To mitigate the risks occasioned by the features of a computerized information system, the management should design internal controls over the system. These controls are mainly classified into general controls and application controls. 1. General controls. These relate to the environment within which the computer based systems are developed, maintained and operated aimed at providing reasonable assurance that the overall objectives of internal controls are achieved e.g. completeness, accuracy and validity of financial information. The objective of the general controls is to ensure the proper development and implementation of applications and the integrity of program files and information. These controls could either be manual or programmed and are classified into; System development controls Access controls. Computer operations and other controls. 1. System development controls. These relate to controls that must be exercised by the client when developing new systems or modifying existing systems. The controls that can be exercised during systems development can be discussed in the following groupings. Appropriate review testing and approval of new systems. The organization should set up a steering committee composed of senior management and high level representatives of system users who should the development and implementation of the new system. Management should approve specifications of the new system after the steering committee has assessed the user needs. Before the new system is commissioned for use, appropriate testing should be carried out to ensure that both the hardware and the application programs are operating effectively. The testing will provide assurance that the new system is reliable. The information technology manager, user department and the appropriate management level should give appropriate approval of new system before being placed under operation and after reviewing completeness of system documentation and results of its testing. Controls over program changes. Program changes refer to modifications made to existing programs. Changes in the computer system should be subject to strict controls e.g. a written request for an application program changes should be met by user department and authorized by designated manager or committee. Once changes have been made, appropriate testing should be carried out to ensure that the modified system is reliable. The system documentation should then be amended to reflect the changes and appropriate approval obtained for the modified system to start running. User training should also be carried out as appropriate. System documentation. This involves putting together information that supports and explains computer applications. The documentation provides details of capability of the system and how it is operated. System documentation is important in conducting user training and also enables the management to effectively review the system by considering whether appropriate controls have been put in place during system development. Parallel running. Before switching to the new system, the whole system should be tested by running it alongside the old system for a specified period. This is important because it provides user with the opportunity to familiarize themselves with the new system before it is fully implemented and ensures that the new system is reliable and data is correctly carried forward from the old to the new system. 2. Access controls. The success of computerized information systems is largely dependent on the accuracy, validity and credibility of the data processed by the system. Access controls to computer hardware, software and data files is therefore vital. Access controls provide assurance that only authorized individuals use the system and that the usage is for authorized purposes only. Access may be restricted to specified persons, files, functions or computer devices. This can be achieved using both physical and programmed controls. Examples of access controls include; Physical restriction of access to computer facilities to specified persons only e.g. file servers should be maintained in a secure location where access is granted to only specified persons. Controls over computers stored in the user department could be improved by making sure that vital data on programs are not left running when the computer is left unattended. Passwords should be used by all staff when accessing computer facilities. Passwords should be changed regularly and access to password data held in a computer system should be subject to stringent controls. This will ensure that some users do not gain access to other people‘s passwords. In granting user rights within the system, there should be appropriate segregation of duties to ensure that rights granted are not excessive. E.g. a user should not have right to post data and also make amendments on the same data. When designing the user rights, sensitive data and programs should only be accessible to few individuals. In other cases, some files should be designed as ‘read only’ to avoid unauthorized amendments. Programs and data that do not need to be online should be stored in secure locations. A system‘s access log to record all attempts to log in the system should be maintained. This would record name of user, data accessed or entered, time of log in and mode of access. When transmitting data over communication lines, it should be encrypted to make it difficult for persons with access to communication lines from being able to modify the contents. There should be automatic log off i.e. the disconnection of active data terminal to prevent viewing of sensitive data on unattended terminals. 3. Computer operations and other controls. The organization should have a reconstruction or disaster recovery plan that will allow it to regenerate important programs and data files in case of disasters or accidental destructions. The recovery plan should create back up or duplicate copies of important data files and programs which should be stored off site. The recovery plan should also be tested on regular basis to ensure that it indeed works. Other issues that should be addressed include: Undertaking protection measures against natural disasters such as setting up computer rooms in areas protected from floods and fitted with smoke or fire detectors. There should be standby equipment to revert to in case of computer breakdown. There should be adequate virus detection. Procedures for dealing with virus infection are. Establishing a formal