An Introduction to

Computer Auditing

Barclay Simpson
Recruitment Consultants
 Index
1. INTRODUCTION
1.1 Purpose 2
1.2 Definition 2
1.3 Origins of Computer Audit 2
1.4 Change 2
1.5 Nature of Computer Audit 3
1.6 Computer Auditors 3
1.7 Scope 4

2. SYSTEMS UNDER DEVELOPMENT

2.1 Background 5
2.2 Development of New IT Applications 5

An Introduction to Computer Auditing

2.3 IT Application Controls 7

3. LIVE APPLICATIONS
3.1 Background 10
3.2 Application Controls 10
3.3 General IT Infrastructure Controls 10

4. IT INFRASTRUCTURE
4.1 Background 12
4.2 IT Environment 12
4.3 Infrastructure Areas 12
4.3.1 Physical Security 12
4.3.2 Contingency Planning 13
4.3.3 Logical Access Controls 14
4.3.4 Change Control 15
4.3.5 Operating Systems 16
4.3.6 Telecommunications 16
4.3.7 Cryptography 17
4.3.8 Computer Operations 17
4.3.9 Databases 18
4.3.10 Storage Media 18

5. AUDIT AUTOMATION
5.1 Background 19
5.2 Audit Tools 19
5.3 Administration Tools 19

GLOSSARY OF TERMS 20

B A R C L AY S I M P S O N 1
1. Introduction
1.1 Purpose organisations operating in the same sector may have
The aim of these notes is to give potential computer different approaches to computer audit. Even where
auditors an overview of the main activities of there appears to be commonality in the scope of
computer audit and the role of the computer auditor. audit areas, there can be significant variations in the
They have been written to assist candidates who are depth of auditing undertaken. An audit of an
planning to attend an interview for a position in operating system in one organisation may require
computer audit but have a limited knowledge of the between 5 and 10 man-days, whilst in another, the
subject. For those from either an audit, business or same operating system may be subject to a more
information technology (IT) background seeking a detailed examination lasting several months.
move into computer audit, these notes will provide
useful background reading. 1.3 Origins of Computer Audit
Whilst any organisation that has agreed to interview a The absence of a common definition of computer
candidate who has limited experience of computer audit may, in part, be due to the relative newness of
auditing will judge them accordingly, there is computer audit. The history of traditional auditing or
substantial scope for candidates to improve their inspection can be traced back many hundreds of
chances by demonstrating that they have done some years. In contrast, computer audit is a relatively
research and are conversant with the basic principles. recent development. It was not until the late 1970’s
Further, as it is increasingly difficult to distinguish that the majority of major organisations in the UK
between IT and business areas, many organisations established a computer audit capability for the first
now require that all business auditors have an time.
awareness of computer audit. These notes, therefore,
The use of IT in business is also a relatively recent
should assist business auditors in obtaining a greater
development. The father of modern day computing is
appreciation of computer auditing.
generally regarded as being Charles Babbage, who
Given the diversity of IT, it is not possible within a
produced his Difference Calculator in 1833. It was
document of this type to be specific about computer
not until the outbreak of the Second World War and
audit in particular sectors or in relation to specific
the widespread development of valve technology,
hardware or software. The basic principles of
that the 1st Generation computers were used. Even
computer audit should be common to all sectors and
then, it was many years later that they became
to most types of hardware and software.
commonplace in business.

1.2 Definition
1.4 Change
One of the most important factors to consider when
A key feature of many organisations today is change.
discussing computer audit is that the term “computer
Although not necessarily the driver of change, IT is
audit” can mean many different things to different
invariably an intrinsic component and much of the
people. What may be regarded as computer auditing
change would not be possible without IT. IT has had
in one organisation, and very much the realm of the
specialist computer auditor, may be undertaken by a major impact on social, economic and political
business auditors in another similar organisation. For factors throughout the world. Not only has it led to
example, computer audit may be restricted to the creation of new professions but it has also
auditing systems software in one organisation, whilst revolutionised others, such as office work, or, when
areas such as auditing systems under development combined with robotics, manufacturing industries.
may be the responsibility of the business auditor. Computer audit operates in a climate of constant and
Similarly, in some organisations, it is not uncommon rapid change. Computer auditors are continually
for the role of computer audit to be extended to faced with the prospect of faster, smaller and cheaper
include the review of clerical procedures and the IT systems. An analogy that is frequently used to
production of compliance based audit work describe the rapid development of IT, is if aviation
programmes for field auditors, thereby providing a had developed at the same rate, man would have
wider systems audit service. landed on the moon in 1922. IT is a dynamic area
There are no hard and fast rules as to what which in turn, requires a dynamic and flexible
constitutes computer audit. Often, similar sized control structure.

2 B A R C L AY S I M P S O N
The rapid development of IT is perhaps best 1.6 Computer Auditors
indicated by the relative absence of specific IT
It was not until the late 1970’s that most
legislation, which, in England and Wales, is largely
organisations in the UK established a computer audit
based upon precedent established over many years.
capability. This primarily arose out of the need to
The only specific IT legislation in the UK at present is
provide business auditors with independent data
the Data Protection Act 1984 and the Computer from the IT system. This in turn progressed to a
Misuse Act 1990, both of which have been subject to wider review of the IT applications and infrastructure
considerable interpretation by the Courts. Both to provide an assurance that the organisation’s assets
pieces of legislation are security and control related. were protected and that suitable security and control
mechanisms were in place. The high level of
1.5 Nature of Computer Audit technical knowledge required resulted in the birth of
the computer auditor.
Although an IT system may achieve the same end
It is important when considering computer audit to
result as a manual system, the way in which it does
note that it is an integral part of the overall audit
so, and hence the level of security and control
activity. It is usually separated to enable specialised

An Introduction to Computer Auditing

required, can differ considerably. There are a
security and control issues to be dealt with more
number of significant risks associated with the
effectively and to make better use of specialist staff.
processing of IT systems. It is important, therefore,
Computer auditing, therefore, is a means to an end
that high standards of security and control are
rather than an end in itself. There is always a
maintained to minimise the potential impact on the
temptation when dealing with IT to become
organisation.
engrossed in the technical complexities of an
Computer fraud and abuse can have a detrimental operating system or application and to ignore the
effect on an organisation. Periodic surveys business realities of the organisation. Risk based
undertaken by organisations such as the NCC computer auditing, integrated as appropriate with
(National Computing Centre) and the Audit business audit, is essential if computer audit is to add
Commission indicate the following common instances value to the organisation and to deliver the effective
of computer fraud and abuse: service demanded of it by senior management.

