The question refers to an internal auditor evaluating IT controls and suggesting an improvement in the process where results are compared against the input. This indicates a focus on verifying the accuracy, completeness, and validity of processed data, which falls under processing controls.
Definition of IT Controls Categories:
Input Controls: Ensure data accuracy before processing but do not compare input to results.
Processing Controls: Ensure that data is processed correctly and that the output matches the expected results.
Output Controls: Verify the accuracy of the final output but do not directly compare results against input.
Integrity Controls: Ensure data integrity across systems but do not specifically focus on input-output validation.
Why Processing Controls?
Processing controls are designed to detect and correct errors during data processing.
According to the IIA’s Global Technology Audit Guide (GTAG) on Information Technology Risks, processing controls ensure data consistency, accuracy, and completeness by validating input data against expected output.
Examples of processing controls include:
Reconciliation controls (comparing input and output).
Validation and verification checks (ensuring correct processing logic).
Why Not Other Options?
A. Output Controls: Focus on final reports and user access, not comparing input with output.
B. Input Controls: Ensure valid data entry but do not verify processing results.
D. Integrity Controls: Protect data consistency but do not specifically involve input-output reconciliation.
IIA GTAG – Information Technology Risks and Controls
IIA Standard 2110 – IT Governance and Risk Management
COBIT 2019 – Control Objectives for Information and Related Technologies
Step-by-Step Justification:IIA References:Thus, the correct and verified answer is C. Processing controls.
