IT6

Name/s: ARAGON, Althene Nicole G. Schedule: MW 1:00-2:30 PM

Section: M31

EXER. FT 1: IT AUDIT PROGRAM FOR TEST OF GENERAL CONTROLS

1. Operating System Controls

AUDIT OBJECTIVES
1. To verify that access privileges are granted in a manner that is consistent with
the need to separate incompatible functions and is in accordance with the
organization’s policy.
2. To ensure that the organization has an adequate and effective password policy
for contolling access to the operating system.
3. To verify that effective management policies and procedures are in place to
prevent the introduction and spread of destructive programs, including viruses,
worms, back doors, logic bombs, and Trojan horses.
4. To ensure that the established system audit trail is adequate for preventing and
detecting abuses, reconstructing key events that precede system failures, and
planning resource allocation.

POSSIBLE ERRORS + IRREGULARITIES

1. Unauthorized access
2. Virus infection
3. Cybercrime attacks

AUDIT PROCEDURES
1. Review the organization’s policies for separating incompatible functions and
ensure that they promote reasonable security.
2. Review the users’ permitted log-on times.
3. Verify that all users are required to have passwords.
4. Verify that the current version of antiviral software is installed on the server and
that upgrades regularly downloaded to workstations.
5. Select a sample of security violation cases and evaluate their disposition to
assess the effectiveness of the security group.

INTERNAL CONTROL CHECKLIST

1. How does the company keep unwanted / unauthorized access out of their
system?
2. What is the company’s policy with regards to the users’ passwords?
3. Are the permitted users’ passwords strong enough to avoid unauthorized
access?
4. Does the company employ an excellent antivirus software?

REFERENCES
1. Hall, J. A. (2011). Accounting Information Systems (7th ed.). Cengage Learning.
2. Sadasdas
3. sadasd
 IT6

Name/s: ARAGON, Althene Nicole G. Schedule: MW 1:00-2:30 PM

Section: M31

EXER. FT 1: IT AUDIT PROGRAM FOR TEST OF GENERAL CONTROLS

2. Data Management Controls

AUDIT OBJECTIVES
1. To verify that individuals who are authorized to use the database are limited to
accessing only the data needed to perform their duties.
2. To verify that unauthorized individuals are denied access to the database.
3. To verify that database backup controls are adequate to facilitate the recovery of
lost, destroyed, or corrupted data.

POSSIBLE ERRORS + IRREGULARITIES

4. Unauthorized access
5. Virus infection
6. Cybercrime attacks

AUDIT PROCEDURES
6. Review the organization’s policies for separating incompatible functions and
ensure that they promote reasonable security.
7. Review the users’ permitted log-on times.
8. Verify that all users are required to have passwords.
9. Verify that the current version of antiviral software is installed on the server and
that upgrades regularly downloaded to workstations.
10. Select a sample of security violation cases and evaluate their disposition to
assess the effectiveness of the security group.

INTERNAL CONTROL CHECKLIST

5. How does the company keep unwanted / unauthorized access out of their
system?
6. What is the company’s policy with regards to the users’ passwords?
7. Are the permitted users’ passwords strong enough to avoid unauthorized
access?
8. Does the company employ an excellent antivirus software?

REFERENCES
4. SASD
5. ASDAS
6. SDASDASD

IT6

Name/s: ARAGON, Althene Nicole G. Schedule: MW 1:00-2:30 PM

Section: M31
 EXER. FT 1: IT AUDIT PROGRAM FOR TEST OF GENERAL CONTROLS

4. Computer Center Security and Controls

AUDIT OBJECTIVES
5. To verify that access privileges are granted in a manner that is consistent with
the need to separate incompatible functions and is in accordance with the
organization’s policy.
6. To ensure that the organization has an adequate and effective password policy
for contolling access to the operating system.
7. To verify that effective management policies and procedures are in place to
prevent the introduction and spread of destructive programs, including viruses,
worms, back doors, logic bombs, and Trojan horses.
8. To ensure that the established system audit trail is adequate for preventing and
detecting abuses, reconstructing key events that precede system failures, and
planning resource allocation.

POSSIBLE ERRORS + IRREGULARITIES

7. Unauthorized access
8. Virus infection
9. Cybercrime attacks

AUDIT PROCEDURES
11. Review the organization’s policies for separating incompatible functions and
ensure that they promote reasonable security.
12. Review the users’ permitted log-on times.
13. Verify that all users are required to have passwords.
14. Verify that the current version of antiviral software is installed on the server and
that upgrades regularly downloaded to workstations.
15. Select a sample of security violation cases and evaluate their disposition to
assess the effectiveness of the security group.

INTERNAL CONTROL CHECKLIST

9. How does the company keep unwanted / unauthorized access out of their
system?
10. What is the company’s policy with regards to the users’ passwords?
11. Are the permitted users’ passwords strong enough to avoid unauthorized
access?
12. Does the company employ an excellent antivirus software?

