Quantification of the Auditor's Evaluation of Internal Control in Data Base Systems.

Abstract The importance of an adequate system of internal accounting control to the auditor's conduct of an independent audit has long been recognized. Similarly, authoritative bodies have recognized that, although the concepts, definitions, and objectives of internal control are common to all systems whether mechanized or manual, there are major differences in the specific internal control procedures employed in implementing and evaluating an internal control system in an EDP environment. This paper presents a model to be used by researchers and by independent and internal auditors to identify and quantify those control points in complex EDP systems that represent the areas of greatest risk and that are, consequently, the areas requiring the greatest emphasis in the design of the audit. In addition to the quantification model, a preliminary framework for the definition of control points is suggested. The design of such a framework is the first step in the implementation of the model.