Control within Computer Systems

Control Within the Computer Systems

• Control is applied throughout the computer architecture to meet user needs.
• The operating system is a program set that controls the computer's basic functions, with other software running under it.
• Applications conduct business functions and operate under the Operating System, including built-in controls.
• Parameters are user-defined adjustments that modify program operations.
• Run Instructions are instructions for operators in the jobs to be run and how to respond to machine queries.
• Job Control Language (JCL) automates the processes of running jobs.
• Users, operators, programmers, and managers ultimately exercise the human element of control.

People in Computer Systems

• Control is enacted by individuals involved in developing and processing computer systems.
• Operators run computers daily.
• Programmers write applications.
• System designers design application.
• Systems analysts analyze business structures and application.
• Systems programmers manage Operating Systems.
• Database analysts maintain Database Management Systems (DBMS).
• Network analysts ensure network performance and security.
• Management is responsible for planning, organizing, and directing operations.

Batch vs. Online Processing

• Batch Processing involves collecting inputs and entering them in batches, requiring stringent data controls.
• Online Processing involves real-time data capture; however, early systems lacked sufficient controls.

Communication Modes

• Simplex is a one-way communication.
• Half-Duplex is a two-way communication, but only one direction can transmit at a time.
• Duplex involves a simultaneous two-way communication.

Database Management Systems

• A DBMS controls the access to and management of data.
• Access Methods involve the logic for retrieving, inserting, modifying, and deleting data.
• Data Dictionary/Data Directory Systems (DD/DS) are repositories of metadata.
• Data Independence allows users different logical views to access the same data.
• A database is a structured collection of data.
• Database Administration coordinates and controls data-related activities.
• User System Interfaces components request and transform data.

Database Administrator Responsibilities

• Define storage structures and access strategies.
• Coordinate database security and recovery strategies.
• Monitor performance and respond to requirement changes.
• Employ tools like utility programs, reorganization routines, and statistical analysis.

Database Recovery

• Database recovery reinstates databases to a known state while minimizing lost work.
• Checkpoints define stable database states for recovery.
• Roll Back undoes transactions to the last checkpoint.
• Roll Forward replays transactions from logs.
• Back-up Copy Updates restore previous states after failures.
• Compensating Transactions are corrective journal entries.

Auditing Database Migration

• Migrating controls from applications to the database environment improves control opportunities.
• Audit steps include listing record types, identifying key records, ensuring uniqueness, and studying relationships.
• The Data Dictionary/Directory System (DD/DS) aids documentation, cross-referencing, and change control.
• Administration and coordination of database designs, data quality monitoring, and ensuring proper organizational segregation of roles.

Operational Controls

• Auditors ensure controls over unauthorized access, accuracy, recovery, and data protection.
• Security concerns involve hardware theft, sabotage, software corruption, data theft, integrity manipulation, and data loss.
• Risks related to database technology include increasing the cost of error correction and reducing user confidence due to cascading errors.
• Mitigating factors include ensuring consistency, accessibility, enhancing audit quality, and formalizing data resource management.
• Implementing control migration.

Common DBMS Controls

• Uniqueness checking
• Structural/Relational checking
• Format validation
• Declarative edit criteria

Computing Jargon - Hardware

• CPU stands for Central Processing Unit.
• Peripherals are input/output devices.
• Memory includes RAM (volatile), ROM (non-volatile), PROM, and EPROM.
• Types of computers: Mainframe, Mini, Microcomputers.
• LANs (Local Area Networks) and WANs (Wide Area Networks).

Computing Jargon - Communications

• Terminals are remote input/output devices.
• Modems convert digital-to-analog signals.
• Multiplexers combine signals for transmission.
• Cables can be twisted pair, coaxial, or fiber optics.
• Microwave uses wireless high-power signal transmission.

Computing Jargon - Input and Output Devices

• Input Devices: Cards, Paper Tape, Keyboards, Mouse, Scanners, Bar Codes, Voice Input
• Output Devices: Paper, Screens, Magnetic Media, Voice Output

Information Systems Auditing

• It is critical for an organization to effectively manage information and IT.
• Threats like cyberterrorism, as well as dependence on information and related systems requires improved IT management.
• IS Audit is based on management control and its role is evolving to have process owners becoming custodians of internal control.

What is Management?

• Management optimizes corporate resources through planning, organizing, leading, and controlling.
• Management involves continuous improvement and adaptation to changing environments.

Management Process

• Understanding the Organization's Business requires combining theoretical & practical staff interviews.
• Establishing Needs identifies key products/services, customer needs, and key performance areas (KPAs).
• Establishing Performance Objectives sets achievable targets, defines Key Performance Indicators (KPIs), and assesses internal and external risks/threats.
• Deciding Control Strategies determines which risks to manage, transfer, prevent, or detect.
• Implementing and Monitoring Controls requires active management, review for relevance, and adaptation.