REFERENCES
7. SASD
8. ASDAS
9. SDASDASD

IT6

Name/s: ARAGON, Althene Nicole G. Schedule: MW 1:00-2:30 PM

Section: M31
 EXER. FT 1: IT AUDIT PROGRAM FOR TEST OF GENERAL CONTROLS

9. IT Organizational Structure Controls

AUDIT OBJECTIVES
10. To verify that access privileges are granted in a manner that is consistent with
the need to separate incompatible functions and is in accordance with the
organization’s policy.
11. To ensure that the organization has an adequate and effective password policy
for contolling access to the operating system.
12. To verify that effective management policies and procedures are in place to
prevent the introduction and spread of destructive programs, including viruses,
worms, back doors, logic bombs, and Trojan horses.
13. To ensure that the established system audit trail is adequate for preventing and
detecting abuses, reconstructing key events that precede system failures, and
planning resource allocation.

POSSIBLE ERRORS + IRREGULARITIES

10. Unauthorized access
11. Virus infection
12. Cybercrime attacks

AUDIT PROCEDURES
16. Review the organization’s policies for separating incompatible functions and
ensure that they promote reasonable security.
17. Review the users’ permitted log-on times.
18. Verify that all users are required to have passwords.
19. Verify that the current version of antiviral software is installed on the server and
that upgrades regularly downloaded to workstations.
20. Select a sample of security violation cases and evaluate their disposition to
assess the effectiveness of the security group.

INTERNAL CONTROL CHECKLIST

13. How does the company keep unwanted / unauthorized access out of their
system?
14. What is the company’s policy with regards to the users’ passwords?
15. Are the permitted users’ passwords strong enough to avoid unauthorized
access?
16. Does the company employ an excellent antivirus software?

REFERENCES
10. SASD
11. ASDAS
12. SDASDASD

IT6

Name/s: ARAGON, Althene Nicole G. Schedule: MW 1:00-2:30 PM

Section: M31
 EXER. FT 1: IT AUDIT PROGRAM FOR TEST OF GENERAL CONTROLS

14. System Development Controls

AUDIT OBJECTIVES
15. To verify that access privileges are granted in a manner that is consistent with
the need to separate incompatible functions and is in accordance with the
organization’s policy.
16. To ensure that the organization has an adequate and effective password policy
for contolling access to the operating system.
17. To verify that effective management policies and procedures are in place to
prevent the introduction and spread of destructive programs, including viruses,
worms, back doors, logic bombs, and Trojan horses.
18. To ensure that the established system audit trail is adequate for preventing and
detecting abuses, reconstructing key events that precede system failures, and
planning resource allocation.

POSSIBLE ERRORS + IRREGULARITIES

13. Unauthorized access
14. Virus infection
15. Cybercrime attacks

AUDIT PROCEDURES
21. Review the organization’s policies for separating incompatible functions and
ensure that they promote reasonable security.
22. Review the users’ permitted log-on times.
23. Verify that all users are required to have passwords.
24. Verify that the current version of antiviral software is installed on the server and
that upgrades regularly downloaded to workstations.
25. Select a sample of security violation cases and evaluate their disposition to
assess the effectiveness of the security group.

INTERNAL CONTROL CHECKLIST

17. How does the company keep unwanted / unauthorized access out of their
system?
18. What is the company’s policy with regards to the users’ passwords?
19. Are the permitted users’ passwords strong enough to avoid unauthorized
access?
20. Does the company employ an excellent antivirus software?

REFERENCES
13. SASD
14. ASDAS
15. SDASDASD

IT6

Name/s: ARAGON, Althene Nicole G. Schedule: MW 1:00-2:30 PM

Section: M31
 EXER. FT 1: IT AUDIT PROGRAM FOR TEST OF GENERAL CONTROLS

19. System Maintenance Controls

AUDIT OBJECTIVES
20. To verify that access privileges are granted in a manner that is consistent with
the need to separate incompatible functions and is in accordance with the
organization’s policy.
21. To ensure that the organization has an adequate and effective password policy
for contolling access to the operating system.
22. To verify that effective management policies and procedures are in place to
prevent the introduction and spread of destructive programs, including viruses,
worms, back doors, logic bombs, and Trojan horses.
23. To ensure that the established system audit trail is adequate for preventing and
detecting abuses, reconstructing key events that precede system failures, and
planning resource allocation.

POSSIBLE ERRORS + IRREGULARITIES

16. Unauthorized access
17. Virus infection
18. Cybercrime attacks

AUDIT PROCEDURES
26. Review the organization’s policies for separating incompatible functions and
ensure that they promote reasonable security.
27. Review the users’ permitted log-on times.
28. Verify that all users are required to have passwords.
29. Verify that the current version of antiviral software is installed on the server and
that upgrades regularly downloaded to workstations.
30. Select a sample of security violation cases and evaluate their disposition to
assess the effectiveness of the security group.

INTERNAL CONTROL CHECKLIST

21. How does the company keep unwanted / unauthorized access out of their
system?
22. What is the company’s policy with regards to the users’ passwords?
23. Are the permitted users’ passwords strong enough to avoid unauthorized
access?
24. Does the company employ an excellent antivirus software?

