End-User Computing Applications

Implications for Internal Auditors and Managers

Mary Callahan Hill, PhD, CPA, and W. Alan Barnes, CPA, CIA

Businesses today rely on the work being done by staff using personal computers. The proliferation of personal computers has led to widespread implementation of end-user computing applications. As their name implies, end-user applications are designed, implemented, and controlled by users rather than by IT professionals. End-user applications can be risky for organizations, both with respect to management decision making and to financial reporting. For public companies, the risk involved in these applications has been increased by the requirements of the Sarbanes-Oxley Act of 2002 (SOX), which call for management to document end-to-end financial operations and internal control structures. Following is a review of the reasons for the prevalence of end-user applications and their inherent problems, as well as strategies for the internal control of these applications for various-sized businesses.