Auditing in a Computerized

Environment
Chapter 7
Characteristics of Computer Information
Systems (CIS)
• Lack of visible transaction trails
• Consistency of Performance
• Ease of Access to Data and Computer Programs
• Concentration of duties
• Systems generated transactions
• Vulnerability of data and program storage media
Internal Control in a CIS Environment
• General Controls
• Organizational controls
• Segregation between the CIS department and user departments
• Segregation of duties within the CIS department
• CIS Director exercises control over the CIS operation.
• Systems Analyst designs new systems, evaluates and improves existing systems, and prepares
specifications for programmers.
• Programmer guided by the specifications of the systems analyst, the programmer writes a
program, tests and debugs such programs, and prepares the computer operating instructions.
• Computer Operator operates the computer to process transactions.
• Data Entry Operator prepares and verifies input data for processing.
• Librarian maintains custody of systems documentation, programs and files.
 • Control Group reviews all input procedures, monitors computer processing, follows-up data
processing errors, reviews the reasonableness of output, and distributes output to authorized
personnel.
• Systems development and documentation controls
• Access Controls
• Data recovery controls
• Monitoring controls
• Application Controls
• Controls over input
• Key verification
• Field check
• Validity check
 • Self-checking digit
• Limit check
• Control totals
• Controls over processing
• Controls over output
Test of Control in a CIS Environment
• Audit around the computer
• Use Computer-Assisted Audit Techniques (CAATs)
• Test data
• Integrated test facility (ITF)
• Parallel simulation
• Other CAATs
• Snapshots
• Systems control audit review files (SCARF)