
Purchasing
| Accounts
payable are adjusted only for valid reasons. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT38 |
Purchasing
| Credit
notes and other adjustments are accurately calculated and recorded. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT39 |
Purchasing
| All
valid credit notes and other adjustments related to accounts payable are
input and processed. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT40 |
Purchasing
| Credit
notes and other adjustments are recorded in the appropriate period. |
Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT41 |
Purchasing
| Disbursements
are made only for goods and services received. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT42 |
Purchasing
| Disbursements
are distributed to the appropriate suppliers. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT43 |
Purchasing
| Disbursements
are accurately calculated and recorded. |
Valuation,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT44 |
Purchasing
| Disbursements
are recorded in the period in which they are issued. |
Valuation,
Occurance |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT45 |
Purchasing
| Only
valid changes are made to the supplier master file. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT46 |
Purchasing
| All
valid changes to the supplier master file are input and processed. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT47 |
Purchasing
| Changes
to the supplier master file are accurate. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT48 |
Purchasing
| Changes
to the supplier master file are processed in a timely manner. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT49 |
Purchasing
| Supplier
master file data remain up-to-date. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT50 |
Monetary
Cycle |
Borrowings
are accurately recorded as to amounts and terms. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT51 |
Monetary
Cycle |
All
borrowings are recorded. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT52 |
Monetary
Cycle |
Borrowings
are recorded in the appropriate period. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT53 |
Monetary
Cycle |
All
interest is accurately calculated and recorded in the appropriate period.=
|
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT54 |
Monetary
Cycle |
Recorded
loan repayments are valid. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT55 |
Monetary
Cycle |
Loan
repayments are accurately recorded. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT56 |
Monetary
Cycle |
All
loan repayments are recorded. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT57 |
Monetary
Cycle |
Loan
repayments are recorded in the appropriate period. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT58 |
Monetary
Cycle |
Investment
purchases, sales and maturities are accurately recorded. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT59 |
Monetary
Cycle |
All
investment transactions are recorded. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT60 |
Monetary
Cycle |
Investment
transactions are recorded in the appropriate period. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT61 |
Monetary
Cycle |
All
investment income is accurately calculated and recorded in the appropriate
period. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT62 |
Monetary
Cycle |
Derivative
transactions are accurately recorded. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT63 |
Monetary
Cycle |
Derivative
transactions are recorded in the appropriate period. |
|
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT64 |
Inventory |
Adjustments
to inventory prices or quantities are recorded promptly and in the
appropriate period. |
Validity,
Completeness, Valuation, Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT65 |
Inventory |
Adjustments
to inventory prices or quantities are recorded accurately. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT66 |
Inventory |
Raw
materials are received and accepted only if they have valid purchase orde=
rs. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT67 |
Inventory |
Raw
materials received are recorded accurately. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT68 |
Inventory |
All
raw materials received are recorded. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT69 |
Inventory |
Receipts
of raw materials are recorded promptly and in the appropriate period. |
Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT70 |
Inventory |
Defective
raw materials are returned promptly to suppliers. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT71 |
Inventory |
All
transfers of raw materials to production are recorded accurately and in t=
he
appropriate period. |
Valuation,
Occurrence, Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT72 |
Inventory |
All
direct and indirect expenses associated with production are recorded
accurately and in the appropriate period. |
Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT73 |
Inventory |
All
transfers of completed units of production to finished goods inventory are
recorded completely and accurately in the appropriate period. |
Valuation,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT74 |
Inventory |
Finished
goods returned by customers are recorded completely and accurately in the
appropriate period. |
Valuation,
Completeness, Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT75 |
Inventory |
Finished
goods received from production are recorded completely and accurately in =
the
appropriate period. |
Completeness,
Valuation, Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT76 |
Inventory |
All
shipments are recorded. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT77 |
Inventory |
Shipments
are recorded accurately. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT78 |
Inventory |
Shipments
are recorded promptly and in the appropriate period. |
Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT79 |
Inventory |
Inventory
is reduced only when goods are shipped with approved customer orders. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT80 |
Inventory |
Costs
of shipped inventory are transferred from inventory to cost of sales. |
Validity,
