Southern New Hampshire University

ACC-675: Control/Audit of Accounting Info System

A study guide to ACC-675 at SNHU, a graduate course on information technology controls and how auditors test the systems that produce financial information.

Updated October 2026 · 5 min read

ACC-675 Control/Audit of Accounting Info System is a graduate course in Southern New Hampshire University's accounting catalog.

Its course description, as it appears in an SNHU syllabus, starts from a professional requirement: auditing and quality control standards adopted by the PCAOB and AICPA expect auditors to have adequate technical training and to understand the role information technology plays in effective internal control over financial information.

The course aims to give auditors the knowledge needed to comply with Section 404 of the Sarbanes-Oxley Act, which requires management to assess, and auditors of larger public companies to attest to, internal control over financial reporting. Check your current syllabus for the exact outcomes.

The central shift is from testing numbers to testing the process that produces them. Many students are comfortable checking a balance but less sure how to evaluate access rights, change management or an automated control. Mapping a process clearly is usually the first hurdle.

Course at a Glance

ItemDetails
UniversitySouthern New Hampshire University (SNHU)
Course codeACC-675
LevelGraduate
Subject areaIT controls and information systems auditing
Key regulationSarbanes-Oxley Act, Section 404
Typical workProcess narratives and flowcharts, control gap analyses, testing plans (confirm in your syllabus)

What ACC-675 Covers

TopicWhat it means in practice
IT and internal controlHow systems support, or undermine, reliable financial reporting
SOX 404Management's assessment and the auditor's attestation on internal control
Documenting processesWriting narratives and drawing flowcharts to find gaps that could cause material weaknesses
General and application controlsAccess, change management and operations versus input, processing and output controls
Testing controlsInquiry, observation, inspection and reperformance

Key Concepts Explained

IT General Controls and Application Controls

IT general controls (ITGCs) cover the environment: who can access systems, how program changes are approved and tested, and how operations such as backups are run. Application controls work inside a specific process, such as a three-way match or a credit limit check. If ITGCs fail, auditors cannot rely on automated application controls.

Deficiency, Significant Deficiency, Material Weakness

A material weakness is a deficiency, or combination of deficiencies, creating a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. Classifying a gap correctly is a frequent assignment.

Example: A flowchart of the purchasing cycle shows the same clerk can create vendors, enter invoices and release payments, and no one reviews the vendor master change report. That is a segregation of duties gap in a high-risk area. If payments are large and there is no compensating control, it may be classified as a material weakness. A fix: split vendor creation from payment release and review vendor changes weekly.

Testing the Process, Not Just the Product

For an automated control, auditors can test it once, if ITGCs over change management are effective, because a computer applies the rule consistently. For a manual control, they test a sample across the period.

Typical Assignments and How to Approach Them

Assignment typeWhat it testsHow to approach it
Narrative and flowchartDocumenting a processShow who does what, in which system, with which document
Control gap analysisSpotting weaknessesLink each gap to a risk and an assertion
Deficiency evaluationJudging severityConsider likelihood, magnitude and compensating controls
Testing planDesigning control testsChoose the method and sample suited to each control

Using COSO to Frame a Controls Review

Most SOX 404 assessments use the COSO internal control framework, which organizes control into five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

Using these components as headings in an ACC-675 paper gives your analysis a recognized structure and helps you avoid missing whole areas, such as monitoring.

IT sits across all five. Access policies and IT governance shape the control environment; IT risks feed the risk assessment; automated controls and IT general controls are control activities; system reports and interfaces carry information; and review of logs and exception reports is monitoring.

When you identify a gap, say which component it belongs to and why it matters for financial reporting.

This approach also helps with severity judgments. A weakness in the control environment, such as management overriding system controls, tends to be more serious than a single failed control activity, because it undermines everything else.

Where Students Get Stuck

Study Tips for ACC-675

How We Help with ACC-675

Send the case, any narratives or flowcharts, the rubric and feedback. A writer with IT audit knowledge can prepare a worked controls analysis, explain severity judgments, or review your flowchart and write-up. Our accounting assignment help guide covers other modules.

GradeEssays is independent of Southern New Hampshire University. Our models are study aids: use them to understand the method, then complete and submit your own work under SNHU's academic integrity policy. Work is written from scratch with free revisions within the scope of your original request.

Get a Clear Model for Your ACC-675 Work

Share the case, flowcharts and feedback. We prepare a worked controls analysis you can study.

Start My ACC-675 Help

Free revisions · Full refund if late · Written from scratch for your order

Frequently Asked Questions

What is ACC-675 about?

Controls over, and auditing of, the information systems that produce financial data, with a focus on what auditors need to comply with SOX Section 404.

What does SOX Section 404 require?

Management must assess internal control over financial reporting, and for larger public companies the external auditor must attest to that control.

What are IT general controls?

Controls over the IT environment, such as access, program change management and computer operations, that support reliable automated processing.

What is a material weakness?

A deficiency, or combination of deficiencies, creating a reasonable possibility that a material misstatement will not be prevented or detected on time.

Which course follows ACC-675?

SNHU's catalog also lists ACC-676 Audit of Accounting Information Systems and ACC-677 Information Systems Assurance and Advising; check your program's sequence.

Can you check my flowchart?

Yes. Send it with the case; we check that it shows the process and controls clearly.