信息系统审计讲lecture 6

Informationsystemsauditing2015YingQianITApplicationControlsObjectivesforITApplicationControlsControlsandpossibletestsforInputtingProcessingOutputtingTechniquesforauditingapplicationcontrolBusinessapplicationsGeneralLedgerInventoryControlSalesManufacturingResourcePlanning(MRP)DistributionRequirementsPlanning(DRP)HumanResourcesPayroll…ApplicationControlCosteffectiveandefficientmeanstomanageriskReliantontheeffectivenessontheITgeneralcontrolenvironmentApproachvariesforcomplexversusplexenvironmentsApplicationControlsObjectivesInputdataisaccurate,complete,authorized,andcorrectDataisprocessedasintendedinanacceptabletimeperiodOutputandstoreddataisaccurateandcompleteArecordismaintainedtotrackdataprocessingfrominputtostoragetooutputBenefitsofApplicationcontrolsReliabilityReduceslikelihoodoferrorsduetomanualinterventionBenchmarkingRelianceonITgeneralcontrolcanleadtoconcludingtheapplicationcontrolsareeffectiveyeartoyearwithoutre-testingTimeandcostsavingsTypicallyapplicationcontrolstakelesstimetotestandonlyrequiretestingonceaslongastheITgeneralcontrolsareeffectiveInputandAccessControlsDatachecksandvalidationAutomatedauthorization,approval,andoverrideAutomatedsegregationofdutiesandaccessrightsPendeditemsDatachecksandvalidationControlsReasonablenessandlimitchecksonfinancialvalues.Formatandrequiredfieldchecks;standardizedinputscreens.Sequencechecks(missingitems)rangechecks,andcheckdigits.Crosschecks(certainpoliciesareonlyvalidwithcertainpremiumtablecodes).Validations(storedtableanddrop-downmenuofvaliditems).PossibleTestsConductasampletestofeachscenario.Observeattemptstoinputincorrectdata.Determinewhocanoverridecontrols.Iftabledriven,determinewhocanchangeeditsandtolerancelevels.Automatedauthorization,approval,andoverrideControlsAuthorizationandapprovalrights(ofexpensesorclaimpaymentsorcreditoveracertainthreshold)areallocatedtousersbasedontheirrolesandtheirneedtousetheapplication.Overridecapability(e.g.,approvalofunusuallylargeclaims)isrestrictedbytheuser’sroleandneedtousetheapplicationbymanagement.PossibleTestsConducttestsbasedonuseraccessrights.Testaccessprivilegesforeachsensitivefunctionortransaction.Reviewaccessrightsthatsetandamendconfigurableapprovalandauthorizationlimits.AutomatedsegregationofdutiesandaccessrightsControlsIndividualswhosetupapprovedvendorscannotinitiatepurchasingtransactions.Individualswhohaveaccesstoclaimsprocessingshouldnotbeabletosetuporamendapolicy.PossibleTestsTestingbasedonuseraccessrights.Reviewofaccesstosetandamendconfigurablerolesormenustructures.PendeditemsControlsAgingreportsshowingnewpolicyitemswithpleteprocessingarerevieweddailyorweeklybysupervisors.Pendingfileswherethereisinsufficientinformationavailabletoprocesstransactions.PossibleTestsReviewagingresultsandevidenceofsupervisorreviewprocedures.Walkthroughasampleofitemstoandfromtheagingreportorpendingfile.FileandDataTransmissionControlsFiletransmissioncontrolsDatatransmissioncontrolsFiletransmissioncontrolsControlsChecksforcompletenessandvalidityofcontent,includingdateandtime,datasize,volumeofrecords,andauthenticationofsource.PossibleTestsObservetransmissionreportsanderrorreports.Observevalidityandcompletenessparametersandsettings.Reviewaccesstosetandamendconfigurableparametersonfiletransfers.DatatransmissioncontrolsControlsApplicationofselectedinputcontrolstovalidatedatareceived(keyfields,reasonableness,etc.).PossibleTestsTestsamplesofeachscenario.Observeattemptstoinputincorrectdata.Determinewhocanoverridecontrols.Iftabledriven,determinewhocanchangeeditsandtolerancelevels.BatchInputtingcontrolBatchInputAuthorizationBatchControlsandBalancingErrorReportingandHandlingBatchIntegrityinOnlineorDatabasesystemsBatchInputAuthorizationSignaturesonbatchformsOnlineaccesscontrolsUniquepasswordsWorkstationidentificationSourcedocumentsBatchControlsandBalancingtotalmonetaryamounttotalitemstotaldocumentshashtotalsmanualtotalsareinagreementwiththecomputertotalsErrorReportingandHandlingWhathappenstoabatchthathasanerror：dowerejectonlythetransaction？