Friday, 1 February 2008

Auditing Data Conversion

Data conversions are an essential part of testing the primary Controls that are necessary to ensure that the task is performed completely and accurately, and that no unauthorised changes to the input take place. Experience has demonstrated that the most likely point of error and fraud in computer systems is during the input phase. This is where data may be: -

  • lost or incomplete;
  • duplicated;
  • unauthorised or fictitious;
  • manipulated during the input process;
  • inserted without authority (either accidentally or fraudulently).

One of the issues that is often missed is that a system change and the associated testing needs to cover aspects as banal as:

  • starting up, shutting down and operating computers (other than PCs) and networks;
  • software, hardware and network problem investigation and resolution;
  • producing and distributing centrally produced computer outputs;
  • operating “batch” (or “background”) jobs;
  • backing up the system and management of off-line files (tapes, CDs, DVDs, etc);
  • installing new and amended software;
  • providing a help desk service for recording and allocating problems (hardware, software, communications) for resolution, and expediting outstanding problems;

When moving to a new finacial system always validate that the process is documented, there are adequate procedures for handling input forms, and that the data input to the system for processing is first tested for errors and omissions. Statistical tests can be carried out against the appropriate application system (e.g. duplication, gap analysis, transactions unmatched with accounts).

The basic stategs in a data conversion may include test of controls for the following areas:

  1. Strategy, Planning, Identify Dependencies
  2. Data Cleansing of Predecessor Systems
  3. Data Reconciliation and Validation Procedures
  4. Parallel Maintenance of Master Files
  5. Ownership and Sign-Off of Converted Files
  6. Internal Staff have Primary Responsibility - and Contract Staff should work subject to additional validation
  7. Special Controls for Automated and Manual Conversions

With legistlation to protect the integrity of data and finacial reports, it is still amazing that data conversion testing is rare and oft overlooked.

No comments: