1. Batch Processing Application Audit
Application Controls
Batch Processing
Application Audit
Most of this information is taken from Chapter 3 of the CISA Review Manual: Sections 3.13 Application Controls and 3.14 Auditing Application Controls. Source:  CISA® Review Manual ©2010, ISACA. All rights reserved. Used by permission

2. Acknowledgments Material is sourced from:
CISA® Review Manual 2011, ©2010, ISACA. All rights reserved. Used by permission.
CISM® Review Manual 2012, ©2011, ISACA. All rights reserved. Used by permission.
Author: Susan J Lincke, PhD
Univ. of Wisconsin-Parkside
Contributors: Todd Burri, Megan Reid, Kahili Cheng
Funded by National Science Foundation (NSF) Course, Curriculum and Laboratory Improvement (CCLI) grant : Information Security: Audit, Case Study, and Service Learning.
Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and/or source(s) and do not necessarily reflect the views of the National Science Foundation.
Material is taken from CISA Chapter 3, section 3.13.

3. Objectives Students should be able to:
Define and describe batch control, validation, batch balance, reconciliation, standing data, exception report, audit trail, system control parameters
Define checks: sequence, limit or range, validity check or table lookup, existence, key verification, check digit, completeness, duplicate, consistency of logical relationship
Define and understand testing application techniques: test data, snapshot, integrated testing facilities, parallel operation, parallel simulation, transaction selection program
Define online auditing techniques: audit hooks, system control audit review file and embedded audit modules (SCARF/EAM)

4. Security in Software Development
Requirements
Requirements
Risk
Analysis
Architecture
& Design
Abuse
Cases
Code
Review
External
Review
Code
Adapted from book: “Software Security: Building Security In” by Gary McGraw, Addison-Wesley, 2006
Source:  CISM® Review Manual 2009, ©2008, ISACA. All rights reserved. Used by permission.
As the picture shows, security requirements should be thought out and included in the earliest stage, and should also be part of the test plan.
Risk-Based
Security Test
Penetration
Test
Test
Security
Operation
Deploy

5. Input Form Make form easy to read and use Group like fields togetherNo
Sales Order Form
Make form easy to read and use
Group like fields together
Provide predetermined input codes to reduce errors
Provide identifier or cross-reference number
Indicate field sizes
Provide authorization signature if necessary
Date: 11/09/09 Time: 3:24 PM
Product Quantity
_____________ _______
_____________ _______
Salesperson:
Authorization:
Source:  CISA® Review Manual 2009, ©2008, ISACA. All rights reserved. Used by permission.

6. Transaction Validation
Sequence Check: Sequence number use causes out-of-sequence and duplicate numbers to be rejected.
Limit or Range Check: Valid numbers are below or between a maximum value. E.g., checks should not exceed $3,000
Validity Check or Table Lookup: Only certain values are accepted: Sex=M/F.
Reasonableness Check: Values entered are reasonable: A takeout order of 100 pizzas???
Existence Check: Required fields are entered correctly.
Key Verification: Input is double checked via second person OR all digits are entered twice.
Check Digit: A digit may verify the correct entry of other digits.
Completeness Check: Complete input is provided: zeros or spaces are checked for each required letter or digit
Duplicate Check: Duplicate transactions or transactions with duplicate IDs are checked for and rejected.
Consistency or Logical Relationship Check: Data is consistent with other known data: An employee’s birth date must be at least 16 years ago.
Source:  CISA® Review Manual 2009, ©2008, ISACA. All rights reserved. Used by permission.

7. Batch Processing Input is authorized and collected into a batch
Batch controls are automatically calculated and associated
with the batch file.
Validation of the transactions occur. Rejected transactions
are corrected and resubmitted or otherwise handled.
Blue: Transactions; Disk: Batch; Yellow: Processes.
First process calculates batch totals and these are verified by the last process
Processing occurs (e.g., orders, payments, storage to DB)
Processing is complete. Batch balancing occurs through
manual or automatic reconciliation of batch controls.