• unauthorised disclosure of confidential Over the years, the role of the computer auditor has
changed to being more consultative and value
information
adding. Clearly, where a new system is being
• unavailability of key IT systems developed, it is more cost effective for audit
• unauthorised modification/destruction of software comments to be provided prior to a system being
implemented, when improved security and control
• unauthorised modification/destruction of data features can be included more easily and cheaply.
• theft of IT hardware and software Similarly, although computer auditors regularly
undertake audits of say logical access controls, there
• use of IT facilities for personal business is considerable scope for computer auditors to be
When considering computer audit, it should be noted involved in the design of those components.
that the basic control objectives and principles do not There is an issue of independence if the computer
change. The manner in which those objectives are auditor becomes involved in the design process as
achieved, however, does change fundamentally. this may be compromised if the same individual
Specifically, there is a need for greater preventative subsequently audits that system. It is generally
controls rather than a reliance on the more detective recognised, however, that the costs of not getting
and corrective control mechanisms which would involved are so great that this is not an option. It is
usually be found in manual systems. The unlikely, for example, that senior management will
development of on-line real time systems, where the be happy to receive an audit report just after a new
immediacy of processing can result in millions of IT system has gone live which details significant
pounds being transferred away in a funds transfer security and control exposures.
system, requires a robust level of security. The role of the computer auditor continues to
mature and develop. This is essential if computer

B A R C L AY S I M P S O N 3
 audit is to provide a value added service to the
business in the face of increasingly sophisticated
Acknowledgement
technology. A key challenge for computer auditors is
to keep up to date with the constant and rapid Barclay Simpson would like to acknowledge
developments in IT. Continuous training and the assistance of Graham Burggy QiCA MIIA
development is essential. Successful computer ACIB, in the completion of these notes.
auditing is based upon a foundation of technical Graham Burggy is an experienced Computer
excellence. Without this, computer auditors are Audit Manager who has worked in computer
limited in their ability to audit effectively and to audit for three major financial services
provide a valuable service to the organisation. organisations.

It should also be noted that the role of the computer

auditor can, in some areas, overlap with that of the
computer security function and this can cause No part of these notes may be reproduced or
confusion. It is essential to clearly define respective transmitted in any form or by any means without
responsibilities so that unnecessary duplication is prior permission.
avoided. Essentially, the role of the computer © Barclay Simpson Associates Limited.
security section is to assist users in developing
security solutions and to administer that security on a
day to day basis. The role of the computer auditor is
to provide senior management with an independent
and objective assurance as to the level of security
applied within the IT environment. As an integral
part of the audit process, computer auditors will also
provide advice and it is in this area that duplication
and overlap may arise.

1.7 Scope
The following sections of these notes describe the
main areas of computer audit activity:

• systems under development

• live applications
• IT infrastructure
• audit automation

The extent to which these areas are reviewed and the

depth to which they are examined will vary. Key to
the performance of audit work is a comprehensive
risk based evaluation which should determine the
amount of audit resource required and should also
assist in determining an assessment of a satisfactory
level of security and control.
A brief outline of the involvement of the computer
auditor has been provided for each area. The
purpose of this outline is to give an indication of the
audit considerations rather than to provide an
exhaustive list. Readers are advised to refer to
appropriate text books where additional information
is required, specifically, “Computer Auditing” by Ian J
Douglas and the “CIPFA Computer Auditing
Guidelines” by CIPFA.

4 B A R C L AY S I M P S O N
2. Systems Under Development
2.1 Background 2.2.1 Project Management

“There is nothing more difficult to plan, more Project Management is concerned with delivering a
doubtful of success, nor more dangerous to manage solution on time, within budget and to the
than the creation of a new system” Machievelli. appropriate level of quality. Project management as
an activity is not confined to IT and many of the
The development of a new computer system
basic principles have been developed in other
represents an area of potentially significant risk to an
industries, notably the construction industry.
organisation. New computer systems are developed
to meet a variety of business needs, whether they be The basic principles of good project management are:
to meet new legal requirements, to maintain or
• clearly defined management responsibility
enhance profitability, to improve efficiency or to
reduce costs. The failure of a new system could • clear objectives and scope
have a major impact on an organisation’s future • effective planning and control
viability and well being.
• clear lines of accountability
A review of an organisation’s financial statements will

An Introduction to Computer Auditing

usually indicate that, with minor exceptions, the There are a variety of project management
development of IT systems is also one of the methodologies in existence, such as PRINCE (Project
organisation’s major areas of investment. in Controlled Environment), which in turn may be
supported by an ever increasing range of project
The potential sources of a new IT application are management tools, such as Project Manager
many and varied. A number of factors, such as cost, Workbench (PMW) and MS-Project. The precise
time constraints and availability of a skilled resource, requirements of project management methodologies
will determine which source is the most appropriate vary and frequently methodologies may be
for a particular organisation. Options include: customised to meet the specific needs of an
• a bespoke development by an in-house IT team organisation.

• a package solution from a software house In spite of the widespread availability of such
methodologies and tools, research has shown that the
• a bespoke development by a software house
majority of IT projects are not implemented on time,
• joint bespoke development (partnership) by a within budget or to the appropriate level of quality.
software house and the in-house IT team
Typical components in a project management
• end-user development methodology include:

Computer audit activity within systems under Organisation

development is focused on two main areas:
This is to ensure that senior management are
• the manner in which a new IT application is committed to the project and to enable issues to be
developed resolved promptly. A standard framework for the
direction and management of a project should be
• the adequacy of security and control within an IT
established, which generally involves committees
application
such as a Steering Committee and the appointment of
specific personnel such as a Project Manager or
2.2 Development of New IT Project Sponsor.
Applications
It is important to ensure that new IT applications are Planning
developed in a controlled manner so that they This is to ensure that work activities are addressed at
perform only those functions that the user requires an appropriate level of detail, that resource
and that adequate security and control is included. requirements are identified and that risks are properly
The manner in which a new IT system is developed evaluated. Comprehensive planning is the key to
is generally considered under two main headings: successful project management and forms the basis of
subsequent project control. Typically, a project will
• project management
be broken down into a number of sub-projects, each
• the systems development life cycle with a number of specific stages.

B A R C L AY S I M P S O N 5
 Control programming language such as Assembler, or a high
This is to ensure that potential problems can be level programming language such as COBOL, by
identified and that the ongoing viability of the project specialised programmers working to a design
can be continuously monitored. produced by systems analysts. Package solutions are
also used extensively for common applications such
Project control generally consists of financial controls
as payroll. As with project management, a variety of
such as budgets and time controls such as milestones,
methodologies have been developed to assist in this
which enable the status of a project to be measured.
process, the most widely known of which is probably
Frequently, a regime of more subjective controls will
SSADM (Structured Systems Analysis and Design
also be established, such as internal and quality
Methodology).
assurance reviews, supported where necessary by
external reviews undertaken by specialist consultancy The precise definition of stages in a systems
organisations. development life cycle will vary according to the
development process and methodology being used.
Computer Audit Involvement in Project In many ways the stages of a life cycle are consistent
Management with the basic principles of TQM (Total Quality
The computer auditor should be involved in the audit Management). Typical stages are:
of project management. The purpose of this
involvement is to provide an objective view to project Project Initiation/Feasibility Study
management and an independent appraisal to The purpose of this phase is to progress an initial
accountable senior management, that an adequate idea to a stage where a project can be formally
system of project management is in place. defined. Once defined, the feasibility of this
Key areas of audit interest are to assess whether: proposal and the cost benefit can be determined.

