Question 3
What are Auditing Application Controls?
Application controls ensure that only valid data enters a system through input control, that
calculations yield only valid results, and that output data is valid.
An IS auditor’s tasks include the following:
Identifying the significant application components and the flow of transactions through the
system, following the transactions from end to end. Considering whether any data flow
diagrams or flowcharts exist that describe data flow in the transaction, and whether such
diagrams or flowcharts correctly identify the flow of data. Also check whether any data
items in transactions were altered in the data flow and logs are maintained.
Identifying the application control strengths and evaluating the impact of the control
weaknesses to develop a testing strategy by analyzing the accumulated information. Data
integrity testing should be performed, which confirms whether an application properly
accepts, processes, and stores information in online processing systems. OLTP systems
have the ability to process transactions for many users simultaneously. Checking
referential integrity in database along with atomicity, which assures a transaction is
completed fully or aborted. Additional checks such as, consistency that guarantees a stable
condition before and after executing a transaction; isolation, when one transaction isn’t
affected by other transaction; durability tests if the committed transactions remain
permanent, are also tested in OLTP environment.
Techniques available for auditing IT applications are, transaction tracing, test batches,
software mapping, base lining, and parallel testing.
Reviewing application system documentation to provide an understanding of the
functionality of the application considering the operational aspects of the application to
ensure its efficiency and effectiveness.
Continuous auditing permits the IS auditor to conduct audits of an online environment in a
way that is less disruptive on business operations. The technologies available are audit
hooks, SCARF/EAM, ITF, CIS, snapshots, online inquiry.
Question 6
What should an IS auditor should perform for Post implementation Review?
Auditing Post implementation Review is part of SDLC Audit. The IS auditor should audit
all post-implementation activities, considering whether
• Any post-implementation review took place and, if so, whether the review was
documented and actions taken
• The application supports the entire body of requirements established during the project /
Determine if the system’s objectives and requirements were achieved
• The application is being measured to verify whether it is meeting established
performance and ROI targets / Determine if the cost benefits identified in the feasibility
study are being measured, analyzed and accurately reported to management
• Excessive changes were made to the system after implementation, which could be an
