Operations and Business Resilience · Topic 2 of 8
Job Scheduling, Interfaces and End-User Computing
Controls over job scheduling and automation, system interfaces and data transfers, and the risks of shadow IT and end-user computing such as spreadsheets.
- 3 min
- Scheduler changes go through change management; access to the scheduler is restricted.
- Reconcile interfaces with record counts and control totals.
- Every interface and automated job needs an owner.
What it is
Job scheduling runs batch and automated production jobs in the right order at the right time. System interfaces move data between systems. Shadow IT is technology used by business units without IT's knowledge or approval, and end-user computing (EUC) covers tools business users build themselves, such as spreadsheets and small databases. All three can quietly move or change critical data outside normal controls.
How it works
Job scheduling and automation
| Control | Purpose |
|---|---|
| Authorized schedule | Only approved jobs run; schedule changes go through change management |
| Restricted access to the scheduler | Prevents unauthorized jobs or changed parameters |
| Job dependencies | Jobs run in the correct sequence |
| Monitoring and alerts | Failed or late jobs are noticed |
| Exception handling and restart procedures | Failures are fixed without data loss or duplicate processing |
| Logs reviewed | Evidence of what ran and any manual intervention |
Automation, including scripts and robotic process automation (RPA), needs the same discipline: owned, documented, change-controlled, and running under accounts with only the access they need.
System interfaces
Interfaces include file transfers, application programming interfaces (APIs), message queues and electronic data interchange (EDI). Risks are data loss, duplication, corruption or interception. Controls include:
- Record counts and control totals compared between sender and receiver.
- Validation of incoming data before it is posted.
- Error and exception queues that someone owns and clears.
- Encryption and authentication for data in transit.
- Inventory of interfaces with owners, so none run unnoticed.
Every interface should have an owner who reconciles it. An interface that failed silently for weeks is a classic scenario.
Shadow IT
Shadow IT includes unapproved cloud services, personal tools and devices used for work. It appears when official IT is slow or does not meet needs. Risks: data outside security controls, no backup, licensing and privacy breaches, and no exit plan. Responses: discover it (for example with network monitoring or a cloud access security broker), assess the risk, bring useful tools under governance, and block or retire the rest.
End-user computing
Spreadsheets and user-built tools often feed financial reports and key decisions. Risks include formula errors, no version control, no access control, no testing and dependence on one person. A good EUC program:
- Inventories EUC tools and ranks them by criticality.
- Applies controls in proportion: access protection, version control, input checks, review of logic, backups.
- Moves the most critical tools into controlled applications over time.
If a spreadsheet drives financial reporting, the auditor treats it like an application: test its logic, check access and change control, and confirm its inputs reconcile to the source.
How the exam asks about this
- "An interface has been dropping records." Add reconciliation of record counts and control totals with an owner who reviews exceptions.
- "Business units use an unapproved cloud file service." Assess the risk and bring it under governance, rather than ignoring or simply blocking without understanding the need.
- "A critical spreadsheet has no change control." Put it in an EUC inventory and apply controls in proportion to its risk.
What to remember for the exam
- Scheduler changes go through change management; access to the scheduler is restricted.
- Reconcile interfaces with record counts and control totals.
- Every interface and automated job needs an owner.
- Shadow IT: discover, assess, then govern or retire.
- Control EUC tools in proportion to their criticality.
Rerunning a failed batch job without checking what already posted can process transactions twice.
Common mistakes
Assuming an interface works because no one has complained.
Banning shadow IT without understanding why it exists. Users will find another workaround.
Ignoring spreadsheets because they are not systems.
Check yourself
Which control detects records lost in an interface?
Reconciling record counts and control totals between the sending and receiving systems.
What is the first step in managing end-user computing risk?
Building an inventory of EUC tools and ranking them by criticality.
Why should access to the job scheduler be restricted?
To prevent unauthorized jobs or parameter changes that could alter production processing.
Topic 2 of 8 in Operations and Business Resilience
Test yourself on Operations and Business Resilience
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.