• an effective project team has been set up to Analysis and User Requirements
ensure that responsibilities are clearly defined, The aims of this phase are to confirm the project
that senior management are involved and that objectives and scope, to identify and classify the
issues can be raised required data and to identify and prioritise business
• comprehensive and sufficiently detailed plans requirements.
have been prepared together with an assessment
Design
of the extent to which they are achievable and
The aim of this phase is to complete a logical and
whether they cover all areas
detailed technical design of the system which meets
• effective mechanisms have been established to the user’s requirements.
continuously monitor project progress in order to
obtain an assurance that senior management is Build
provided with timely information so that variances This involves programming and testing the system.
from the plans can be investigated and the Testing will consist of a number of components, such
appropriate action taken as unit testing, link testing, systems testing and user
acceptance testing.
2.2.2 Systems Development Life Cycle
The systems development life cycle is concerned with Implementation
the formal development of an IT application and The aims of this stage are to plan and co-ordinate all
aims to ensure that a new IT solution is: the activities needed to ensure that the new (or
• developed in a controlled manner amended) system can be successfully moved into
production in a manner which will maximise the
• adequately documented
delivery of benefits while keeping disruption to a
• maintainable in the future minimum.
• developed efficiently and securely
Post Implementation Review
• meets the user’s requirements
The aim of this stage is to review the development to
IT applications have traditionally been developed in a determine any lessons for the future. In practice, this
mainframe computer environment, in a low level stage is all too frequently ignored.

6 B A R C L AY S I M P S O N
Increasingly, IT applications are being developed by involvement is to provide an assurance to project
alternative processes. IT applications, for example, management, user management and accountable
are being developed by end users, whether relatively senior management of the organisation that the
simple spreadsheets which generate key MIS for application has been developed in a secure and
strategic decision making or more complex controlled manner. Some types of development may
developments in languages such as MS-Access and cause greater concern than others, such as end-user
FoxPro. Even within the more formal and structured developments where the users are not skilled in the
IT development areas there is a move towards disciplines of developing IT systems.
modern methods of developing IT applications.
The primary area of audit focus should be the design
These include:
phase where an assurance and advice on the
• CASE (Computer Aided Software Engineering) - adequacy of proposed controls can be provided. A
this is a working environment consisting of strong presence in the testing phase is also
programs and other developmental tools that help recommended to ensure that the proposed controls
managers, systems analysts, programmers and are robust and workable.
users to automate the design and implementation

An Introduction to Computer Auditing

The computer auditor should seek an assurance that:
of programs and procedures. Common CASE
tools include IEF, from Texas Instruments, and • user requirements have been fully understood and
Foundation, from Andersen Consulting confirmed

• Object Orientation - a program is viewed as a • the IT system, and any associated manual
collection of discrete objects that are self processes, meet those requirements
contained collections of data structures and • the development approach and methodology are
routines that interact with other objects. C++ is appropriate for that development and provide for
an object orientated version of the C a thorough consideration of risks and the
programming language inclusion of controls
• Prototyping - here systems are developed • adequate documentation is available which
on-screen interactively with the user, typically in a explains the workings of the system
fourth generation language (4GL). Several
The computer auditor may also undertake limited
iterations may be produced until an acceptable
compliance testing to ensure that deliverables are
product is achieved. From this, a full production
produced in accordance with the approved
system can be developed
methodology.
• Rapid Application Development (RAD) - unlike
prototyping which is a development technique to
2.3 IT Application Controls
create a throwaway version of a product, RAD is
an end to end development life cycle. It is based Within an IT application it is important to ensure that
upon the premise that 80% of the solution can be satisfactory levels of security and control are
achieved in 20% of the time it would take to implemented to meet identified risks. Application
develop 100% of the solution. The most widely controls generally fall under two main headings:
known RAD methodology is DSDM (Dynamic • application specific controls
Systems Development Method)
• general IT infrastructure controls
A key impact of these newer approaches is that
traditional development documentation may not be 2.3.1 Application Specific Controls
available. A more interactive and ongoing This is concerned with controls within the IT
involvement may be necessary although this in turn application and consists of the following:
may create issues of resourcing and scheduling.
Input Control
Audit Involvement in the Systems Development Input controls will be necessary to ensure that all
Life Cycle data entered is authorised, complete, accurate and
Early involvement in the audit of systems under entered only once. Typically, a combination of
development is essential. The purpose of this manual and automated controls will be required to

B A R C L AY S I M P S O N 7
 achieve this. These include validation checks, range assurance as to the adequacy of security and control.
checks and segregation. The system should also Whilst it is not possible during the development
provide a suitable mechanism that records sensitive phase to conduct detailed audit testing, formal test
or critical activities by individual users and enables plans should be reviewed to ensure that controls are
the production of evidence of processing. being adequately addressed and consideration could
even be given to setting up specific security and
Processing Controls control test plans.
Processing controls will be necessary to ensure that
Key areas of interest for the computer auditor
transactions are processed completely, accurately and
in a timely fashion. A variety of controls will be used include:
to achieve this, for example, reconciling input control
Input
totals with subsequent output, validating the integrity
and reasonableness of automatically generated • are input documents authorised by an appropriate
transactions and generating calculations automatically person(s)
from the appropriate authorised standing data. • is adequate segregation in place

Output Controls • does input validation include the following checks:

Output controls will be necessary to ensure the
• data within valid limits
completeness, accuracy and availability of application
• data one of valid codes
output, whether it be in a paper form, or as
electronic data. On printed output, controls such as • data compared to existing items on file
sequence numbers and page numbers will be used to • check digits
ensure completeness. • balancing - e.g. agrees to batch total, journal
totals to zero
Procedures
Procedures should be prepared which contain Processing Controls
adequate management and supervisory controls and • are changes to the calculation/formulae properly
checks. In some instances, separate user guides may controlled, tested and authorised
be prepared for the application, although usually they
will be incorporated in a departmental procedures • are key calculations checked
manual.
Output Controls
Computer Audit Involvement in Application • is printed output held and distributed securely
Specific Controls
• are reasonable checks of output performed
Early involvement in the development of a new IT
application is essential if the computer auditor is to • are logical controls over access to on-line output
add value to the process and to safeguard the reports adequate
organisation’s interests. It is obviously easier and
• is there a schedule of when output is due, which
cheaper to incorporate improved security and control
should be linked to an operations schedule to
features at the design stage of a new system rather
ensure that the necessary programs are run on
than when it has gone live. Research suggests that it
time
only costs 50p to implement a recommendation at
the design phase, but £1500 when it has gone live. Procedures
In practice, the actual cost can be far higher as the
system may not get the necessary priority and • have procedures manuals been prepared which
resource, and even if it does, the organisation runs adequately define controls and checks
the risk of the exposure until the weakness can be • have the procedures been tested before the
corrected. system goes live
As the application is in the process of being
2.3.2 General IT Infrastructure Controls
developed the computer auditor will have to rely on
a review of available documentation and discussions When considering application controls, general IT
with relevant IT and business personnel to obtain an infrastructure controls should also be evaluated. The

