Computer-Based Processing: Developing an Audit Assessment Approach Chapter 6 Computer-Based Processing: Developing an Audit Assessment Approach
Introduction Overview of computerized accounting systems Client/server systems Mass storage Mass communication Software
Client/Server Systems Client portion of the system Risks that come with the client portion of the system
Mass Storage Paperless information systems Risks Advantages
Mass Communication Communications Technology Global Networks
Software Telecommunications Operating systems Application programs Access control software Database management system Financial reporting on the Web
The Virtual Private Network Demands of the “new economy” Firewalls Web server and back-office computing structures
Risks with VPN Unauthorized penetration Loss of messages Interception and either destruction, modification, or copying Denial-of-service attacks Loss of processing
General & Application Controls Pervasive computer controls General controls Application controls
General Control Concepts Planning and controlling data processing Controlling applications development Controlling access Maintaining hardware Controlling electronic communications
Risk Analysis @ General Control Level Unauthorized users. Wrong programs. Telecommunication systems. Processing of wrong data. Unauthorized personnel. Securing of physical computer environment. User errors.
Planning & Controlling the Data Processing Function Segregation of duties within data Processing. Adequate Documentation--A Key Control.
Controlling Applications Development & Program Changes
Controlling Access to Equipment, Data, & Programs Access controls Authentication Security and Backup Hardware controls Telecommunication controls Data transmission
Application Control Procedures Approaches to Processing Transactions Batch processing applications Online processing Database Management Systems
Application Control Procedures Audit trail provisions Input control procedures Input & validation control procedures Batch control procedures Self-checking digits Stored data references On-screen input verification
Control Risk Assessment Process Understanding the control structure Testing the effectiveness of procedures documenting evidence of controls monitoring controls testing controls
Electronic Data Interchange and Electronic Commerce EDI •Value-added network (VAN) •Economic interdependence •Total systems dependence •Risks and control considerations •Application controls