Application Controls Batch Processing Application Audit Acknowledgments Material

Application Controls Batch Processing Application Audit

Acknowledgments Material is sourced from: n CISA® Review Manual 2011, © 2010, ISACA. All rights reserved. Used by permission. n CISM® Review Manual 2012, © 2011, ISACA. All rights reserved. Used by permission. Author: Susan J Lincke, Ph. D Univ. of Wisconsin-Parkside Contributors: Todd Burri, Megan Reid, Kahili Cheng Funded by National Science Foundation (NSF) Course, Curriculum and Laboratory Improvement (CCLI) grant 0837574: Information Security: Audit, Case Study, and Service Learning. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and/or source(s) and do not necessarily reflect the views of the National Science Foundation.

Objectives Students should be able to: n Define and describe batch control, validation, batch balance, reconciliation, standing data, exception report, audit trail, system control parameters n Define checks: sequence, limit or range, validity check or table lookup, existence, key verification, check digit, completeness, duplicate, consistency of logical relationship n Define and understand testing application techniques: test data, snapshot, integrated testing facilities, parallel operation, parallel simulation, transaction selection program n Define online auditing techniques: audit hooks, system control audit review file and embedded audit modules (SCARF/EAM)

Security in Software Development Requirements Security Requirements Abuse Cases Architecture & Design Risk Analysis Code Penetration Test Code Review Test Security Operation al n r w e t Ex evie R Risk-Based Security Test Deploy

Input Form No. 12083 n n n Make form easy to read and use Group like fields together Provide predetermined input codes to reduce errors Provide identifier or crossreference number Indicate field sizes Provide authorization signature if necessary Sales Order Form Date: 11/09/09 Time: 3: 24 PM Product _____________ Quantity _______ Salesperson: Authorization:

Transaction Validation Sequence Check: Sequence number use causes out-of-sequence and duplicate numbers to be rejected. Limit or Range Check: Valid numbers are below or between a maximum value. E. g. , checks should not exceed $3, 000 Validity Check or Table Lookup: Only certain values are accepted: Sex=M/F. Reasonableness Check: Values entered are reasonable: A takeout order of 100 pizzas? ? ? Existence Check: Required fields are entered correctly. Key Verification: Input is double checked via second person OR all digits are entered twice. Check Digit: A digit may verify the correct entry of other digits. Completeness Check: Complete input is provided: zeros or spaces are checked for each required letter or digit Duplicate Check: Duplicate transactions or transactions with duplicate IDs are checked for and rejected. Consistency or Logical Relationship Check: Data is consistent with other known data: An employee’s birth date must be at least 16 years ago.

Batch Processing Input is authorized and collected into a batch Batch controls are automatically calculated and associated with the batch file. Validation of the transactions occur. Rejected transactions are corrected and resubmitted or otherwise handled. Processing occurs (e. g. , orders, payments, storage to DB) Processing is complete. Batch balancing occurs through manual or automatic reconciliation of batch controls.

Batch Controls Account# Trans. Type Amount Clerk 01001 054 $54. 43 212 01222 054 $89. 99 215 02022 033 $10. 19 212 02022 036 $999. 99 215 ……… 01098 054 $50. 00 215 Batch Control: 12242 435 $9544. 34 818 A Batch groups transactions to control processing. Batch controls can include totals or hashed values. Totals may include total items, documents, or values.

Transaction Authorization n Manual: ¨ Obtain signature from management on batch forms or source documents ¨ Forms or Source Documents record data n n Pre-number for control preferably Automatic: ¨ Online access control via password or terminal identification

Error Handling Alternatives Reject transaction(s) with errors but process remaining batch n Reject batch with error transactions n Hold the batch in suspense: hold batch until error transactions are fixed n Accept the full batch but flag the error transactions for later correction n

Data Processing System Control Parameters Controls processing: e. g. , specify limit maximums Transaction File (for today) Processing Standing Data (Permanent Files) Exception Report Master Data/Balance Data Reports errors in transactions Audit Trail (or transaction log) Records running balances and totals updated by transactions

Processing Controls Per-Transaction Basis n Editing: program tests the accuracy, completeness and validity of data n Checks on Calculated Amounts: Calculated values are checked to be reasonable or not exceed maximum n Programmed Control: Software to detect, log, and initiate corrective action for errors n Exception Report: Reports error transactions with their error types Per-Batch Basis n Batch Register: Batch totals are recorded manually to be compared with system totals n Run-to-Run Totals: Each processing stage reports its calculated batch controls n Reconciliation: Supervisor should review that *all* data was properly recorded and processed

Data File Control Procedures Prerecorded Input: Certain information fields are preprinted on a blank input form to reduce input errors. n Data File Security: Ensures authorized access only n Version usage: The correct version of a file is always accessed n Transaction Logs: An audit trail records date/time of input, user ID and terminal location, and input transactions n Before and After Image Reporting: File data is recorded before and after processing, enabling traces to occur based on transactions n Parity Checking: When data is transmitted, check codes are added to ensure data is transmitted without error. Batch Processing n Error reporting & handing: All error reports are properly reconciled and authorizations/corrections are submitted in a timely manner. n One-for-One Checking: Source Documents correctly describe the processing that has occurred n Source document retention: Source documents are retained as necessary for error handling and audits. n Internal & External Labeling: Removable storage media is labeled to ensure correct processing n

Question 1. 2. 3. 4. A hash total of customer numbers is one input to the sales program. This program generates its own total to compare against this input parameter. What is the purpose of this procedure? Validate customer numbers are accurate Detect lost or changed transaction(s) Detect error(s) in sales transactions Validate that each sales transaction is complete

Question 1. 2. 3. 4. Batch balancing is used to? Ensure that test data accurately matches real data when considering transaction types Detect lost or changed transaction(s) during processing Detect error(s) in sales transactions Verify batch total is reasonable

Question 1. 2. 3. 4. Batch totals may not match when error transactions are removed. The process that verifies full processing did occur correctly, while accounting for errors is called: Audit trail Validation Batch balancing Reconciliation

Application Audit

Auditor Tasks Identify significant application components and flow of transactions n Identify controls and evaluate their effectiveness n Test the controls n Analyze the test results to determine whether controls work as expected n

Testing Applications: Test Data Pgm 1 Pgm 2 Pgm 3 Processes test data through real programs.

