Explain the difference between general IT controls and application controls, with examples.

• A. General controls cover the IT environment (security, access); application controls are built into software (input validation, edit checks, processing accuracy).
• B. Application controls govern the IT environment broadly, while general controls are embedded in software.
• C. They are the same.
• D. General controls only address physical security.

Answer: (A)

The main idea being tested is where each type of control operates and what it protects. General IT controls establish the overall security and reliability of the IT environment—things that apply across many systems—such as who can access systems, how changes to software and infrastructure are approved, how backups and disaster recovery are handled, and the physical security and operation of data centers. Application controls, on the other hand, are built into a specific software application to ensure that the data and processing within that application are correct. They include input validation (checking that data is in the right format and within allowed ranges), edit and reasonableness checks, processing accuracy controls (ensuring calculations are correct), and controls over the generation and distribution of outputs and audit trails.

This is why the described distinction is the best answer: it correctly assigns general controls to the IT environment (security, access) and places application controls inside the software (input validation, edit checks, processing accuracy). The other statements mix up the scope, claim they’re the same, or reduce general controls to physical security only, which doesn’t reflect their broader coverage. Both types are essential, with general controls underpinning the effectiveness of application controls.