11. AUDIT OF SYSTEMS DEVELOPMENT
a.
Systems Authorization Activities
All systems should be properly authorized to ensure their economic
User Specification Activities
Users need to be actively involved in the systems development process.
User involvement should not be stifled by the technical complexity of the
system. Regardless of the technology involved, the users should create
Technical Design Activities
The technical design activities translate user specifications into a set of
detailed technical specifications for a system that meets the user’s needs.
The scope of these activities includes systems analysis, feasibility analysis,
Internal Audit Participation
To meet the governance-related expectations of management under SOX, an
organization’s internal audit department needs to be independent, objective,
Chapter 1 Page 2
astute in computer technology and possessing a solid grasp of the business
Program Testing
All program modules must be thoroughly tested before they are implemented.
The results of the tests are then compared against predetermined results to
identify programming and logic errors. The auditor should verify that all
User Test and Acceptance Procedures
Prior to system implementation, the individual modules of the system need to
be formally and rigorously tested as a whole. The test team should comprise
of user personnel, systems professionals, and internal auditors. The details of
b.
In meeting the audit objectives the auditor would select a sample of system
Chapter 1 Page 3
The auditors would also examine the audit trail of program changes by
12. PAYROLL APPLICATION CONTROL
a. Five different areas in this payroll application with inadequate controls.
i. The payroll processing system violates the principle of segregation of
duties in several areas as the same individual verifies the time cards,
iii. The payroll checks are not prenumbered nor are they properly stored. As
iv. There is no control over the machine-signing of checks such as control
v. The data processing department appears to have full access to the
Chapter 1 Page 4
b. Two areas in the payroll system in which system controls are satisfactory:
i. The personnel department determines the wage rate and initiates the
13. ANNOUNCING A NEW INFORMATION SYSTEM
The issues to be addressed include the following:
A survey of the current system is essential. The consultants need to
Chapter 1 Page 5
Some of the above facts can be gathered independently through
oThe internal auditor should be involved in the development
The internal auditor must ensure the auditability of the system. Some
The internal auditor is best qualified to determine if the system under
The auditor should be involved in the final system selection to assess
14. PROBLEMS VS SYMPTOMS
Classify each of the following as a problem or a symptom.
a. declining profits—symptom.
b. defective production process—problem.
Possible symptoms
c. low-quality raw materials—problem.
d. shortfall in cash balance—symptom.
Possible problems
e. declining market share—symptom.
Possible problems
f. shortage of employees in the accounts payable department—problem.
g. shortage of raw material due to a drought in the Midwest—problem.
Possible Symptoms
15. SPL RISKS AND CONTROLS
Response:
1) Trade-Off between Efficiency and Control
Control is always in conflict with operational flexibility and efficiency. For these
reasons, systems professionals who must work daily within this environment
2) The risks associated with Orben’s approach are:
The opportunity for program fraud is increased when applications are developed and
tested by the same individual. Also, unfettered access to all programs in the SPL
increases the potential for fraud.
Chapter 1 Page 7
The maintenance approach employed by Orben provides no audit trail of program
changes. Each application change should be documented and the revised program
3) Control to reduce the risk
Orben manufacturing should implement SPL controls that include the following
features:
Audit trail reports that describe the details of all changes to applications
Version numbers that uniquely identify each version of the application and permit a