Economy Informatics, nr.

1-4/2005 15

Research Areas in Data Warehouse Systems’ Audit

Prof. Traian SURCEL, PhD, Lect. Marian STOICA, PhD
Economic Informatics Department, Academy of Economic Studies, Bucharest

The data warehouse is the core of decision support systems. The audit of data warehouse sys-
tems aims to certify the conformity, credibility and superior performance of the system. This pa-
per presents some aspects of data warehouse audit, investigating the following areas: methodo-
logical and architectural problems, data quality, system maintenance, documentation and user
training. The ultimate purpose is to ensure the continuity, efficiency and consolidation of busi-
nesses based on this kind of decision support systems.
Keywords: audit, data warehouse, methodology, change management, architecture, data quality,
maintenance.

Recommendations made by the auditor about

1 Research areas
The general purpose of auditing a data
warehouse system is linked to the evaluation
the methodological aspects will deal with the
necessity of long term goals and, on short
of its daily functioning, of the implementation, term, the existence of a strategy to achieve
maintenance and development processes aim- those goals and a plan to redesign applications
ing to identify directions of consolidation and that modify the original design.
improvement of using it. Standards and best These modifications appear as a result of an
practices direct the audit towards the following “impact analysis” which must be carried out
areas: periodically, every month. This analysis deals
methodology to create the data warehouse; with the impact of using the data warehouse on
change management; the company management and functioning.
system architecture; From a methodological point of view, nothing
data quality; should be forgotten: goals, strategy, impact
maintenance and performance; analysis, change plan (figure 1).
documentation. 3. Changes
For each of these areas, operative auditing Changes are driven by the specific elements of
work must follow these directions: data warehouse design, elements the auditor
analyze the current situation and gather must know and deal with. The following ele-
audit samples; ments stand out:
evaluate conformity with theoretical ap- dynamics of unpredictable requirements,
proaches and best practices; representing those new informational re-
elaborate recommendations. quirements from the beneficiaries, as they
2. Methodology to create a data warehouse realize what can be done with a data ware-
The methodology to create a data warehouse is house;
the first aspect the auditor must analyze. This non-standard informational environment as
requirement is reflected by the presence and opposed to ERP systems that use a rela-
the content of the design project and imple- tively standardized environment;
mentation plan for the data warehouse. cross organizational approach of applica-
Because the data warehouse must integrate tions, which means a series of applications
with the complex informational environment deal with problems that belong to several
of the company, the design of the data ware- departments;
house must be a component of the design of post implementation problems.
the informational system of the company, There must be a change management to coor-
which, in turn, is a component of the Enter- dinate and control their implementation, first
prise Consolidation Plan (EPC). inside the development environment and, after
16 Economy Informatics, nr. 1-4/2005

passing the acceptance test, in the real system. with the best practices, the architecture must
For an efficient coordination of the changes, ensure scalability, integrity and flexibility for
the auditor might recommend and verify a bet- the system. The auditor must analyze two
ter communication and notification through other elements:
support procedures in order to document the refreshment strategy
changes. Small changes may be implemented operational data fund (ODS), created paral-
straight into the real system, but only with a lel to the data warehouse.
close monitoring after implementation. It is a Flexibility means using configurable parame-
fast solution, with a small risk, and it is better ters for the system architecture and the possi-
than the standard procedure mentioned above. bility to add new objects to the warehouse. An
element that leads to increased flexibility is the
START
START use of descriptions instead of codes, which
Preplaning
Preplaning leads to increased performance in creation of
Gathering context information cubes and reports. Using the “always include”
Gathering context information
options in cube creation after upgrading the
Gathering information on client juridical obligations
Gathering information on client juridical obligations data series and daily “clean house” also lead to
Performing preliminary analytical procedures increased flexibility.
Performing preliminary analytical procedures
5. Refreshment strategy
Setting up significance threshold and estimation of
Setting up significance threshold and estimation of
Refreshment strategy is based on refreshment
acceptable audit risk and inherent risk
acceptable audit risk and inherent risk rate. A way to implement the refreshment rate
Understanding internal control and estimating control risk considers the creation date of the record and
Understanding internal control and estimating control risk
the increase of refreshment period with a cer-
Drawing general audit plan and audit program
Drawing general audit plan and audit program tain increment rate. The disadvantage of this
method is that it leads to restoring more re-
Is there
cords than actually modified.
Is there
a plan to decrease
NU Another, more efficient, implementation uses a
a plan to decrease
the control risk?
the control risk? refreshment rate based on the time of the last
modification of a record. To restore older
transactions, a higher incrementation rate of
DA the recording time marking is recommended.
Perform tests on control mechanisms
Perform tests on control mechanisms Indexing increases the performance of loading,
Perform thorough operations tests
Perform thorough operations tests extracting and reporting data, more so on large
Estimate the probability of errors in data quality
data volumes. Refreshment strategy must be
Estimate the probability of errors in data quality
assessed from the point of view of maintaining
Verify the data quality
Verify the data quality and restoring indexes. “Update & insert” tech-
Verify events nique uses existing indexes and is faster, while
Verify events
“delete & append” rebuilds the indexes by
Gather final samples
Gather final samples “drop and rebuild after refresh” technique,
Assess results
Assess results
which consumes more time but yields better
performance when creating cubes.
Write the audit report
Write the audit report ODS is an operational data fund created and
Communication with audit committee and management
Communication with audit committee and management maintained in parallel with the data ware-
house, with the goal of a better response time
STOP
STOP and logging the activity of the data warehouse.
Fig. 1. Sinteza procesului de audit Data loaded into ODS must be verified before
(adaptare după Arens A. şi Loebbecke J.) their confirmation in the data warehouse.
Data warehouse audit must asses the feasibility
4. System architecture of developing an ODS on the same storage en-
Data warehouse architecture is another point vironment as the warehouse it is associated
of interest for the audit. In order to comply with.
Economy Informatics, nr. 1-4/2005 17

