An internal auditor observed that sales staff are able to modify or cancel an order in the system prior to shipping She wonders whether they can also modify orders after shipping. Which of the following types of controls should she examine?

The auditor is questioning a specific business rule that should be enforced by the sales order software: preventing the modification of an order after it has been shipped. Controls that are automated and embedded within a specific business application to ensure the validity, accuracy, and completeness of transactions based on predefined processing logic are defined as application controls. These controls are integral to the business process itself and operate at the transaction level. The auditor must examine the application's configuration and processing logic to verify if this specific control exists and is effective.

A. Batch controls: These controls are used to ensure the integrity of data processed in groups (batches), not the rules governing a single, real-time transaction's state.
C. General IT controls: These are foundational controls that apply to the overall IT environment (e.g., change management, data center security), not specific business rules within an application.
D. Logical access controls: These controls determine who can access a system or data, whereas the specific issue here is an application control that governs what an authorized user can do based on the transaction's status. ---

1. The Institute of Internal Auditors (IIA), Global Technology Audit Guide (GTAG) 8: Auditing Application Controls, 2nd Edition.

Page 6, Section "Understanding Application Controls": Defines application controls as "controls that are embedded within business processes... designed to prevent or detect unauthorized transactions and to ensure that transactions are complete, accurate, and valid." This directly aligns with the scenario of ensuring an order cannot be modified after a certain point in the business process (shipping).

2. Vaassen, E. H., & Information Systems and Internal Control courseware, Maastricht University.

Chapter 7, "Application Controls": The text distinguishes application controls from general controls, stating, "Application controls are controls that are embedded in the applications... They are aimed at safeguarding the validity, completeness, and accuracy of transaction processing." The example of preventing order modification after shipping is a classic input/processing application control.

3. ISACA, COBIT 2019 Framework: Governance and Management Objectives.

DSS06 – Manage Business Process Controls: This objective area describes designing and implementing controls within business processes. It states, "Controls are embedded into the business processes... This includes defining and implementing application controls." This reference clearly situates the control in question as an application control designed to manage a business process.