Control identification and design: input, processing and output application controls

Controls are cheapest and most effective when designed into a system rather than added after go-live. During requirements and design, the project team, with advice from security, risk and audit, should identify the risks in the business process and build in application controls to address them. The auditor can review and advise on what controls are needed, but should not design them, to protect independence when the system is audited later. Application controls aim to ensure that data is complete, accurate, valid, authorized and that processing is timely and traceable.