dowerejectthewholebatch?doweholdthebatchinsuspensependingcorrection?dowejustprocessthebatchandflagtheerror?InputControlTechniquesTransactionlogReconciliationofdataDocumentationErrorcorrectionproceduresAnticipating;TransmittallogCancellationofsourcedocuments.DataValidationEditsandControlsSequencecheckLimitcheckRangecheckValiditycheckReasonablenesscheckTablelookupsExistencecheckKeyverificationCheckdigitCompletenesscheckDuplicatecheckLogicalRelationshipcheckProcessingControlsAutomatedfileidentificationandvalidationAudittrailsandoverridesDataextraction,filtering,andreportingInterfacebalancingAutomatedfunctionalityandagingDuplicatechecksAutomatedfileidentificationandvalidationControlsFilesforprocessingareavailableandcomplete.PossibleTestsReviewprocessforvalidationandtestoperation.AudittrailsandoverridesControlsAutomatedtrackingofchangesmadetodata,associatingthechangewithaspecificuser.Automatedtrackingandhighlightingofoverridestonormalprocesses.PossibleTestsReviewreportsandevidenceofreviews.Reviewaccesstooverridenormalprocesses.Dataextraction,filtering,andreportingControlsExtractroutineoutputsareassessedforreasonablenessandcompleteness.Automatedallocationoftransactions(forreinsurancepurposes,furtheractuarialprocesses,orfundallocation).Evaluationofdatausedtoperformestimationforfinancialreportingpurposes.PossibleTestsReviewdesignofextractroutineagainstdatafilesused.Reviewsupervisoryassessmentofoutputfromextractroutineforevidenceofregularreviewandchallenges.Reviewsampleofallocationsforappropriateness.Reviewprocesstoassessextracteddataforcompletenessandvalidity.InterfacebalancingControlsAutomatedcheckingofdatareceivedfromfeedersystems(e.g.,payroll,claimsdata,etc.)intodatawarehousesorledgersystems.Automatedcheckingthatbalancesonbothsystemsmatchor,ifnot,anexceptionreportisgeneratedandused.PossibleTestsInspectinterfaceerrorreports.Inspectvalidityandcompletenessparametersandsettings.Reviewaccesstosetandamendconfigurableparametersoninterfaces.Inspectevidenceofmatchreportschecksanderrorfileprocessing.AutomatedfunctionalityandagingControlsFileextractsfromdebtorslistingtoprovidemanagementwithdataonagetransactions.PossibleTestsTestsampleoflistingtransactionstovalidateappropriatenessofagingprocessing.DuplicatechecksControlsComparisonofindividualtransactionstopreviouslyrecordedtransactionstomatchfields.Comparisonofindividualfilestoexpecteddates,times,sizes,etc.PossibleTestsReviewaccesstosetandamendconfigurableparametersonduplicatetransactionsorfiles.Reviewprocessforhandlingrejectedfilesortransactions.ProcessingControlsTechniqueRun-to-runtotalsLimitchecksReasonablenessverificationofcalculatedamountsDatafilecontroltechniqueParitycheckingTransactionlogsVersionUsageFileupdatingandmaintenanceauthorizationOutputControlDidtheinformationdistributedgettotheappropriaterecipient?

Wherewasthesensitivereportprinted?

Wasdistributioncontrolled?Howlongarethesensitivereportsretainedandaretheystoredinaprotectedenvironment?

OutputcontrolGeneralledgerpostingSubledgerpostingGeneralledgerpostingControlsAllindividualandsummarizedtransactionspostingtogeneralledger.PossibleTestsSampleofinputandsubledgersummarytransactionstracedtothegeneralledger.SubledgerpostingControlsAllsuccessfultransactionspostingtosubledger