8 B A R C L AY S I M P S O N
rationale behind this is that there is limited value in Computer Audit Involvement in General IT
providing an evaluation on the adequacy of security Infrastructure Controls
and control within the application if no assurance can If the new application will run on an existing
be provided about the IT environment on which it mainframe installation, a reliance will be placed upon
runs. existing computer audit work to assess the security
The basic areas to be considered under general IT and control mechanisms in place. The audit effort in
infrastructure controls are detailed in Section 4 of this instance will focus on the application specific
these notes. In this instance, they are considered at a aspects, e.g. has the application been included in the
lower, application specific level of detail. The extent contingency plan and have appropriate logical access
to which general IT infrastructure controls need to be control rules been established. If, however, the
considered will obviously vary from application to application requires a new computer installation, say
application. If an application is to run on an existing a LAN, then these areas will need to be considered in
mainframe, then a reliance can be placed upon more detail.
existing mainframe infrastructure controls. It will
only be necessary to consider the areas specific to

An Introduction to Computer Auditing

that application, e.g. which users are to be allowed
access, what type of access will be allowed or what
additions need to be made to the existing mainframe
contingency plan. If, however, the application is to
run on a new LAN for example, then additional areas
will need to be considered, e.g. should a logical
access control package be installed, who will be
responsible for its administration and will a new
contingency plan be necessary?

The general IT infrastructure controls to be

considered include:

• physical security

• contingency planning

• logical access control

• program change control

• operating system

• telecommunications

• storage media

• databases

• cryptography

• computer operations

B A R C L AY S I M P S O N 9
3. Live Applications
3.1 Background Computer Audit Involvement in Application
Specific Controls
Many organisations are dependent upon the
The key issue of audit involvement in live
availability of IT systems to such an extent that it is
true to say that for them, no IT means no business. applications is to determine who will undertake the
It is important, therefore, that the IT applications review. In many organisations, computer auditors
within an organisation are subject to a periodic risk will perform a live review of IT applications, whilst in
based evaluation of security and control. The others, live applications may be viewed as a business
rationale behind a periodic evaluation is that: area and therefore the responsibility of a business
auditor. Increasingly, a joint approach is being
• IT applications are dynamic and changes to the adopted by many organisations where the IT
system will be necessary. Although such changes application forms part of a wider scope audit of the
may be subject to audit evaluation, it is usually business area and enables a more integrated and
the case that changes are made over a period of
complete review to be undertaken.
time, usually without audit review, and the
application system may differ considerably from The frequency of the periodic review is also
that originally implemented. This may impact on important. Risk should be the key factor in
the effectiveness of security and control determining frequency and hence, importance to the
organisation. A variety of risk assessment
• the control environment surrounding the
methodologies are available for this purpose from the
application may change. Associated manual
simple and subjective to the more formal and
processes, for example, may change significantly,
structured such as CRAMM (Computerised Risk
as the dramatic de-layering of middle
Analysis and Management Methodology).
management in many organisations has shown
• live data may indicate the need for additional The audit work required for a live application review
security and control. As the application is used in is very similar to that undertaken for a system under
a live environment, specific processing conditions development with one main exception. When
or types of data may come to light which the auditing an application under development, there is
existing security and control structure does not little opportunity for detailed audit testing. Audit
accommodate work will focus on evaluating the adequacy of
security and control using discussion and a review of
• risks may change and increase or decrease,
technical documentation. The testing phase of the
rendering the existing security and controls
project may allow some scope for control testing, but
inappropriate. For example, the number of
this is artificial. With a live application review, there
customers may increase substantially, or data may
is considerable scope for audit testing, as live data
be used for new purposes such as strategic
will be available together with other documentary
decision making
evidence such as error logs.
In a similar way to the audit of systems under
Effective use of CAATS (See Section 5 - Audit
development, effective security and control are
Automation) can also be made in live application
achieved by a combination of application specific and
reviews. Interrogation software can be used to
general IT infrastructure controls.
identify exceptional conditions in data or to produce
a sample of records for testing.
3.2 Application Controls
This is concerned with controls within the application 3.3 General IT Infrastructure
- see Section 2 - Systems Under Development for Controls
details. For ease of reference, the headings of this
As with systems under development, when
Section are summarised here:
considering application controls, general IT
Input Controls infrastructure controls should also be considered.
• processing controls These areas include:
• output controls • physical security
• procedures • contingency planning

10 B A R C L AY S I M P S O N
• logical access control
• program change control
• operating systems
• telecommunications
• storage media
• databases
• cryptography
• computer operations

Computer Audit Involvement in General IT

Infrastructure Controls

The approach to the review of general IT

infrastructure controls is very similar to that detailed
in Section 2 - Systems Under Development. Again,

An Introduction to Computer Auditing

the main difference is that there is considerably more
scope for detailed audit testing in a live review.

B A R C L AY S I M P S O N 11
4. IT Infrastructure
4.1 Background considering IT infrastructure, a computer auditor may
come across a wide range of environments,
IT Infrastructure is a generic term which describes
configurations, hardware and software. As ever, risk
components such as computer hardware, systems
should be the critical factor in determining the
software or telecommunications which provide a
amount of audit effort required and the most effective
processing platform for business applications.
audit approach to be adopted.
IT infrastructure represents an area of potentially
significant risk to the organisation as the overall 4.3 Infrastructure Areas
security and control of its business applications is to
a large extent dependent upon the level of integrity, The following areas are of interest to the computer
availability and confidentiality within the IT auditor in considering IT infrastructure, although the
amount of work required under each heading will
infrastructure.
vary. For example, a physical security review of a
purpose built computer centre housing a large IBM
4.2 IT Environment
mainframe computer may require a specific audit of
In considering IT infrastructure, it should be noted several weeks duration. A review of the physical
that there is no such ideal as a standard computer security aspects of a user based PC, however, may
installation. In some organisations, IT hardware may only, require a few hours work and could be
be located in a purpose built computer centre, where incorporated into a larger scope audit.
responsibility for its operation and maintenance is in
the hands of specialist personnel, such as computer 4.3.1 Physical Security
operators, systems programmers and operations Accidental or deliberate physical damage to IT
analysts. In other organisations, IT hardware may equipment could damage the software and data of
also be located in a purpose built computer the organisation. Given the large capital investment
installation, but responsibility for its operation and made by organisations in IT, not only could this
maintenance may be vested in a smaller number of result in a significant financial cost to the
personnel who will perform a wider range of duties. organisation, but also the non-availability of the
In some organisations, IT hardware may be located in system could have a major impact on the well-being
a user environment, where responsibility for such of the organisation. It is essential that effective
activities as software upgrades and back-ups is simply physical security arrangements are in place to protect
the part-time responsibility of one or two individuals. the IT environment from accidental or malicious
damage.
Traditional computer audit text books invariably refer
to three distinct types of computer: mainframe, mini The term physical security can be further considered
and micro. Whilst such terms do exist, in practice it under the following headings:
is very difficult to distinguish between them. What is
Physical Access
regarded by one organisation as a mainframe
This is concerned with restricting access to IT
computer located in a purpose built computer centre,
infrastructure to authorised persons only. Physical
may be viewed as a mini computer by another and
access will initially consist of perimeter security
could be located in an office environment. The
which may be achieved by the use of walls and
situation is further complicated by extensive
fencing, supported as appropriate by such controls as
telecommunications networks and the use of client
CCTV or security guards. Within the building,
server environments, where several desktop machines
various IT infrastructure components such as
are connected to a central server which contains the
telecommunications and central processing units
data and programs. This move towards a distributed
should be segregated and an access control system
computing environment has increased the potential
should be installed to restrict the access of
exposure of most organisations as the control
unauthorised personnel. Typically, this will involve
environment increasingly becomes dependent on the
some form of card based access control system,
weakest link in the network.
although more sophisticated systems using
The impact of these variances is that the control biometrics, such as finger print scanning may be
environment over identical IT infrastructure found. Comprehensive intruder detection systems,
components can differ significantly. When incorporating a combination of contact breakers and