6. Data quality software errors.

Data quality is a first target of auditing a Data It is necessary to verify that there are no appli-
Warehouse, focused on evaluation of data cations that keep running after a crash or an er-
verification and error correction. The audit ror. Procedures that solve errors must seek to
must identify automated data quality checks, minimize the error impact on users. A better
complex checks and cross checks. These coordination of data warehouse refreshment
checks must signal erroneous data and return needs a monitoring of the crash rate and suc-
them to the source. The audit must asses the cess rate. An efficient approach is refreshing
checking procedures from the point of view of the data on demand; it also implies delegation
preventing erroneous data from loading into of control to the end user, increasing the effi-
the data warehouse. ciency of the activity.
A useful recommendation is designating a The auditor must identify and evaluate disaster
process owner or supervisor that will answer recovery procedures, which add to the crash
to all problems linked to data quality, both for solving procedures. Basic premise for disaster
input and reports. He will also be responsible recovery is the existence of backup copies.
for the operational procedures in the transac- Copies should be placed on different ma-
tional system. This supports the separation and chines. Fast recovery will answer the need for
delegation of responsibilities during exploita- continuous availability of the system.
tion of the data warehouse. Help Desk designates support for maintaining
7. System maintenance and implementing changes. From a procedural
Data warehouse maintenance is not a linear ac- point of view, help desk includes all actions
tivity; it is more than a suite of technological for identification of ways and means to im-
operations of updating the data and creating prove functioning and development of the data
reports. Auditing this area must look carefully warehouse system. This includes following ac-
into: tions:
monitoring data warehouse system modifi- meetings to find new designs;
cations; interviews;
preventing resource unavailability; research of data and processing rules;
resolving system crashes and recovery of impact analyses;
data in case of disaster; analyzing the functioning of new proce-
help desk system. dures in the new modified context.
Data Warehouse system modifications fall into Help desk is the way to stimulate designers
two categories: modifications forced by real and users to analyze system functioning and
economy and information environment modi- find new ideas to plan the strategy to improve
fications. Real economy modifications are a the functioning of the data warehouse. This
result of data, logical structures change, rules strategy consists of:
for data protection and data violation error. control procedures for data quality and
Informational environment system modifica- data restoring;
tions are both of hardware and software nature, updating the task list and responsibility
but mostly software: patches, performance delegation;
backup systems, new applications etc. reviewing help files and improving com-
Preventing resource unavailability concerns munication and change notification.
reliability of hardware, networks, connectivity 8. Documentation and training
etc. Also, it deals with software resources Documentation and training are the support for
locking, crashes of SQL server, parallel proc- knowledge, operating and data interpretation
esses accessing the same resources. skills transfer. There is a need for a strategy to
Resolving crashes is essential to ensure system create the documentation and plan and organ-
reliability. The auditor must acknowledge that ize the training of users. This strategy must be
once the scheme of logical error is built and part of the general strategy of creating the data
tested, there should be no more hardware and warehouse system.
18 Economy Informatics, nr. 1-4/2005

Specifications for informational demands, de- User satisfaction is analyzed from the point of
sign specifications and term glossaries must be view of achieving goals established at design
complete, dated and constantly updated. time, as well as system functioning. User satis-
Documentation must clearly highlight data ar- faction is reflected by the frequency, nature
chitecture, process architecture and system and structure of additional requirements to the
technical architecture. initial system. All these aspects are found in
We must highlight again the importance of the level of benefits, recording and acknowl-
specifications for coordinating refreshment edging of catching new business opportunities,
processes, complete and correct explanations ensuring continuity and consolidating the
of back step engineering used to capture the business that exploits the data warehouse sys-
last modification, the last updating. tem.
Definitions, economic rules and terms that be-
long to the business community must be in- References
cluded in a glossary that specialists name Arens A., Loebbecke J., Audit. O abordare
“Gognos Glossary and End User Guide”. integrată, Editura ARC, Chişinău 2003
Documentation assessment also evaluates the Champlain Jack, - Auditing Information
existence of information concerning creation Systems, John Wiley & Sons, New Jersey,
and maintaining standards and recommenda- 2003
tions for the best practices implemented in the Ivan I., Noşca G., Capisizu S. - Auditul sis-
audited system. temelor informatice, Editura ASE, Bucur-
Training must differentiate competence and eşti, 2005
responsibility levels of the users. There are International Federation of Accountants, -
three categories: regular users, professional Audit financiar 2000, Standarde de audit,
users, help desk users involved in perfecting Editura Economică, Bucureşti, 2002
the system – extending and diversifying appli- Jacques Renard – Théorie et practique de
cative functionality. l’audit interne, Editions d’Organisation,
Auditing also targets continuous training for Paris, France 2002
the new procedures, which means internal
seminaries, discussions forums to establish the
feed-back needed to stimulate new opinions
about current functioning and future evolution
of the system. This is an additional element
that increases user satisfaction.