Testing Applications: Snapshot Pgm 1 Pgm 2 Pgm 3 Displays ‘snapshots’ of how transactions are processed, as they are processed. Certain transactions are designated for recording.

Integrated Testing Facilities Real Data Pgm 1 Pgm 2 Pgm 3 Test Data Test data and real data are merged. Must be careful to isolate test results.

Parallel Operation or Parallel Simulation New System or System under Test Pgm 1 Pgm 2 Pgm 3 Pgm 1* Pgm 2* Pgm 3* Real Data Stable System or Simulated System Data is processed through two systems and results are compared. Useful to verify new system. Parallel Operation: Compare new system with older stable system Parallel Simulation: Compare actual and simulated system

Transaction Selection Program Test Data Pgm 1 Pgm 2 Pgm 3 A tool helps to select transactions to build a test deck. .

Embedded Audit Data Collection Regular Data Pgm 1 Pgm 2 Pgm 3 Embedded Audit Modules (EAM): Audit software is embedded directly into the application programs to monitor specific types of transactions. Systems Control Audit Review File (SCARF): Provides statistical information about the normal input data file, to determine if the file is sufficiently varied for the auditor. Sample Audit Review File (SARF): Selects random transactions for analysis.

Testing Application Techniques Test Data: n Test Data: Test transactions go through real programs n Integrated Testing Facilities: Creates test transactions to include with live data n Transaction Selection Programs: Screen and selects transaction input to regular production cycle n Embedded Audit Data: Selects random or statistically-distributed input transactions and generates logs during production Debugging/Processing: n Mapping: Identifies specific program’s logic that have not been tested n Tracing and tagging: Trace shows trail of instructions executed. Tag places indicators on selected transactions n Snapshot: Records flow of designated transactions through logic paths Validation Systems: n Base-case system evaluation: Uses test data for testing programs and verifies correct system operations before accepting. n Parallel Simulation: Uses programs that simulate application program logic n Parallel Operation: Compares new and old production data processing systems and compares results

Online Auditing Techniques n n n Systems Control Audit Review File and Embedded Audit Modules (SCARF/EAM): Embedding specific written audit software in organization’s host application system Snapshots: Pictures of the processes’ path Audit Hooks: Embedding hooks in applications Integrated Test Facility (ITF): Dummy entries are set up and include auditor's production file Continuous & Intermittent Simulation (CIS): Simulates the instructions executed of the application

Concurrent Audit Tools Online Audit Techniques: Complexity: SCARF/ EAM Very High Useful when: Regular processing cannot be interrupted Integrated Test Facilities Snapshots Continuous Intermittent Simulation Audit Hooks High Medium Its not beneficial to use test data An audit trail Transactions Only select is required meeting transactions certain or criteria need processes to be need to be examined Low

Continuous Online Auditing: Audit Hooks Regular Data Pgm 1 Pgm 2 Pgm 3 Continuous Online Auditing enables auditors to test the system without disrupting a company’s regular operation. Audit hooks are software logic embedded into the application, which prints error reports of red flags enabling auditors to act to catch errors early, before they become problems. .

Question 1. 2. 3. 4. Embedded audit modules is associated mostly clearly with: Audit hooks Snapshots Batch processing Parallel operation

Question 1. 2. 3. 4. This technique provides statistical information about the normal input data file, to determine if the file is sufficiently varied for the auditor. Test data Snapshots Systems Control Audit and Review File Transaction Selection Program

Question 1. 2. 3. 4. Combining real and test data during an audit is known as: Parallel operation Integrated testing facilities Batch processing Embedded audit modules

Match Definitions Sequence number use causes out-of-sequence and duplicate numbers to be rejected. Valid numbers are below a maximum value. Values entered are plausible Required fields are entered correctly. Input is double checked via second person OR all digits are entered twice. Transactions with duplicate IDs are checked for and rejected. Duplicate Check Existence Check Reasonableness Check Limit Check Key Verification Sequence Check

Reference Slide # Slide Title Source of Information 6 Transaction Validation CISA: page 225 Exhibit 3. 30 7 Batch Processing CISA: page 223, 224, 393 8 Batch Control CISA: page 223, 224 9 Transaction Authorization CISA: page 223 10 Error Handling Alternatives CISA: page 224 12 Processing Controls CISA: page 224, 225 13 Data File Control Procedures CISA: page 225, 226 19 Testing Application: Test Data CISA: page 229 Exhibit 3. 32 20 Testing Application: Snapshot CISA: page 229 Exhibit 3. 32 21 Integrated Testing Facilities CISA: page 230 Exhibit 3. 32 22 Parallel Operation or Parallel Simulation CISA: page 230 Exhibit 3. 32 23 Transaction Selection Program CISA: page 230 Exhibit 3. 32 24 Embedded Audit Data Collection CISA: page 230 Exhibit 3. 32 25 Testing Application Techniques CISA: page 229, 230 Exhibit 3. 32 26 Online Auditing Techniques CISA: page 230, 231 27 Concurrent Audit Tools CISA: page 231 Exhibit 3. 33 28 Continuous Online Auditing: Audit Hooks CISA: page 230, 231