12 B A R C L AY S I M P S O N
passive infra red detectors should be used, connected Flood Protection
directly to a central monitoring station. Flooding can be caused by both internal and external
sources and the impact can be significant, particularly
Fire Protection if the water is contaminated, in which case
Fire represents a key area of risk to IT infrastructure equipment may be damaged beyond repair. Water
and good fire protection systems are essential. Fire detection systems should be installed and where
protection is generally considered under the possible, water supplies should be routed away from
following headings: IT equipment. Care should also be given to the
siting of IT equipment so that it is protected from
• fire prevention systems - these include no local hazards, such as being below ground level in an
smoking policies, good housekeeping practices area prone to flooding.
such as the prompt removal of waste paper or the
use of fire proof materials Computer Audit Involvement in Physical Security

• fire detection systems - these include the use of In considering physical security, the computer auditor
should be aware that in some areas this can be a

An Introduction to Computer Auditing

smoke and fire detectors in ceiling and floor voids
specialist field. In these circumstances, e.g. fire
and manual fire alarms, which should be
systems, computer auditors should seek the advice of
connected directly to a central monitoring station
specialist organisations such as the Fire Brigade.
• fire extinguishing systems - traditionally Halon Careful risk analysis is necessary to determine the
has been used as an effective extinguishing agent amount of audit work required in this area and to
although environmental concerns mean that this is ensure that the level of control is commensurate with
no longer appropriate. Other types of the degree of risk to the organisation.
extinguishing system include CO2 and fine spray The computer auditor should ensure that effective
water sprinkler systems. The systems should be security and control mechanisms are in place so that
capable of manual and automatic activation and the computer installation is physically secure and is
also be linked to an automatic power down of adequately protected against potential destruction and
the IT equipment physical loss. Audit work will rely heavily on
observation and discussion, together with a review of
Power Supplies available documentation such as access control logs,
The availability of quality power supplies is essential and associated manual procedures, such as those for
to the efficient running of IT infrastructure, otherwise allowing access to visitors.
data corruption and equipment damage can occur. A
wide range of devices are available to smooth out 4.3.2 Contingency Planning
potential fluctuations in the quality of the power Such is the dependence on IT by an increasing
supply, known as spikes and troughs, such as an number of organisations that the non-availability of
uninterruptable power supply (UPS) system. Again, their IT infrastructure could have a profound impact
dependent on risk, it may also be appropriate to on the well being of the organisation, if not on its
have a back-up power supply in the event of a mains continued survival. Research has indicated that of
failure. This will usually consist of a back-up those organisations suffering a major IT failure, the
generator and a short term battery powered supply. majority will be out of business within two years.

Effective physical security controls can do much to

Air Conditioning prevent or restrict the potential impact of a disaster,
As with power supplies, IT infrastructure is sensitive but it is essential that effective and tested contingency
to its operating environment. Controls are needed to plans are in place to enable the organisation to
ensure the quality of air and the temperature. survive such an eventuality. Contingency plans
Typically, air conditioning systems will be installed, should cater for various levels of IT infrastructure
together with good housekeeping procedures, such failure, from strike action by key IT staff, to a major
as avoiding the shredding of paper in the vicinity of disaster such as a fire or flood which completely
IT equipment. destroys the IT capability.

B A R C L AY S I M P S O N 13
 In terms of larger IT installations, a number of date and regularly tested. Areas to consider include
different strategies can be adopted for contingency. ensuring that the correct back-ups are taken, stored
These include: off-site and that the back-up hardware and software
environment will meet the needs of the business.
• hot standby - a dedicated site is available to
resume processing from the main site almost
4.3.3 Logical Access Control
instantaneously. This site will have identical IT
The nature of IT is such that the emphasis of the
hardware, software and data to the main site
traditional control environment has moved to one of
• warm standby - an alternative, similarly prevention rather than detection. Most organisations
configured site is available to resume processing, now use on-line or real time systems where data is
but which will require several hours to set up, updated and transactions are initiated immediately.
e.g. to load back-up data. Typically, these sites Logical access controls, therefore, are a key feature of
are provided by specialist disaster recovery IT infrastructure in that they provide the ability to
services such as CDR (Computer Disaster identify and authenticate users and thereby control
Recovery) or Guardian Computer Services and access to and usage of the system.
may be shared by several users
The basic purpose of logical access controls is to
• cold standby - where premises are available restrict authorised users to performing authorised
which must first be equipped out with hardware, activities from authorised locations via only
etc. before they can be used. Typically these authorised channels. It is essential, to achieve an
range from an empty warehouse to a spare office effective balance between having too much security
or a portacabin and allowing too much flexibility and access for the
• reciprocal agreements - arrangements with users.
other organisations operating similar equipment In operating systems such as VMS from DEC,
are also an option, although in reality, these tend Windows NT from Microsoft and OS/400 from IBM,
to be impractical in today’s IT dependent business security functionality is integrated within the
environment operating system software. In others, such as the
Clearly the specific needs of the business will large IBM operating system, MVS, separate logical
determine which is the most appropriate solution to access control software will have to be implemented
its needs. For smaller IT environments, variations of to achieve the required level of security - Top Secret
these strategies can be adopted. and ACF2 from Computer Associates and RACF from
IBM are the most common packages available for this
It is important to ensure that IT contingency plans do
purpose. In some operating systems, notably the
not exist in isolation of the business. Business
various flavours of UNIX, security functionality is
requirements, ideally in the form of a wider business
included within the operating system software, but it
resumption plan, should be clearly identified and
may need to be supplemented by third party
should provide the basis for subsequent contingency
packages such as BOKs, to achieve the required level
planning. Regular and thorough testing of the plan is
of security.
essential if an assurance is to be obtained as to its
effectiveness. IT is such a dynamic area and regular The basic components of logical access control
testing helps to ensure that potential problems are systems include:
identified and resolved.
• environmental controls - where system-wide
options/parameters are set. These include the
Computer Audit Involvement in Contingency
initial security level, whether protection is to be
Planning
extended to magnetic media, password options
Ideally, computer auditors should be involved in the
such as the number of invalid attempts allowed
development of a contingency plan and in the testing
and the enforcement of password changes
process. The objective of this involvement is to
ensure that the plan is comprehensive, up to date, • user controls - where restrictions are put on
and meets the requirements of the business. The who can access the system and from where.
computer auditor should consider whether a Usually, there will be a number of users in the
contingency plan exists and if it is documented, up to system who are privileged; that is they have

