Automated Controls

An automated control is a rule written into a system, so it applies the same way every time. Typical cases are a payment system that blocks a transfer above a person's approval limit, a form that rejects a missing field, or software that refuses to release an invoice until the order and goods receipt match. Because no one has to remember to apply them, they cut down human slips and run at high volume. They also fail in a different way: a wrong setting or a bad change to the software can break the control for every transaction at once. For that reason auditors test the control and also the general controls around the system, such as change management and access. Testers therefore ask two things: does the rule work, and could anyone have altered it unnoticed?

A manufacturer's purchasing system will not release payment unless the purchase order, delivery note and supplier invoice agree within a 2% tolerance. Mismatches go to a queue for review. During an audit, the tester checks the tolerance setting, confirms it was not changed without approval during the year, and tries a few test invoices that should be blocked.