Definition
Application controls are controls built into a specific IT application that govern the initiation, recording, processing and reporting of transactions. Examples: input validation, duplicate-invoice checks, automated three-way match, system calculations of depreciation, and role-based approval limits.
Why it matters in an audit or review
An automated application control can be tested efficiently, often with a single test of one instance, if effective ITGCs show it has not changed. That is a real efficiency gain. However, if ITGCs are weak, the auditor cannot assume the control worked all year and has to test it another way. Application controls also determine whether system-generated reports can be used as evidence.
Example
A payables system blocks payment when quantity or price on the invoice differs from the PO by more than 2 percent (illustrative). The auditor tests the control by entering a test invoice outside tolerance in a test environment, or by inspecting the configuration, then relies on ITGCs and change logs to conclude it was unchanged through the year.
Common mistakes
Testing the configuration screen today and assuming it was the same all year without reviewing change logs.
Sources
- AICPA, AU-C Section 315, Appendix on understanding the entity's use of information technology (as amended by SAS No. 145)
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error