Executive Management's Responsibility and Corporate Governance

• Corporate Governance defines relationships among key stakeholders in determining a company's direction and performance.
• Key stakeholders include shareholders, management, the board of directors, and employees.
• Objectives include human satisfaction, efficiency, effectiveness, flexibility, and continuity.

Audit Role

• Auditing includes IS, internal, external, and public sector auditing.
• Internal Auditing evaluates internal control effectiveness.
• External Auditing ensures the fairness of financial statements.
• Public Sector Auditing focuses on management efficiency and service delivery.
• IS Auditing supports all types of auditing.
• Audit activities which include control strategy assessment, control adequacy, unit performance reporting and follow up actions.

Conceptual Foundation

• A structured risk analysis assesses audit risk (incorrect opinion) and business risk (risks to the auditee and third parties).
• The external auditor is responsible to the organization and stakeholders.
• IS auditing ensures financial statement reliability.

Relationship of IS Audit

• IS Auditors may serve as external consultants or independent internal professionals.
• The audit charter defines the relationship and responsibilities between the Chief Executive, IS Audit head, and line managers.
• The audit charter defines the IS Audit function/objectives and establishes reporting lines/authority levels, and also assurance on internal control reliability.

Audit Charter Content

• Includes a formal definition of IS Audit objectives.
• Includes authority/reporting structure and terms of reference detailing IS Audit function's role/objectives.

Attest Service vs. Advisory Services

• Attestation Service is a written communication that provides a conclusion about the reliability of a written assertion by another party
• Attestation Service requirements include written assertions, a written report, and formal measurement criteria.
• Levels of attestation engagements include Examination, Review, and Agreed-upon Procedures.
• Advisory Services are professional services that aim to improve operational efficiency and effectiveness (fraud investigations, system design, SOX compliance assessments).
• Unlawful Services for Public Accounting Firms Providing Attest Services includes bookkeeping and financial information systems design.

Internal Audits

• Defined by the IIA (internal auditing) as an independent appraisal function within an organization to examine and evaluate activities.
• Internal auditors conduct financial audits and operational reviews.

Management Assertions and Audit Objectives

• Auditors determine whether financial statements are fairly presented by testing management assertions.
• Existence or Occurrence ensures assets exist and transactions occurred.
• Completeness ensures all material items are included.
• Rights and Obligations ensures ownership of assets and liabilities.
• Valuation or Allocation ensures assets are valued per GAAP.
• Presentation and Disclosure ensures proper classification and disclosures.

Communicating the Audit Result

• Auditors report findings to stakeholders via audit opinions in financial reports.

Computer Risks and Exposures

• Control ensures organizations can achieve goals reliably.
• Risk is the possibility of adverse consequences.
• The risk management process includes identifying processes/risks, evaluating control adequacy, and determining key controls and their effectiveness.

Types of Risk

• Inherent Risk: Likelihood of loss before considering controls.
• Control Risk: Likelihood that existing controls will fail.
• Audit Risk: Risk that audit fails to detect significant exposures.
• Detection Risk: Risk that auditors fail to detect errors not caught by controls.

Categories of Risk

• Controllable: managed internally
• Uncontrollable: requiring strategic responses
• Influenceable: can be influenced

Audit Evidence

• Auditors must gather evidence to assess internal control effectiveness through physical, testimonial, documentary, and analytical approaches.
• Evidence Characteristics must be sufficient, competent, relevant, and useful.

Audit Planning

• Before an audit, the auditor assesses the client's business and audit planning risk.
• Planning involves reviewing internal controls, identifying key business exposures, and evaluating control effectiveness.
• Evidence-Gathering Techniques use questionnaires, interviews, document reviews, and observations.

Tests of Controls

• Tests of controls purpose is to effectively determine if internal controls are in place and functioning.
• Tests use manual procedures and CAATs (computer assisted audit tools and techniques).
• Auditors assign a control risk level based on the results.

Substantive Testing

• Substantive testing involves verifying financial data accuracy through confirming customer balances and physical verification of cash/inventory.
• Substantive testing uses CAATs to extract and analyze financial data.

Internal Control

• Organizations are legally required to establish and maintain internal control systems.
• Key Legislations include the Foreign Corrupt Practices Act (FCPA) of 1977, Committee of Sponsoring Organizations (COSO) – 1992, and Sarbanes-Oxley Act (SOX) of 2002.
• SOX Key Sections require CEO/CFO certification of internal controls (Section 302) and annual assessment of control effectiveness (Section 404).