REFERENCES
16. SASD
17. ASDAS
18. SDASDASD

IT6

Name/s: ARAGON, Althene Nicole G. Schedule: MW 1:00-2:30 PM

Section: M31
 EXER. FT 1: IT AUDIT PROGRAM FOR TEST OF GENERAL CONTROLS

24. Internet and Intranet Controls

AUDIT OBJECTIVES
25. To verify that access privileges are granted in a manner that is consistent with
the need to separate incompatible functions and is in accordance with the
organization’s policy.
26. To ensure that the organization has an adequate and effective password policy
for contolling access to the operating system.
27. To verify that effective management policies and procedures are in place to
prevent the introduction and spread of destructive programs, including viruses,
worms, back doors, logic bombs, and Trojan horses.
28. To ensure that the established system audit trail is adequate for preventing and
detecting abuses, reconstructing key events that precede system failures, and
planning resource allocation.

POSSIBLE ERRORS + IRREGULARITIES

19. Unauthorized access
20. Virus infection
21. Cybercrime attacks

AUDIT PROCEDURES
31. Review the organization’s policies for separating incompatible functions and
ensure that they promote reasonable security.
32. Review the users’ permitted log-on times.
33. Verify that all users are required to have passwords.
34. Verify that the current version of antiviral software is installed on the server and
that upgrades regularly downloaded to workstations.
35. Select a sample of security violation cases and evaluate their disposition to
assess the effectiveness of the security group.

INTERNAL CONTROL CHECKLIST

25. How does the company keep unwanted / unauthorized access out of their
system?
26. What is the company’s policy with regards to the users’ passwords?
27. Are the permitted users’ passwords strong enough to avoid unauthorized
access?
28. Does the company employ an excellent antivirus software?

REFERENCES
19. SASD
20. ASDAS
21. SDASDASD

IT6

Name/s: ARAGON, Althene Nicole G. Schedule: MW 1:00-2:30 PM

Section: M31
 EXER. FT 1: IT AUDIT PROGRAM FOR TEST OF GENERAL CONTROLS

29. Electronic Data Interchange Controls

AUDIT OBJECTIVES
30. To verify that access privileges are granted in a manner that is consistent with
the need to separate incompatible functions and is in accordance with the
organization’s policy.
31. To ensure that the organization has an adequate and effective password policy
for contolling access to the operating system.
32. To verify that effective management policies and procedures are in place to
prevent the introduction and spread of destructive programs, including viruses,
worms, back doors, logic bombs, and Trojan horses.
33. To ensure that the established system audit trail is adequate for preventing and
detecting abuses, reconstructing key events that precede system failures, and
planning resource allocation.

POSSIBLE ERRORS + IRREGULARITIES

22. Unauthorized access
23. Virus infection
24. Cybercrime attacks

AUDIT PROCEDURES
36. Review the organization’s policies for separating incompatible functions and
ensure that they promote reasonable security.
37. Review the users’ permitted log-on times.
38. Verify that all users are required to have passwords.
39. Verify that the current version of antiviral software is installed on the server and
that upgrades regularly downloaded to workstations.
40. Select a sample of security violation cases and evaluate their disposition to
assess the effectiveness of the security group.

INTERNAL CONTROL CHECKLIST

29. How does the company keep unwanted / unauthorized access out of their
system?
30. What is the company’s policy with regards to the users’ passwords?
31. Are the permitted users’ passwords strong enough to avoid unauthorized
access?
32. Does the company employ an excellent antivirus software?

REFERENCES
22. SASD
23. ASDAS
24. SDASDASD

IT6

Name/s: ARAGON, Althene Nicole G. Schedule: MW 1:00-2:30 PM

Section: M31
 EXER. FT 1: IT AUDIT PROGRAM FOR TEST OF GENERAL CONTROLS

34. Computer Controls (Stand-Alone Environment)

AUDIT OBJECTIVES
35. To verify that access privileges are granted in a manner that is consistent with
the need to separate incompatible functions and is in accordance with the
organization’s policy.
36. To ensure that the organization has an adequate and effective password policy
for contolling access to the operating system.
37. To verify that effective management policies and procedures are in place to
prevent the introduction and spread of destructive programs, including viruses,
worms, back doors, logic bombs, and Trojan horses.
38. To ensure that the established system audit trail is adequate for preventing and
detecting abuses, reconstructing key events that precede system failures, and
planning resource allocation.

POSSIBLE ERRORS + IRREGULARITIES

25. Unauthorized access
26. Virus infection
27. Cybercrime attacks

AUDIT PROCEDURES
41. Review the organization’s policies for separating incompatible functions and
ensure that they promote reasonable security.
42. Review the users’ permitted log-on times.
43. Verify that all users are required to have passwords.
44. Verify that the current version of antiviral software is installed on the server and
that upgrades regularly downloaded to workstations.
45. Select a sample of security violation cases and evaluate their disposition to
assess the effectiveness of the security group.

INTERNAL CONTROL CHECKLIST

33. How does the company keep unwanted / unauthorized access out of their
system?
34. What is the company’s policy with regards to the users’ passwords?
35. Are the permitted users’ passwords strong enough to avoid unauthorized
access?
36. Does the company employ an excellent antivirus software?

REFERENCES
25. SASD
26. ASDAS
27. SDASDASD