IT ENVIRONMENTS - ON-LINE COMPUTER SYSTEMS

• Contents

  • Introduction
  • On-Line Computer Systems
  • Types of On-Line Computer Systems
  • Characteristics of On-Line Computer Systems
  • Internal Control in an On-Line Computer System
  • Effect of On-Line Computer Systems on the Accounting System and Related Internal Controls
  • Effect of On-Line Computer Systems on Audit Procedures
  • Compatibility with International Auditing Practice Statements
• Special purpose terminals

  • Point-of-sale devices, Automated teller machines, Hand-held wireless devices, Voice response systems
• On-line systems allow users to directly initiate various functions such as


  Entering transactions, making enquiries, requesting reports, updating master-files, electronic commerce activities
• Terminal devices may be found either locally or at remote sites. Local terminal devices are connected directly to the computer through cables, whereas remote terminal devices are connected to the computer through telecommunications networks
• Types of terminal devices

  • General purpose terminals
  • Special purpose terminals
• This Practice Note (PN) describes the effects of an on-line computer system on the accounting system and related internal controls and on audit procedures
• General purpose terminals

  • Basic keyboard and screen, Intelligent terminal, PCs
• On-Line Computer Systems


  Computer systems that enable users to access data and programs directly through terminal devices
• Users such as customers or suppliers may access terminal devices

  Application software and data are kept on-line to meet users' needs
• Types of terminal devices

  • Local terminal devices
  • Remote terminal devices
• In a client/server environment

  The processing of data takes place on the server and the desktop computer (client)
• Classifications of on-line computer systems

  • On-line/real-time processing
  • On-line/batch processing
  • On-line/memo update (and subsequent processing)
  • On-line/inquiry
  • On-line downloading/uploading processing
• Common applications of tone-generating devices

  • Telephone banking
  • Bill payment systems
• Local terminal devices are connected directly to the computer through cables

  Remote terminal devices require the use of telecommunications to link them to the computer
• Employees, business partners, customers, and other third parties may obtain access to an organization's on-line applications

  They may use the Internet or other remote access services
• Software required for systems with terminal devices

  • Access control software
  • Software that monitors on-line terminal devices
• On-line/real-time processing


  Individual transactions are entered at terminal devices, validated, and used to update related computer files immediately
• On-line/inquiry


  Restricts users at terminal devices to making inquiries
• On-line/memo update (and subsequent processing)

  Combines on-line/real-time processing and on-line/batch processing
• Increased sharing of system resources through LANs and WANs has led to the growth of distributed on-line processing


  Client/Server systems have resulted in applications being split, so that processing can be performed across several machines
• Even local terminals may be connected using telecommunications links or wireless communication links

  Terminal devices may be accessed by many users, for different purposes, in different locations, all at the same time
• Terminal devices may be found either locally or at remote sites
• External parties may access the organization's applications through electronic data interchange (EDI) or other electronic commerce applications

  Programmers may use the on-line capabilities to develop new programs and maintain existing programs
• On-line/batch processing

  Individual transactions are entered at a terminal device, subjected to certain validation checks, and added to a transaction file that contains other transactions entered during the period
• On-Line Downloading/Uploading Processing

  Data from a master-file is transferred to an intelligent terminal device for further processing by the user. Results of local processing may be uploaded back to the main computer
• Programmers' on-line access to the system

  Enables them to develop new programs and modify existing ones. Unrestricted access could lead to unauthorized changes and access to other parts of the system
• On-line access to the system

  Enables users to perform various functions like entering transactions, reading, changing, or deleting programs and data files through terminal devices
• The entity may need to establish suitable general controls to mitigate risks of unauthorized access
• Data entry on-line

  Subject to immediate validation checks. Data failing validation are not accepted, and users can correct and re-enter valid data immediately
• An on-line computer system may not provide supporting documents for all transactions entered, but must be able to provide transaction details on request or through logs
• On-Line Inquiry


  Users at terminal devices can make inquiries of master-files, which are updated by other systems on a batch basis
• Auditors consider the security infrastructure before examining general and application controls
• Characteristics of On-Line Computer Systems

  • On-line data entry and validation
  • On-line access to the system by users
  • Lack of visible transaction trail
  • Potential access to the system by non-users
  • Dependence on system design
• On-Line/Real Time Processing


  Data entered are available immediately, but transactions have not been subjected to complete validation before the master-file update
• Unlimited access to all functions in a particular application is undesirable as it may lead to unauthorized changes to data and programs
• Applications in an on-line environment may have greater exposure to unauthorized access and update, requiring a strong security infrastructure for information integrity
• The effect of an on-line computer system on the accounting system and the associated risks will generally depend on
• Risks that the entity may need to mitigate

  • Viruses
  • Unauthorized access
  • Potential destruction of audit trails
• Important aspects of control in an on-line computer system

  • Controls over passwords
  • System development and maintenance controls
  • Programming controls
  • Transaction logs
  • Firewalls
• Entity's security infrastructure


  Plays an important part in ensuring the integrity of the information produced