1. Internal Control & EDP “ Man is a tool using animal” –Thomas Carlyle, 1836 “A tool is but an extension of a man’s hand. He that invents a machine augments the power of a man and the well-being of mankind” –H.W. Beecher, 1870 “Men have become the tools of their tools” –H.D. Thoreau, 1854

2. Processing Systems  Batch  On line/real time  Time Sharing  Service Bureaus

3. File Systems  Separate  Integrated Data Base

4. Hardware Configurations  Magnetic Tape  On-line –Retail cash register systems –Telephone catalog ordering –Electronic Data Interchange Purchase orders, invoices, checks ANSI format

5. Hardware Configurations  Distributed Data Processing –Mainframe –Mini –PC  PC’s

6. EDP Controls  General  Application  User

7. General EDP Controls  Organization & Operation Controls –EDP mgr/ Analysts/ Programmers/ Operators  System Development & Documentation –Definition/ Design/ Development/ Testing/ Documentation  Access Controls –Data/ Data base/ operations  Data & Procedural Controls –Network monitoring/ encryption/ protocols

8. Application & User Controls  Input Controls –Computer editing  Processing Controls –labels, echo checks, hash totals  Output Controls –batch totals, error logs  User Controls –Control totals (input & output)

9. Testing EDP Controls  Auditing around the computer  Auditing through the computer

10. Auditing Around the Computer  Compare auditor pre-determined output with the client’s actual output

11. Auditing Through the Computer  Parallel simulation processes client’s actual data through auditor’s program  Test Data processes auditor simulated data through client’s S/W to test controls  Integrated Test Facility appends auditor created “real” files to client’s data base & processes test transactions along with client’s actual transactions. Continuous processing by client’s employees

12. Auditing Through the Computer  Surprise Audits check for use of unauthorized & undocumented programs  Design Phase Auditing involves the auditor in the system’s design to ensure inclusion of appropriate controls