14 B A R C L AY S I M P S O N
 special attributes which enable them to perform segregation, procedures and checking of work. The
special actions. In UNIX, for example, the system-wide options and locally coded exits should
privileged user is known as “Root” and has access be reviewed to ensure that they do not compromise
to all system resources security. Limited testing may be undertaken to
ensure that key databases and system resources are
• resource controls - where the protection for
sufficiently protected and that user’s access rights are
resources such as databases are created, e.g.
when is access to this database to be allowed, is consistent with their operational duties. An important
the access to be read only and from what consideration is to ensure that effective mechanisms
terminal? have been established to investigate potential and
actual breaches of IT security.
Logical access control systems can be customised
although this can have a significant effect on the 4.3.4 Change Control
security of the IT system. The customisation is
Change is a common feature of the IT world. It is
achieved by a series of parameters or values which
important that effective control procedures are in
determine how the software will work, e.g. how
place to ensure that only authorised changes are

An Introduction to Computer Auditing

many logon attempts will a user be allowed? Exits
made to IT systems. Not only is there scope for the
are also included which enable an organisation to
accidental or deliberate inclusion of unauthorised
develop its own logical access controls code.
code (the so called Trojan horse or time bomb) but
The administration of logical access control is change involves a degree of risk and it is necessary
particularly important. Specifically, it is advisable to to ensure, for example, that the right version of
segregate the administration of logical access control
software is actually implemented.
from other operational activities and to provide for
regular checking of the administrator’s activities, e.g. Formal change control systems are necessary to
the independent review of audit trails. ensure that changes to application software, systems
software, and even IT hardware, are adequately
A key issue of logical access control is that with the
proliferation of IT systems, many users are required tested, authorised and moved to live production in a
to hold several User-IDs and passwords. Inevitably, controlled manner. A variety of change control
this results in users keeping a record of them, so software products are available to assist, notably CA-
compromising security. It is technically feasible to Librarian and Endevor for IBM systems. Many
implement a single sign-on system where a user is operating systems include basic change control
authenticated at the point of entry and only has to functionality, whilst a number of organisations
sign-on once. Such systems, however, do not develop their own to meet specific needs. The basic
necessarily provide for a secure single sign-on as functions of this software are to:
frequently, passwords are distributed in clear text.
• establish different logical environments for
There are problems of password synchronisation and,
programming, testing, quality assurance and live
invariably, the available products do not cater for all
program versions
of the IT platforms that an organisation is likely to
use. • restrict access to program code

Computer Audit Involvement in Logical Access • provide version control over the program libraries
Control
• provide an audit trail facility
The basic objective of a logical access control review
is to establish whether controls over access to Formal change control systems should accommodate
systems, data, software and resources are adequate. not only scheduled changes, but also the need for
Ideally, the computer auditor should be involved in emergency changes, whether they be software or
the initial design of the access control system when data. The basic principles of change control apply to
appropriate advice and guidance on the level of emergency changes, i.e. authorisation is required,
security can be provided. although detailed investigation, testing and
The computer auditor should review the access documentation of the change may be undertaken
control administration function to ensure adequate after the event.

B A R C L AY S I M P S O N 15
 Computer Audit Involvement in Program Change requirements. Usually, most operating systems will
Control have a series of parameters or values which
The objective of the computer auditor is to obtain an determine how the operating system will work. Exits
assurance that changes to applications and systems are also included which enable an organisation to
software and hardware are adequately controlled. develop its own operating system code. This
The computer auditor should ensure that a change customisation can have a significant effect on the
control system is in place which accommodates both confidentiality, availability and integrity of IT
scheduled and emergency changes. An assurance processing.
should also be obtained that an authorisation In larger organisations, running large complex
mechanism is in place, that adequate documentation operating systems, it is not uncommon to have
of the change is produced, that the integrity and personnel specifically responsible for fine tuning and
security of program versions is maintained and that customising the operating system. Effective control
the implementation process provides for back-out procedures are required over such personnel.
routines.
Computer Audit Involvement in Operating
4.3.5 Operating Systems Systems
An operating system is usually defined as a set of
The audit of operating systems is a complex and time
programs which permit the continuous operation of a
consuming area. In some instances, software is
computer. The software controls scheduling and
available to assist in this process, such as CA-Examine
execution of application programs and use of
for MVS.
computer resources. Simplistically, the operating
system acts as the interface between the application The basic objective of the computer auditor is to
program, the user and the IT hardware. The security ensure that the security and integrity of the operating
and control of an operating system is a complex issue system has not been compromised. The auditor
and provides an area of potentially major risk to an should consider whether responsibility for the
organisation. maintenance of the operating system has been
established and that suitable procedures have been
The complexity, size and functionality of operating
documented. An effective change control system is
systems varies enormously from one manufacturer to
necessary to ensure that only authorised amendments
another. Some operating systems may include
can be made to the operating system. The computer
functionality, such as database management systems
auditor should also ensure that system initiation
and security software, whilst others will require
procedures are established to prevent unauthorised
separate systems software to perform such tasks.
changes.
Some of the most well known operating systems
include MVS from IBM, which contains over 10 4.3.6 Telecommunications
million lines of code, VMS from DEC and VME from The major development in computing in the last few
ICL. Whilst operating systems such as MVS, VMS and years has been the rapid expansion of
VME are proprietary to that manufacturer and telecommunications. As a result, a vast amount of
dependent on its hardware, a few operating systems, data is regularly transmitted throughout the world
notably UNIX, are portable and can be run on a and with it there are significant security and control
range of manufacturers’ hardware. This portability, exposures, specifically in terms of availability and
however, may be limited, as invariably basic UNIX is integrity.
customised by each supplier to provide its own
There are many different types of telecommunications
features, such as AIX from IBM and HP-UX from
networks, such as local area networks (LANs) which
Hewlett Packard. In effect, these portable, or open
are usually confined to individual offices and wide
systems, become proprietary and dependent on a
area networks (WANs) which can span continents.
specific manufacturer’s hardware.
Telecommunications software is necessary to operate
The extent to which operating systems need to be these networks and to enable communication
customised varies considerably, not only from one between user terminals and the application program.
operating system to another, but from organisation to A vast array of network protocols are necessary and
organisation, depending upon its specific several will be found in the same organisation,

16 B A R C L AY S I M P S O N
whether for historical or specific business reasons (a 4.3.7 Cryptography
protocol is a set of standards to ensure data moves The risks associated with the transmission of data
efficiently around a network). Typical protocols over extensive telecommunications networks (parts of
include IBM’s SDLC Synchronous Data Link Control which may not be under the organisations direct
and TCP/IP (Transmission Control Protocol/Internet control) have created a need to take additional steps
Protocol). to prevent the unauthorised/accidental corruption of
Telecommunications software typically provides the messages in transit, or a breach of confidentiality.
following functionality: Cryptography can be used to ensure confidentiality,
integrity, non-repudiation and authenticity and
• controlling the flow of data in a network includes such techniques as encryption and digital
• providing for recovery and resilience signatures. Military organisations and banking
institutions make extensive use of cryptography.
• MIS on network performance and capacity
management Encryption
• security and cryptography functionality Encryption is a widely used technique which involves

An Introduction to Computer Auditing

making information indecipherable to protect it from
• network administration tools
unauthorised viewing or use, especially during
• network audit trails transmission or when it is held on removable magnetic
media. Encryption is usually based on a key(s)
Again, telecommunications is a very specialised area
without which the information cannot be decoded
possibly requiring the support of a separate team.
(decrypted). The most widely used encryption system
The number of staff required will vary from
is DES (Data Encryption Standard) although
installation to installation, and may comprise several
increasingly this is being replaced commercially by
sections in large organisations running software such
as IBM’s SNA (Systems Network Architecture). the more secure public key system RSA.