Internal Control Objectives

• Safeguard assets.
• Ensure reliable financial reporting.
• Promote operational efficiency.
• Ensure compliance with policies and procedures.

Modifying Principles

• Management Responsibility: Establish and maintain controls.
• Data Processing Methods: Controls apply regardless of processing method.
• Limitations: Every system has errors.
• Reasonable Assurance: Cost-benefit balance of controls.

The PDC Model (Preventive, Detective, Corrective Controls)

• Preventive Controls are blocking errors before occurrence.
• Detective Controls identify and expose errors.
• Corrective Controls fix detected problems.

Internal Controls

• A control is any action taken by management to enhance the likelihood that goals will be achieved.
• Variants include management control, internal control, etc.

Types of Objectives

• Corporate are broad statements of intent.
• Management are detailed methods to achieve corporate goals.
• Internal Control ensures management objectives are planned and executed.

Levels of Control

• Strategic, Tactical, and Operational each require different levels of control.

Internal Control Objectives

• Reliability and Integrity of Information ensures trustworthy data for decision-making.
• Compliance with Policies, Laws, and Regulations prevents legal and regulatory breaches.
• Safeguarding of Assets protects physical and intangible assets.
• Effectiveness and Efficiency of Operations ensures optimal resource utilization.

Elements of Internal Control

• Segregation of Duties prevents unauthorized actions by separating responsibilities.
• Competence and Integrity of People requires skilled and ethical personnel.
• Appropriate Levels of Authority grants permissions based on necessity.
• Accountability uses logs and audit trails for tracking actions.
• Adequate Resources ensures sufficient manpower, finance, and tools.
• Supervision and Review ensures compliance with control measures.

Control Procedures

• General IS Controls covers the environment where computer systems operate.
• Computer Operations Controls ensures smooth day-to-day IT activities.
• Physical Security Controls protects IT infrastructure.
• Logical Security Controls manages data access and security.
• Program Change Controls maintains software integrity.
• Systems Development Controls ensures efficiency in IT system creation.

Control Objectives and Risks

• Common IT Risks: Fraud, business interruption, errors, customer dissatisfaction, poor public image, and inefficient resource utilization.
• General Control Objectives: Ensuring data integrity, strengthening computer security, and maintaining compliance with policies and regulations.

Data and Transaction Control Objectives

• Input: ensure transactions are completely recorded and entered accurately by using pre-numbered documents, validation checks, and authorization controls.
• Processing: ensure all approved transactions are processed once and accurately by using control totals, exception reports, and error logs.
• Output: ensure only authorized personnel receive processed data by using output distribution logs and audit trails.
• Program Control Objectives: ensuring program integrity and preventing unauthorized changes.

Corporate IT Governance

• Governance mechanisms ensure accountability and ethical business practices.
• Involves setting objectives, monitoring performance, and ensuring legal compliance.
• Key IT Governance Factors: legal and regulatory compliance, ethical business conduct, environmental and societal responsibility.
• Computer-Assisted Audit Techniques (CAATs) programs and data are used in audit procedures.

Uses of CAATS

• Tests of details on transactions and balances.
• Analytical procedures to identify inconsistencies.
• General and application control testing.
• Audit sampling and recalculations.
• Factors include the IT knowledge of the audit team, the availability of suitable software and data.

Common IT Governance Factors

• Legal regulatory compliance
• Ethical business conduct
• Environmental and societal responsibility

Risk in Auditing

• Auditing involves an annual risk assessment and planning exercise to determine overall audit coverage.
• Key steps include a preliminary review for understanding and evaluation, etc.
• Auditors identify appropriate control objectives, assess responsibility, and evaluate necessary management, system, or physical controls.

Defining the Audit Universe

• Computer Risk: Probability that an undesirable event leads to a loss.
• Computer Exposure: Potential threat from an undesirable event.
• Vulnerability: Flaw or weakness that can become a risk.
• Impacts of Risks: Loss of sales, revenue, profits, etc.

Computer System Threats

• Users: Errors, fraud, malicious damage.
• Management: Errors, fraud, manipulation of records.
• IS Staff: Errors affecting entire systems, fraud, change control.
• IS Auditors: Errors, fraud, excessive access.
• Others: Errors, fraud, loss of confidentiality.
• External: Hackers, viral attacks, access control.

Risk Management Approaches

• Accepting the risk
• Reducing the risk
• Transferring the risk
• Ignoring risk is NOT an option.
• Risk Assessment Goals: Efficient allocation of IS Audit resources, etc.

Risk Factor Assessment

• Date/results of last audit.
• Change in operations, programs, systems and controls.
• Exposure to potential losses.

