Topics in this domain
- Project Roles and Governance
- PMBOK Phases
- Gantt, PERT, Critical Path
- Function Point Analysis
- Earned Value and Project Risk
- Business Case and Feasibility
- Benefits Realization
- SDLC Phases Overview
- Requirements Definition
- System Design
- Waterfall vs. Iterative vs. Prototyping
- Agile
- DevOps and DevSecOps
- RAD, CASE, Low-Code
- Build, Coding Standards, Code Review
- Testing Levels: Unit, Integration, System, UAT
- Regression, Sociability, Parallel, Pilot Testing
- Defect Management
- Data Migration and Conversion
- Change-Over: Parallel, Phased, Abrupt
- Go-Live Readiness and Acceptance
- Post-Implementation Review
- Input Controls
- Processing Controls
- Output Controls
- Data Integrity and ACID
- EDI and E-Commerce Controls
Output Controls
The last checkpoint
Before a dish leaves a restaurant kitchen, the head chef checks it: right order, right table, looks right. Once it’s in front of the customer, it’s too late to fix.
Output controls are that final check. Whatever a system produces (reports, files, interfaces, documents, payments) must be:
- complete and accurate
- delivered only to authorised recipients
- on time
- protected, kept for the right time, and disposed of securely
| Control | What it involves |
|---|---|
| Balancing and reconciling | Output totals reconciled to input and processing totals |
| Report accuracy and timeliness | Output checked against control totals and produced on schedule |
| Report distribution | Distribution lists approved by owners; secure printing or electronic delivery; sensitive reports labelled |
| Sensitive and negotiable forms | Pre-numbered forms (cheques, share certificates) logged, locked away and issued in recorded ranges |
| System-generated negotiable instruments | Signatures and amounts applied by the system under control; signature files protected |
| Output error handling | Errors in output reported, investigated and corrected |
| Retention | Kept as policy and law require; disposed of securely (shredding, secure deletion) |
| Verification of receipt | Recipients confirm they received critical reports or files |
Getting it to the right people
Sensitive output should reach only the people entitled to see it. Distribution lists are approved by the data owner, and printing or delivery is secure. A payroll report sent to an open shared printer, with no badge or PIN release, is an output control weakness.
Cheques are nearly cash
Blank cheque stock and similar forms are almost as valuable as money, so every single form must be accounted for.
- Pre-numbered forms are recorded in an inventory log when they arrive.
- They’re kept in locked storage with restricted access.
- The range issued for each print run is recorded.
- After the run: printed + voided + spoiled + returned unused = issued.
- Spoiled and voided forms are kept or destroyed under control, never just thrown away.
- Someone independent of printing reviews the reconciliation.
Example. An auditor counts blank cheque stock and finds 50 forms missing from the sequence. The print log shows a run that was “cancelled due to printer jam”, but the spoiled forms were thrown away rather than logged. Without them, there’s no evidence they weren’t used fraudulently.
User review
People who receive output should check it looks reasonable and report errors. It’s a detective control, and it only works if users know what to expect.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Best control over blank cheque stock | Logged inventory, secure storage and reconciliation of forms used |
| Control making sure reports reach only authorised users | Defined distribution lists and secure delivery |
| How to verify output completeness | Reconcile output totals to input and processing totals |
| Spoiled negotiable forms | Account for them in the reconciliation; destroy under control |
In short
- Output controls make sure output is complete, accurate and delivered only to authorised recipients in a timely way.
- Negotiable instruments and sensitive forms (cheques, certificates) need logging, secure storage and reconciliation of forms used.
- Report distribution follows defined lists; sensitive reports go only to authorised people.
- Output is balanced and reconciled to input and processing totals.
- Users should review output for reasonableness and report errors.
- Retention of output follows policy and legal requirements; disposal must be secure.
Exam traps
- Blank cheque stock needs inventory control: logged, secured, and reconciled to cheques printed, voided and spoiled.
- Printing sensitive reports to a shared printer without secure release is an output control weakness.
- Output should be reconciled to control totals, not just glanced at.
- Spoiled or voided negotiable forms must be accounted for, not just thrown away.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The last checkpoint
Before a restaurant dish leaves the kitchen, the head chef checks it: right order, right table, looks right. Once it's in front of the customer, it's too late.
Output controls are that final check. Reports, files, payments and documents must be complete, accurate, on time, and reach only the people meant to see them.
Cheques are nearly cash