As with operating systems, telecommunications Message Authentication

software can be customised as appropriate by an Message authentication makes use of encryption to
organisation. Exit points are also available to enable create a digital signature which is appended to a
user code to be implemented. Some transaction. This does not scramble the data but any
telecommunications software, such as CICS (Customer difference in the digital signature at the receiving end
Information Control System) also includes security will indicate some form of message corruption.
software features.
Computer Audit Involvement in Cryptography
Computer Audit Involvement in Cryptography is a very specialised and complex area
Telecommunications and a review of this requires a high degree of
The basic audit objective is to ensure that adequate specialised knowledge. Typically, in ensuring that
security and control is in place over the organisation’s adequate controls are in place over authentication
telecommunications networks. Initially, the computer and encryption, the computer auditor will wish to
auditor must obtain network diagrams of all physical ensure that encryption hardware is physically secure,
and logical connections. The computer auditor that audit trails are made of key change activity and
should ensure that telecommunications hardware, that the generation of keys is well controlled.
such as front-end processors (FEPs) are physically
secure. Effective control should be exercised over the 4.3.8 Computer Operations
addition or deletion of devices to the network and Within any type of computer installation, personnel
documented procedures should govern the work of are required to operate the IT systems. The tasks
the various personnel involved in the network. The undertaken, the number of personnel required and
computer auditor should assess the adequacy of the the extent of automation involved may vary
back-up arrangements and assess whether adequate significantly from one installation to another. Typical
control is exercised over the use of diagnostic tools, operating tasks include:
such as datascopes which could compromise network
• job scheduling
integrity or confidentiality. Particular attention should
be paid to the existence of any dial-in connections. • operating IT hardware

B A R C L AY S I M P S O N 17
 • housekeeping Computer Audit Involvement in Databases

• recovery and back-up The basic objective of the computer auditor is to

assess the integrity and availability of the database.
Computer Audit Involvement in Computer Key areas of interest are to restrict access and to
Operations ensure a satisfactory segregation of duties between
The basic objectives of the computer auditor are to the database administrator and other operation and
assess whether adequate controls are in place over support functions. Local exits should be reviewed,
data preparation, the completeness of processing and together with the various DBMS options to ensure
the dispatch of output. The computer auditor will that security has not been compromised.
wish to ensure that adequate audit logs of operator
4.3.10 Storage Media
activity are maintained, that the computer room is
Most organisations operating sophisticated IT systems
tidy, that there is an adequate segregation of duties
will hold a vast quantity of data. In general, this will
and that work is appropriately organised. The
be held on direct access storage devices (DASD) such
computer auditor should also ensure that output is
as fixed disks. In some instances, notably archive
securely controlled and that appropriate arrangements
data and back-up data, other media such as
exist for re-runs and that unwanted output is safely
cartridges, magnetic tapes or optical disks may be
disposed of.
used. Often, robotic devices such as cartridge
4.3.9 Databases libraries are in use to automate the control of such
A database may be defined as “a collection of inter- media, although manually administered tape libraries
related data which is organised so that, as far as will also be found.
possible, it is independent of any specific application The concentration of such a quantity of data in a
and wherever possible, not duplicated”. A database small number of locations poses potential risks to an
is a structured way of storing and managing data in a organisation. It is essential, therefore, that this data is
consistent manner, which is independent of the held securely, that it is protected from unauthorised
physical structure of the data. Data is arguably one use and that adequate records of its use are
of the organisation’s most important resources and as maintained. Specific procedures are required to
such it is essential that strong controls are in place provide for the safe disposal of magnetic media, for
over its use. which devices such as degaussers may be used.
There are two main types of database:
Computer Audit Involvement in Storage Media
• hierarchical or CODASYL - hierarchical The computer auditor should ensure that satisfactory
databases have a “tree” structure, with a hierarchy control is exercised over its use and storage and that
of nodes, the top node being the “root” node. it is physically protected from accidental or deliberate
One of the most common examples of this type damage. The computer auditor should determine
of database is IMS (Information Management what data is held on magnetic media and its
System) from IBM significance to the organisation. There will be a need
• relational - with relational databases, data is to ensure that authorisation mechanisms are in place
modelled into logical records and relationships as for the use of media and that procedures provide for
before, but entities become rows in a table and its correct labelling and cleaning.
attributes become columns. DB/2 from IBM is an
example of a widely used relational database

The database which holds the data is controlled by

software known as a database management system
(DBMS). The purpose of this system is to manage
the data in the most efficient form. All requests to
read, change, insert or delete data must be made
through the database management system. Logs are
also maintained of such actions. Usually, the
database management system incorporates security
software to control access to the data.

18 B A R C L AY S I M P S O N
5. Audit Automation
5.1 Background application data. Standard programming languages
such as COBOL may be used and generalised audit
In many organisations, the origins of computer audit
software is also available from the accounting firms,
lie in the need for business auditors to obtain
such as System 2190 from KPMG. Specific retrieval
independent data from the system and subsequently,
software such as Easytrieve from SRA can also be
to obtain an assurance about the internal workings of
obtained. Increasingly, there is a large range of third
the IT system. Although audit automation still
party software products available for the development
represents a core activity of many computer auditors,
of CAATS. Some of the most widely known include:
increasingly, this activity is being transferred to
business auditors. This transition has been facilitated • IDEA (Interactive Data Extraction & Analysis)
by the availability of more user friendly application • ACL (Auditor Command Language)
software. The role of the computer auditor in this
environment is to provide specialist expertise to the • SQL (Structured Query Language - used with
business auditors, rather than perform the activity. relational databases)

IT can deliver significant benefits to the audit process • SAS (Statistical Analysis Software)