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT81 |
Inventory |
Costs
of shipped inventory are accurately recorded. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT82 |
Inventory |
Amounts
posted to cost of sales represent those associated with shipped inventory=
. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT83 |
Inventory |
Costs
of shipped inventory are transferred from inventory to cost of sales prom=
ptly
and in the appropriate period. |
Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT84 |
Inventory |
Only
valid changes are made to the inventory management master file. |
Validity,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT85 |
Inventory |
All
valid changes to the inventory management master file are input and
processed. |
Validity,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT86 |
Inventory |
Changes
to the inventory management master file are accurate. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT87 |
Inventory |
Changes
to the inventory management master file are promptly processed. |
Validity,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT88 |
Inventory |
Inventory
management master file data remain up-to-date. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT89 |
Asset |
Fixed
asset acquisitions are accurately recorded. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT90 |
Asset |
Fixed
asset acquisitions are recorded in the appropriate period. |
Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT91 |
Asset |
All
fixed asset acquisitions are recorded. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT92 |
Asset |
Depreciation
charges are accurately calculated and recorded. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT93 |
Asset |
All
depreciation charges are recorded in the appropriate period. |
Validity,
Valuation, Occurrence, Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT94 |
Asset |
All
fixed asset disposals are recorded. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT95 |
Asset |
Fixed
asset disposals are accurately calculated and recorded. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT96 |
Asset |
Fixed
asset disposals are recorded in the appropriate period. |
Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT97 |
Asset |
Records
of fixed asset maintenance activity are accurately maintained. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT98 |
Asset |
Fixed
asset maintenance activities records are updated in a timely manner. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT99 |
Asset |
Only
valid changes are made to the fixed asset register and/or master file.
| Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT100 |
Asset |
All
valid changes to the fixed asset register and/or master file are input and
processed. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT101 |
Asset |
Changes
to the fixed asset register and/or master file are accurate. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT102 |
Asset |
Changes
to the fixed asset register and/or master file are promptly processed.
| Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT103 |
Asset |
Fixed
asset register and/or master file data remain up-to-date. |
Completeness,
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT104 |
Human Resourc=
es |
Additions
to the payroll master files represent valid employees. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT105 |
Human Resourc=
es |
All
new employees are added to the payroll master files. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT106 |
Human Resourc=
es |
Terminated
employees are removed from the payroll master files. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT107 |
Human Resourc=
es |
Employees
are terminated only within statutory and union requirements. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT108 |
Human Resourc=
es |
Deletions
from the payroll master files represent valid terminations. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT109 |
Human Resourc=
es |
All
time worked is input. |
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT110 |
Human Resourc=
es |
Time
worked is accurately input and processed. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT111 |
Human Resourc=
es |
Payroll
is recorded in the appropriate period. |
Valuation,
Occurrence |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT112 |
Human Resourc=
es |
Payroll
(including compensation and withholdings) is accurately calculated and
recorded. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT113 |
Human Resourc=
es |
Payroll
is disbursed to appropriate employees. |
Validity |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT114 |
Human Resourc=
es |
Only
valid changes are made to the payroll master files. |
Validity,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT115 |
Human Resourc=
es |
All
valid changes to the payroll master files are input and processed. |
Validity,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT116 |
Human Resourc=
es |
Changes
to the payroll master files are accurate. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT117 |
Human Resourc=
es |
Changes
to the payroll master files are processed in a timely manner. |
Validity,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT118 |
Human Resourc=
es |
Payroll
master file data remain up-to-date. |
Validity,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT119 |
Human Resourc=
es |
Only
valid changes are made to the payroll withholding tables. |
Validity,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT120 |
Human Resourc=
es |
All
valid changes to the payroll withholding tables are input and processed.<=
/td>
| Validity,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT121 |
Human Resourc=
es |
Changes
to the payroll withholding tables are accurate. |
Valuation |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT122 |
Human Resourc=
es |
Changes
to the payroll withholding tables are promptly processed. |
Validity,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
TBD |
|
| IT123 |
Human Resourc=
es |
Payroll
withholding table data remain up-to-date. |
Validity,
Completeness |
TBD |
TBD |
TBD |
TBD |
N/A |
N/A |
TBD |
TBD |
TBD |
TBD |
TBD |