Business Process - Manual / Administrative Vs. Computer System-Based Internal Controls

Manual / Administrative Vs. Computer System-Based Internal Controls

Internal controls can be built into manual / administrative process steps and / or computer system procedures.

It is advisable to build in as many system controls as possible, since these controls, being automatic, will always be exercised since they are built into the design of the business system software. For instance, an error message preventing an entry of a received raw material quantity exceeding the purchase order quantity by greater than the permissible tolerance percentage will always be displayed and will prevent the system user from entering such a quantity.

However, for various reasons such as practicality, the need to be “flexible” (whatever that may signify), lack of business domain knowledge and experience, difficulties in designing/writing software, cost of software development/modification, the incapability of a computerised system to provide controls, etc., all internal controls otherwise considered to be necessary are often not built into business systems and software.

In such a scenario, the manual, administrative process controls outside the computer system should be clearly documented, enforced and regularly exercised. For instance, while entering data to create a new record in a material system database’s item master table, the only internal control that the system can provide over the item description field is not to allow the user to leave the description blank – in other words, configure item description as a mandatory field. The system obviously cannot alert the user that the description is wrongly spelt, inappropriate, nonsensical, etc.

In the absence of such a system-based internal control, the item creation process must include a suitable administrative control through the detailed checking, by a responsible officer, of all fields entered for the new item, by comparing a print-out taken from the system with the item data entry sheet, and ensuring that any corrections in the item description (and other similar fields where no system control is possible) are promptly carried out.

Last but not least, the introduction of effective manual, administrative controls usually requires an overriding periodic check by a higher authority to ensure that such controls are exercised in the first place.