An Introduction to Computer Auditing

in terms of: timeliness, efficiency, professionalism and There is also a wide variety of other third party
increased productivity. software which can assist in an audit review, such as
Audit automation is generally considered under two CA-Examine for a review of the IBM MVS operating
main headings: system, or the Enterprise Security Manager from
Axent for a review of UNIX.
• as an audit tool
• as an administration tool 5.2.2 Embedded Data Collection
This is similar to interrogation software, but the
program logic is embedded within the live
5.2 Audit Tools
application program or systems software.
Audit automation, in this context, involves the use of
computer assisted audit techniques (CAATS) as an 5.2.3 Parallel Simulation
integral part of an audit review to increase its overall This involves the re-writing of a system and
efficiency and effectiveness. CAATS are generally processing data through it so that the results can be
categorised into those which review data and those compared to the live system.
which review controls.
5.2.4 Others
Those CAATS which review data generally involve
There are a variety of other tools, such as code
the extraction, examination and manipulation of data
comparison software which can compare two files,
by programs. Such techniques can enable the auditor
containing either data or program code, and highlight
to gain an assurance as to the accuracy and integrity
differences.
of the data being reviewed and, by implication, the
strength or weakness of control. Those CAATS which
5.3 Administration Tools
review controls look at the system rather than data
and provide the auditor with an assurance as to A large range of products is now available to assist in
whether or not controls exist and are functioning the effective running of the internal audit function.
effectively. By implication, this will cause the auditor These can be developed in-house or acquired from
to question the accuracy and integrity of that data. third party suppliers. In some instances, such as
planning software, generally available products such
Traditional text books on computer audit usually refer
as PMW can be used, although audit specific
to a large range of CAATS. Although some of these
products are increasingly becoming available. Not
are used to varying degrees by some organisations, in
only do such products simplify the administration of
practice, interrogation software is the most widely
the function, but they also provide a more
used CAAT.
professional service for the organisation.
5.2.1 Interrogation Software Typically products will be used for such areas as:
Interrogation software involves the production of a planning, risk assessment, time recording, electronic
computer program to interrogate either system or working papers and presentations.

B A R C L AY S I M P S O N 19
Glossary of Terms
The following glossary is designed to give readers an understanding MAN : Metropolitan Area Network - typically operates with a discrete
of some of the more common acronyms which will be found in the geographic location (i.e. a city)
computer auditing arena. MICR : Magnetic Ink Character Recognition - the recognition of
ACF2 : An access control software product for mainframe computers, characters on paper by detecting the magnetic code on characters
produced by Computer Associates
Modem : Device that converts digital signals to analogue and vice
AIX : The IBM version of the UNIX operating system
versa to enable computers to communicate across telephones lines
Application : A program which performs business functions such as
payroll MS-DOS : Microsoft-Disk Operating System - single tasking, single
ASCII : American Standard Code for Information Interchange - a user operating system
code for representing characters in binary MVS : Multiple Virtual Storage - IBM mainframe operating system
Assembly Language : A low level language where one OCR : Optical Character Recognition - the recognition of printed
programming instruction corresponds to one machine code characters on paper by detecting patterns of dark and light
instruction
OOP : Object Orientated Programming
BS7799 : The British Standard Code of Practice for Information
Security Management Operating System : The software responsible for controlling the
C : Programming language closely associated with UNIX allocation and usage of hardware resources such as memory and
CAD : Computer Aided Design CPU
CAM : Computer Aided Manufacturing Oracle : A relational database product
CASE : Computer Aided Software Engineering OS/2 : A protected mode, virtual memory, multitasking operating
CD-ROM : Compact Disk - Read Only Memory - large capacity system from IBM based on the Intel x86 processors
storage media using compact disks of varying sizes. These are read Pascal : Concise procedural programming language
only PMW : Project Manager Workbench - a project management tool
CICS : Customer Information Control System - IBM product that
PRINCE : Project in Controlled Environment - a project management
enables transactions entered at remote terminals to be processed
concurrently by user written application programs methodology
Client Server Architecture : LANs that make use of distributed RACF : Resource Access Control Facility - an access control software
intelligence to treat both the server and the workstations as product for mainframe computers, produced by IBM
intelligent programmable devices RAD : Rapid Application Development - a development process to
COBOL : COmmon Business Orientated Language - high level speed up the development of IT systems
English-like programming language
RISC : Reduced Instruction Set Computing - a type of
Compile : Process of preparing a “machine language” program from
microprocessor that focuses on processing a relatively small set of
a source language program such as COBOL
instructions rapidly, rather than handling a much wider array of
CP/M : A range of operating systems based on the Intel
instructions
microprocessors from Digital
CPU : Central Processing Unit - main intelligence of the computer ROM : Read Only Memory - semiconductor based memory that
which processes instructions for execution contains instructions or data that can be read but not modified
CRAMM : Computerised Risk Analysis and Management RSA : Public key encryption standard
Methodology - a risk assessment methodology Server : On a LAN, the computer running the administrative software
Database : A collection of inter-related data which is organised so that controls access to all or part of the network and its resources
that, as far as possible, it is independent of any specific application
SSADM : Structured Systems Analysis and Design Methodology - a
and wherever possible, not duplicated
systems development life cycle methodology
DASD : Direct Access Storage Device
Structured Query Language (SQL) : A database tool used to
DB/2 : A relational database management system from IBM
interrogate, update and manage relational database
DBMS : Database Management System
DES : Data Encryption Standard - widely used encryption standard Sybase : A relational database product
DIP : Document Image Processing - scanning of documents onto TCP/IP : Transmission Control Protocol/Internet Protocol - a set of
optical disk standards for telecommunications
EBCDIC : Extended Binary Coded Decimal Interchange Code - a Token Ring Network : A network topology that uses token passing
code for representing characters in binary as a means of regulating traffic on the line
EDI : Electronic Data Interchange - transfer of electronic trading Top Secret : An access control software product for mainframe
information through computer to computer communication computers, produced by Computer Associates
EFT : Electronic Funds Transfer - transfer of electronic funds through
Trojan Horse : An apparently useful program that contains hidden
computer to computer communication
code, usually damaging
Ethernet : Local area network using a bus topology
Expert System : Application program that solves problems by using Ultrix : A version of the UNIX operating system from Digital
analytical rules and knowledge UNIX : A multi-user, multi-tasking operating system. Written in C it
FAST : Federation Against Software Theft - an organisation of is more portable and less machine specific than other operating
vendors who work to eliminate software theft systems. The main versions are System V from AT&T and BSD from
FORTRAN : FORmula TRANslator - the first high level computer the University of California, Berkeley
programming language used primarily in engineering and scientific UPS : Uninterruptable Power Supply - equipment to smooth out
environments variations in the quality of the electricity supply
GUI : Graphical User Interface - pictorial representation of
Virus : A program, usually harmful, that infects files, usually by
commands, files etc.
inserting copies of itself in those files
HP-UK : A version of the UNIX operating system from Hewlett
Packard VME : Operating system from ICL
Ingress : A relational database product VMS : Operating system from Digital
Internet : A global network of networks connecting a range of VTAM : Virtual Telecommunications Access Method - an IBM product
organisations to provide mainframe communication
ISDN : Integrated Services Digital Network - a network that allows
Windows : A multi-tasking graphical user interface environment
voice transmissions to be mixed with data and video services
from Microsoft that runs on MS-DOS based PCs
LAN : Local Area Network - a group of computers and other devices
spread over a relatively limited area and connected by WORM : Write Once Read Many - a high capacity read only storage
communications links device using optical disk

BARCLAY SIMPSON
Hamilton House, 1 Temple Avenue, Victoria Embankment, London EC4Y 0HA.
Tel: 0171 936 2601 Fax: 0171 936 2655 http: //www.barclaysimpson.co.uk

20 B A R C L AY S I M P S O N