IT operations controls: job scheduling, interfaces, backups and incident management

• Identify batch jobs and interfaces that feed financial reporting
• Test job monitoring and failure resolution controls
• Evaluate backup and restore controls in proportion to financial reporting risk
• Test incident management for issues that affect financial data

What operations controls protect

AS 2201 names computer operations alongside program changes and access as the general controls that must be effective for benchmarking automated controls. The financial reporting risk is that processing does not happen, happens twice, or happens incompletely, and nobody notices. A nightly interface that posts sales to the ledger is an example: if it fails for two days and is rerun without checks, revenue could be missing or duplicated.

Job scheduling and interfaces

Start by listing the scheduled jobs and interfaces that move or transform financial data for in-scope applications: sales feeds, payroll postings, bank statement imports, depreciation runs, intercompany allocations.

Key controls:

• Changes to the job schedule are authorized (this overlaps with change management).
• Job failures generate an alert or exception report.
• Someone reviews failures and resolves them, with evidence.
• Interfaces include completeness checks (record counts or control totals compared between source and destination).

Testing approach:

1. Obtain the job failure log for the period from the scheduling tool.
2. Select a sample of failures and trace each to resolution: ticket, rerun evidence, and confirmation that the rerun completed without duplicates.
3. For interface reconciliations, inspect a sample of daily or monthly reconciliations of record counts or totals, and follow up differences.
4. Inquire and inspect who can change the job schedule; restrict to authorized operators.

Backups and restores

Backups protect data from loss. For financial reporting, the relevant question is whether the entity could lose financial data in a way that leads to misstatement. Key controls:

• Backups of in-scope databases run on schedule, and failures are followed up.
• Restores are tested periodically to show backups are usable.

Testing approach: inspect the backup schedule and a sample of backup logs, follow up failures, and inspect evidence of at least one restore test. A backup failure without data loss does not misstate anything, so backup controls carry less ICFR risk than access and change controls in most environments. Document your rationale either way.

Incident management

Incidents include processing errors, data corruption, and security events. The control is that incidents affecting financial systems are logged, prioritized, investigated and closed, with root cause addressed.

Testing approach: obtain the incident log for in-scope systems, filter for incidents touching financial data, and inspect a sample for resolution. Read the descriptions; an incident like "duplicate invoices posted on March 14" is not just an IT matter. It is a potential misstatement that needs follow-up in the substantive audit.

Security events

A security incident such as unauthorized access or ransomware may affect the integrity of financial data. Ask management about security incidents during the period and how it determined whether financial data was affected. Coordinate with the audit team on any effect on the financial statements and disclosures.

Cloud and hosted systems

When a service organization hosts the application, job scheduling, backups and incident management usually sit with the provider. The evidence comes from the SOC 1 report, and the client often has complementary user entity controls such as reviewing interface reconciliations. Lessons 11 and 12 cover how to use that report.

Proportion

Operations controls are often less likely to cause material misstatement than access or change controls, but interface completeness is an exception: a broken interface misstates revenue or expenses directly. Spend the time where data moves into the ledger.

Interface failures at Silver Fern Retail