8. Batch Controls Account# TransType Amount Clerk 01001 054 $54.43 212$ $ $ $
……… $
Batch Control: $
A Batch groups transactions to control processing.
Batch controls can include totals or hashed values.
Totals may include total items, documents, or values.

9. Transaction Authorization
Manual:
Obtain signature from management on batch forms or source documents
Forms or Source Documents record data
Pre-number for control preferably
Automatic:
Online access control via password or terminal identification
Transaction authorization verifies all transactions have been authorized and approved by management. Authorization input ensures only authorized data enters for processing by applications. Its important authorization controls exist throughout the process.
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.

10. Error Handling Alternatives
Reject transaction(s) with errors but process remaining batch
Reject batch with error transactions
Hold the batch in suspense: hold batch until error transactions are fixed
Accept the full batch but flag the error transactions for later correction
Input process needs to verify that only correct data is accepted and errors are recognized and corrected. Errors may be found and corrected in the data conversion process. Errors can be caused from duplications of transactions and data entry. In order for errors to be re-entered into the system, fixed transactions should be resubmitted through the normal process, which entails going through normal data conversions, and then should be verified and authorized again, and reentered into the system (if necessary).
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.

11. Master Data/Balance Data
Data Processing
System
Control
Parameters
Controls processing: e.g., specify
limit maximums
Transaction
File
(for today)
Standing Data
(Permanent Files)
Processing
The Balance Data is an integrity check on the Standing Data.
Exception
Report
Master Data/Balance Data
Reports errors in
transactions
Audit Trail
(or transaction log)
Records running balances and
totals updated by transactions

12. Processing Controls Per-Transaction Basis
Editing: program tests the accuracy, completeness and validity of data
Checks on Calculated Amounts: Calculated values are checked to be reasonable or not exceed maximum
Programmed Control: Software to detect, log, and initiate corrective action for errors
Exception Report: Reports error transactions with their error types
Per-Batch Basis
Batch Register: Batch totals are recorded manually to be compared with system totals
Run-to-Run Totals: Each processing stage reports its calculated batch controls
Reconciliation: Supervisor should review that *all* data was properly recorded and processed
A Batch Register (manual check) is optional, but should be used if manual processes occur.
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.

13. Data File Control Procedures
Prerecorded Input: Certain information fields are preprinted on a blank input form to reduce input errors.
Data File Security: Ensures authorized access only
Version usage: The correct version of a file is always accessed
Transaction Logs: An audit trail records date/time of input, user ID and terminal location, and input transactions
Before and After Image Reporting: File data is recorded before and after processing, enabling traces to occur based on transactions
Parity Checking: When data is transmitted, check codes are added to ensure data is transmitted without error.
Batch Processing
Error reporting & handing: All error reports are properly reconciled and authorizations/corrections are submitted in a timely manner.
One-for-One Checking: Source Documents correctly describe the processing that has occurred
Source document retention: Source documents are retained as necessary for error handling and audits.
Internal & External Labeling: Removable storage media is labeled to ensure correct processing
Data File Control Procedures ensure that only authorized processes occurs to store data.
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.

14. Question
A hash total of customer numbers is one input to the sales program. This program generates its own total to compare against this input parameter. What is the purpose of this procedure?
Validate customer numbers are accurate
Detect lost or changed transaction(s)
Detect error(s) in sales transactions
Validate that each sales transaction is complete
Answer: 2. The purpose of the batch controls is to ensure that the batch is not changed during processing.

15. Question Batch balancing is used to?
Ensure that test data accurately matches real data when considering transaction types
Detect lost or changed transaction(s) during processing
Detect error(s) in sales transactions
Verify batch total is reasonable
Answer: 2. The purpose of the batch controls is to ensure that the batch is not changed during processing.

