Publier un mémoire Consulter les autres mémoires

Rechercher sur le site:

2.2.4 Techniques of audit

During unfolding of the mission and during the phase of planning and the production run, the listener must accumulate a detailed knowledge of the data-processing environment and carry out an evaluation of the system of internal audit of the processes of the company.

For that, the Listener bases himself on suitable techniques of audit and evaluation.

The listener proceeds by stage. It is interested in the review of documentation of the company, then it organizes talks targeted with the personnel of the company and finally he carries out the tests necessary while basing himself on sampling.

· With regard to documentation, the listener asks the data-processing direction to provide him :

- Internal procedures of controls;

- The directing diagram and data-processing budget : a description of the information policy (current and future) of the company ;

- Flow charts and descriptions of the functions of the personnel (Job descriptions) ;

- Contracts of acquisition of services and computer equipement ;

- Maintenance contracts of the acquired applications ;

- The document laying down the policy of safety company;

- The procedures which define the processes of exploitation of the company.

· The data-processing listener is then interested to organize meetings with the personnel of the company.

He focuses his talks, in the first time, on the data-processing management staff. The listener accumulates the maximum of information on which it will rest for the comprehension of the information system and especially for the identification of the faults and the weaknesses of the system.

The talks are established, after, with the general management staff, other directions until arriving to the simple users of the system.

The listener brings closer the information extracted the documents with those resulting from the discussions with the personnel from the company.

Any information whatever its origin can be useful for the listener during his mission of audit and evaluation.

· The third technique of audit is that of sampling or test. The listener chooses the sample starting from a homogeneous series of data while supposing that the sample is representative of the population. From the study of the characteristics of the sample, a generalization can be made about qualities of the whole population.

The fields to be tested are the seized data, the rejected data, the data-processing treatments and the access security to the system.

For example, to evaluate the access security of the users, the listener must ask for the list of the user profiles and check the respect of the rights of access which theirs is granted.