Risk-Based Auditing

• Risk-based auditing integrates high-level risk analysis into audit planning.
• Audit activities are divided into Mandatory (legal-regulatory) and Discretionary activities (business-critical).

Common IS Risk Factors

• Monetary values handled within applications
• Data loss and information disclosure

Audit Planning Process

• A structured, well-documented audit plan identifies the criteria against which a successful audit is measured.
• Audit process measures identifying tasks to be performed and task duration assessment.

Elements of an Audit

• Determining Objectives and Scope by establishing objectives in consultation with auditees.
• Understanding Business and Control Objectives by identify key performance areas (KPAs).
• Establishing Performance Objectives by defining Key Performance Indicators (KPIs) and assess internal and external threats affecting performance.
• Audit Classification by testing compliance with designed controls.
• Selecting the Audit Team and assigning team members based on expertise.
• Initial Communication with Auditees to notify auditees before the audit starts.
• Preliminary Audit Program Preparation to establish a detailed list of analytical steps.
• Planning the Audit Report to ensure itis objective and clear to drive improvements.
• Approval for the Audit Approach by the lead auditor.
• Structure of Audit Plan preliminary survey, internal control description and analysis, expanded tests and findings.
• Conduct follow-up reports and audit evaluation.

Types of Audits

• Financial: The accuracy of financial statements.
• Operational: The efficiency and effectiveness of operations.
• General Control : The IT management controls.
• Applications Audits: Live systems, development processes, and security.
• Operating System Audits: The implementation of OS security.
• Physical Access: The protection of corporate assets.
• Logical Access: Proper user access permissions.

Audit Management

• The IS Audit’s mission is to evaluate controls and compliance.
• Staffing Requirements: Based on the complexity/size audit team includes Computer Audit Manager, Application Auditors, Trainee Auditors, Technical Support Specialists and Audit Application Developers.

Integrated IS Auditors vs. Integrated IS Audits

• Integrated Auditors expand traditional auditors' knowledge of IT Systems and use CAATS (Computer-Assisted Audit Techniques).
• Integrated audits assemble multidisciplinary teams with IS and financial auditors.
• Application Audit Tools use CAATs, interviews, questionnaires and risk analyzers
• Specialists conduct performance, security, telecommunications, and strategic IT planning audits.

IS Audit Quality Assurance

• Assured by managers through peer review of work and engaging external reviewers for independent assessments.

Audit Evidence Procedures

• Stay on schedule and budget.
• Assign tasks systematically.
• Control and evaluate.
• Maintain audit quality

Statistical Sampling

• Sampling techniques allow auditors to test a portion of a population to make conclusions about the whole.
• Judgmental Sampling (Non-Statistical): Based on the auditor's professional judgment.
• Statistical Sampling: Uses random selection for representative results.
• Provides accurate information about a population, time and effort savings.
• Sampling Risk: The sample may not represent the entire population.
• Non-Sampling Risk: Errors due to incorrect procedures or failure to recognize misstatements.

Statistical Sampling contd.

• Beta Risk (Over-Reliance on Controls): Auditors mistakenly rely on weak controls.
• Alpha Risk (Under-Reliance on Controls): Auditors incorrectly conclude controls are ineffective.
• Risk of Incorrect Acceptance: Auditors believe a balance is correct when it is misstated.
• Risk of Incorrect Rejection: Auditors believe a balance is misstated when it is correct.

Quantitative Methods

• Include trend analysis.
• Include chi-square tests

Project Scheduling Techniques

• PERT identifies task dependencies
• CPM analyzes normal and accelerated task completion times.
• Gantt charts visualize project timelines and task progress.

Simulations

• Monte Carlo simulations use probability models to estimate outcomes.
• Game Theory analyzes competitive strategies.
• Queuing theory optimizes service point efficiency.

Generalized Audit Software (GAS)

• Examines records
• Performs calculations

Application and Industry-Specific Software

• Standard software for payroll
• Standard Software Industry-specific software for healthcare
• Standard Software Industry-specific software for insurance

Customized Audit Software

• Designed for unique audit tests.
• Requires high IS expertise.

Information Retrieval Software

• Includes report writers, qyery languages and program generators.

Utility Programs

• Perform copy, sort, print, merge, and edit functions.

Online Inquiry and Test Transaction Techniques

• Test Data: Uses a copy of the live system for test transactions.
• Integrated Test Facility (ITF): Creates a dummy entity within the live system.
• Source Code Review: Examines original program code for weaknesses.
• Embedded Audit Modules (SCARFs): Collects real-time audit trail data.
• Parallel Simulation: Runs live data through a simulated program to compare results.