16. Question
Batch totals may not match when error transactions are removed. The process that verifies full processing did occur correctly, while accounting for errors is called:
Audit trail
Validation
Batch balancing
Reconciliation
NEW SLIDE (MEGAN) Answer: 4

17. Application Audit

18. Auditor Tasks
Identify significant application components and flow of transactions
Identify controls and evaluate their effectiveness
Test the controls
Analyze the test results to determine whether controls work as expected

19. Testing Applications: Test Data
Pgm1
Pgm2
Pgm3
Test
Data
In this and the next slides, different methods of auditing applications are shown.
Red indicates test input/data/output. Yellow above are real processes.
Testing Applications:
Advantages : May use actual master file or dummies; source code review is unnecessary; can be used on a surprise basis; provides objective review and verifies program controls and edits; initial use can be limited to specific programs functions minimizing scope and complexity; requires minimal knowledge of the information systems environment.
Disadvantages: Difficult to ensure the proper program is checked; risk of not including all transaction scenarios; requires good knowledge of application systems; does not test master file and master file records.
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.
Processes test data through real programs.

20. Testing Applications: Snapshot
Pgm1
Pgm2
Pgm3
Advantages: Verifies program logic
Disadvantages: Requires extensive knowledge of the information system environment
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.
Displays ‘snapshots’ of how transactions are processed,
as they are processed. Certain transactions are designated
for recording.

21. Integrated Testing Facilities
Real
Data
Pgm1
Pgm2
Pgm3
Test
Data
Blue indicates real (commercial) data
Advantages: Periodic testing does not require separate test process
Disadvantage: Need for careful planning; need to isolate test data results from production data results
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.
Test data and real data are merged. Must be careful to
isolate test results.

22. Parallel Operation or Parallel Simulation
New System or System under Test
Pgm1
Pgm2
Pgm3
Real
Data
Pgm1*
Pgm2*
Pgm3*
Parallel Operation:
Advantages: Verifies new system before disconnecting the old one
Disadvantages: Added processing cost
Parallel Simulation:
Advantages: Eliminates need to prepare test data
Disadvantages: Simulation programs must be developed
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.
Stable System or Simulated System
Data is processed through two systems and results are compared.
Useful to verify new system.
Parallel Operation: Compare new system with older stable system
Parallel Simulation: Compare actual and simulated system

23. Transaction Selection Program
Pgm1
Pgm2
Pgm3
Test
Data
Here the TSP is taking a sampling of the actual database.
Advantages: Independent of production system; transactions controlled by the auditor; requires no modification to production system
Disadvantages: Cost of development and maintenance
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.
A tool helps to select transactions to build a test deck..

24. Embedded Audit Data Collection
Regular
Data
Pgm1
Pgm2
Pgm3
Advantages: Provides sampling and productions statistics
Disadvantages: High cost of development and maintenance; auditor independence issues
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.
Embedded Audit Modules (EAM): Audit software is embedded directly
into the application programs to monitor specific types of transactions.
Systems Control Audit Review File (SCARF): Provides statistical information
about the normal input data file, to determine if the file is
sufficiently varied for the auditor.
Sample Audit Review File (SARF): Selects random transactions for analysis.

25. Testing Application Techniques
Test Data:
Test Data: Test transactions go through real programs
Integrated Testing Facilities: Creates test transactions to include with live data
Transaction Selection Programs: Screen and selects transaction input to regular production cycle
Embedded Audit Data: Selects random or statistically-distributed input transactions and generates logs during production
Debugging/Processing:
Mapping: Identifies specific program’s logic that have not been tested
Tracing and tagging: Trace shows trail of instructions executed. Tag places indicators on selected transactions
Snapshot: Records flow of designated transactions through logic paths
Validation Systems:
Base-case system evaluation: Uses test data for testing programs and verifies correct system operations before accepting.
Parallel Simulation: Uses programs that simulate application program logic
Parallel Operation: Compares new and old production data processing systems and compares results
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.

