EDP Auditing What is EDP Auditing?
Richard Baskerville
Georgia State University
Georgia State
University
EDP Auditing
EDP auditing is the process of collecting and
evaluating evidence to determine whether a
computer system safeguards assets,
maintains data integrity, achieves
organizational goals effectively, and consumes
resources efficiently. [Weber, 1989, p. 8-9].
EDP auditing
P supports the attainment of traditional audit
objectives:
< attest objectives (those of the external auditor)
that have asset safeguarding and data integrity as
their focus
< management objectives (those of the internal
auditor) that encompass not only attest objectives
but also effectiveness and efficiency objectives
P a force that helps organizations to better
attain these objectives
 The Changing Intersection of IS Security and EDP
Auditing
What is the relationship
between EDP Auditing and
Audited IS
IS Security? Auditing
Activities

Security MIS

The Changing Intersection of IS Security and EDP The Changing Intersection of IS Security and EDP
Auditing Auditing

Audited IS Audited IS
Activities Activities

Auditing Auditing

Security MIS Security MIS

 EDP Auditing Communities, Controls & Related
IS Security Issues
Users What is the distinction
EDP Auditor Application IS Security
between an “implosive” and
Controls Safeguards
an “explosive” audit trail?
Developers
IS Security
Methods

Development
IS Management Controls

IS Security
Management Program
Controls

The Audit Trail Concept EDP Auditing Framework

Transaction
Data Audit
Item Trail Stored
Data
Transaction Item
Data
Item Stored
Data Stored EDP Audit Areas
Trans action Data
Item
Data Item
Item Stored
Transaction
Data IS Management IT Applications
Item Stored
Data
Item Data
Item
Trans action
Stored
Data
Explosive Audit Trail
Data Item Acquisition User Driven Input Output
Item Stored Controls Computing Controls Controls
Data Controls
Item Transaction
Data Audit
Item Trail Stored Processing
Implosive Audit Trail Transaction
Data
Item
General Controls Controls
Data
Item Stored IS Development IT Systems
Data Stored
Transaction
Item Data Controls
Data Item
Item Stored
Data
Transaction Systems Network
Item Stored
Data
Item Data Controls Controls
Stored Item
Transaction Data
Data Item Database
Item Stored Controls
Data
Item
 Computer Auditing Tools

Generalized
What special IT tools do Audit Software
Expert
Systems
auditors require? Random
Number Fourth
Generators Generation
Languages

Modelling
Packages
Statistical
Analysis
Packages
Flowcharting
and CASE
tools Database
Sort, copy Packages
utilities, etc.

EDP Audit Techniques EDP Audit Process

Audit Target Data Usage Software Usage

Evidence Collection
Technique Data Soft- Production Test Production Audit
ware
Interrogation ! ! !
Embedded ! ! ! ! !
audit
Parallel ! ! !
simulation
Test data ! ! ! !
Program ! !
comparison
Evalutaion
Code analysis ! !
Opinion Formulation
 EDP Auditing Steps
P Initial review
< a preliminary investigation by the EDP auditors to
determine how the audit should be conducted.
P Controls review
< detailed controls are appraised in both their
necessity and their presence.
P Compliance testing
< determining whether the controls actually exist
and function as specified in the documentation
P Substantive testing
< determining whether the system data actually
represent reality