Testing Access Controls.Access control is at the heart of accounting information integrity. In the absence of controls, invoices can be deleted, added, or falsified. Individual account balances can be erased, or the entire AR file can be destroyed. Evidence gathered about the effectiveness of access controls tests the management assertion of existence,completeness, accuracy, valuation and allocation, right and obligations, and presentation and disclosure.
Computer access controls are both system-wide and application-specific. Access control over revenue cycle applications depends on effectively controlling access to the operating systems, the networks, and the databases with which they interact. The control techniques discussed in previous chapters—including passwords, data encryption, firewalls, and user views—apply also in preventing unauthorized access to revenue cycle processes. The auditors will typically test these controls as part of their review of general controls.