A Model of Control and Audit Procedure Change in Evolving Data Processing Systems.

ABSTRACT: The data processing systems that auditors examine and evaluate are modified frequently, Somehow they must decide what effect changes to a system may have on the controls needed to ensure the system is reliable and on the audit procedures used to determine whether controls are in place and working. This paper provides a model that allows auditors to structure their search space so they can identify those system locations where controls and audit procedures must be modified when system changes occur. The model shows that auditors need examine only those parts of a system where structural changes made at the system level induce structural changes at the subsystem level. A formalism is provided for tracing the propagation of change through the various levels of subsystems.