1. Systems Development Audit

2. Principles  To check that they system is producing the expected results  Ensure that the appropriate controls are operating correctly

3. Audit of computer system development  Internal control and audit requirements fall into 2 categories: 1.Ensuring that the development takes place within an approved structure and under management control 2.Ensuring that the systems once developed are suitable and controllable.

4. Features of systems development audits  Ensure that the project is led by a senior operational manager with adequate understanding of IT  Ensure a project team representing all concerned at senior level.  Insist that suppliers and contractors are reputable, financially sound and that the contract is sound  Ensure that the progress of the project is monitored and reviewed by management  Ensure that the project is justified on financial grounds and that all concerned understand the objectives of the project.

5. Objectives of a systems development audit  To ensure that predetermined standards for development are satisfactory and have been observed.  Reviewing the controls that are being built into the new system to ensure that the new system is: –Reliable and secure –Easily auditable

6. Principles of auditing a new computer system  First priority is understanding the system and its workings, and being able to confirm that the system in use is the system documented.  The next is to ascertain how the system can be tested. A simple approach is the use of test packs.  Other approached include reviewing how system management and database management staff make their own checks on the system operation  Security needs to be reviewed. Networks require the security of effective password control, including regular changing of passwords and control of password security for system access and a DBMS limiting access to certain parts of the data.  Data may have to be encrypted.

7. Principles of auditing a new computer system  Access of terminals to other computer systems needs to be controlled  Some check must be made on the accuracy of information generated by the system.  Message acknowledgement/confirmation systems.  Back up of some form is the first step towards system security and preventing disaster. Back up may be in the form of an overnight back up and a log of the days transactions  Recovery procedures will need to cover central processor, terminal and line failure.