26. Online Auditing Techniques
Systems Control Audit Review File and Embedded Audit Modules (SCARF/EAM): Embedding specific written audit software in organization’s host application system
Snapshots: Pictures of the processes’ path
Audit Hooks: Embedding hooks in applications
Integrated Test Facility (ITF): Dummy entries are set up and include auditor's production file
Continuous & Intermittent Simulation (CIS): Simulates the instructions executed of the application
Some techniques are a repeats from test application techniques, but these techniques are designated for continuous online auditing.
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission.

27. Concurrent Audit Tools
Online Audit Techniques:
SCARF/
EAM
Integrated Test Facilities
Snapshots
Continuous Intermittent Simulation
Audit Hooks
Complexity:
Very High
High
Medium
Low
Useful when:
Regular processing cannot be interrupted
Its not beneficial to use test data
An audit trail is required
Transactions meeting certain criteria need to be examined
Only select transactions or processes need to be examined
Source:  CISA® Review Manual 2011 © 2010, ISACA. All rights reserved. Used by permission. Exhibit 3.33

28. Continuous Online Auditing: Audit Hooks
Regular
Data
Pgm1
Pgm2
Pgm3
Here red indicates that test programs are part of real programs, and test output is printed.
Continuous Online Auditing enables auditors to test the system
without disrupting a company’s regular operation.
Audit hooks are software logic embedded into the application, which
prints error reports of red flags enabling auditors to act to catch
errors early, before they become problems..

29. Question Audit hooks Snapshots Batch processing Parallel operation
Embedded audit modules is associated mostly clearly with:
Audit hooks
Snapshots
Batch processing
Parallel operation
Answer 1

30. Question
This technique provides statistical information about the normal input data file, to determine if the file is sufficiently varied for the auditor.
Test data
Snapshots
Systems Control Audit and Review File
Transaction Selection Program
Answer 3

31. Question Combining real and test data during an audit is known as:
Parallel operation
Integrated testing facilities
Batch processing
Embedded audit modules
Answer 2

32. Match Definitions Duplicate Check Existence Check Reasonableness Check
Sequence number use causes out-of-sequence and duplicate numbers to be rejected.
Valid numbers are below a maximum value.
Values entered are plausible
Required fields are entered correctly.
Input is double checked via second person OR all digits are entered twice.
Transactions with duplicate IDs are checked for and rejected.
Duplicate Check
Existence Check
Reasonableness Check
Limit Check
Key Verification
Sequence Check

33. Match Definitions Duplicate Check Existence Check Reasonableness Check
Sequence number use causes out-of-sequence and duplicate numbers to be rejected.
Valid numbers are below a maximum value.
Values entered are plausible
Required fields are entered correctly.
Input is double checked via second person OR all digits are entered twice.
Transactions with duplicate IDs are checked for and rejected.
Duplicate Check
Existence Check
Reasonableness Check
Limit Check
Key Verification
Sequence Check

34. Reference Slide # Slide Title Source of Information 6
Transaction Validation
CISA: page 225 Exhibit 3.30 7
Batch Processing
CISA: page 223, 224, 393 8
Batch Control
CISA: page 223, 224 9
Transaction Authorization
CISA: page 223 10
Error Handling Alternatives
CISA: page 224 12
Processing Controls
CISA: page 224, 225 13
Data File Control Procedures
CISA: page 225, 226 19
Testing Application: Test Data
CISA: page 229 Exhibit 3.32 20
Testing Application: Snapshot 21
Integrated Testing Facilities
CISA: page 230 Exhibit 3.32 22
Parallel Operation or Parallel Simulation 23
Transaction Selection Program 24
Embedded Audit Data Collection 25
Testing Application Techniques
CISA: page 229, 230 Exhibit 3.32 26
Online Auditing Techniques
CISA: page 230, 231 27
Concurrent Audit Tools
CISA: page 231 Exhibit 3.33 28
Continuous Online Auditing: Audit Hooks