oversight

Need for More and Better Computer Auditing

Published by the Government Accountability Office on 1977-10-13.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

J
.         .



     I.
    1'    L   ?,                                                          1l1
                                                                            .ll1
                                                                               llI1
                                                                                  l1111111  lI111111Il1Ill
                                                                                         lI11
                                                                                        094673
                                                                                                               )-&9 s' -__.
                                                                                                                        ,--



                           p"--                                                                     1
                            L
                            NEED FOR MORE AND BETTER COMPUTER AUDITING

                        ASSISTANT COMPTROLLERTEERAL
                                                     BY
                                     E L L S W O R T H T M O R S E , JR.
                                                           - OF THE UNITED STATES
                                                                                                   i
                                                AT THE
                                   FOURTH ANNUAL FALL
                                                  AND
                                                          - SEMINAR
                                  FIRST ANNUALREGIONAL          - SEMINAR-
                                                OF THE
                                  NATIONAL CAPITAL AREA CHAPTER
                                     EDP AUDITORS ASSOCATION
                                    <S;INGTON,                          3'--
                                                    OCTOBER 1 3 , 1 9 7 7

                    XThe t e c h n i c a l c h a l l e n g e s t h a t face management o f f i c i a l s
              whose s y s t e m s i n c l u d e e l e c t r o n i c c o m p u t e r s a n d t h e i r a u d i t o r s
              who m u s t s a t i s f a c t o r i l y c o p e w i t h t h o s e s y s t e m s a l m o s t d e f y
              d e s c r i p t i o a . &he o b j e c t i v e s s o u g h t h a v e n o t c h a n g e d - - a c c u r a t e
              and prompt p r o c e s s i n g o f d a t a and p r o d u c t i o n o f u s a b l e and
              u s e f u l i n f o r m a t i o n f o r o p e r a t i o n a l a n d management c o n t r o l
                            -                                                                 4 ,
              p u r p o s e s 3 Tied i n w i t h t h e s e b r o a d o b j e c t i v e s i s k h e need t o
              p r o t e c t t h e s e c u r i t y o f processed i n f o r m a t i o n and p r e v e n t
              f r a u d i n a n y form.-)
                    G u d i t p r s c o n f r o n t i n g s u c h s y s t e m a a v e no r e a l c h o i c e
                         [b-;f"
              b u t t o be t e c h n i c a l l y equipped t o t e s t t h e workings o f t h e
                         i
              management's i n f o r m a t i o n and c o n t r o l s y s t e m s a n d t o recommend
              improvement o r c o r r e c t i o n of a n y s e r i o u s p r o b l e m s e n c o u n t e r e d - -
              actual or p o t e n t i a l 3
                       T h e s e homely t r u t h s a r e e a s y f o r s p e e c h m a k e r s t o s t a t e .
              B u t , a c h i e v i n g them i s w i d e l y r e c o g n i z e d a s a m o s t d i f f i c u l t
task.       T h a t is o n e r e a s o n why s e m i n a r s s u c h a s t h i s o n e a r e
important.          They p r o v i d e a n e x c e l l e n t forum f o r t h e e x c h a n g e
of i n f o r m a t i o n a b o u t a u t o m a t e d d a t a p r o c e s s i n g r e s o u r c e s a n d
s y s t e m s and t h e i n f o r m a t i o n t h e y produce and a b o u t a u d i t i n g

methods and t e c h n i q u e s .
        I n o u r work i n t h e General A c c o u n t i n g O f f i c e i n r e v i e w -
ing t h e n a t u r e and e f f e c t i v e n e s s o f management c o n t r o l s y s t e m s
and i n t e r n a l a u d i t i n g i n t h e F e d e r a l a g e n c i e s , w e see a n
u r g e n t n e e d f o r a u d i t o r s t o n o t o n l y d o more a b o u t computer
a u d i t i n g b u t a l s o improve g r e a t l y t h e q u a l i t y o f t h e a u d i t i n g
t h e y a r e now d o i n g .       For t h i s r e a s o n , a s e m i n a r c a n a l s o
s e r v e t o h e l p a u d i t o r s , who may b e h e s i t a n t o r a b i t f e a r f u l
a b o u t a u d i t i n g i n t h e computer e n v i r o n m e n t , t o l e a r n from
the experience of others.

       i I n GAO, w e p l a c e g r e a t e m p h a s i s o n h a v i n g a u d i t o r s o n o u r
s t a f f who h a v e t h e c a p a b i l i t y t o a u d i t a u t o m a t e d s y s t e m s , b e

these systems i n t h e f i n a n c i a l , o p e r a t i o n a l , personnel, l o g i s t i c s ,
o r o t h e r management areas
                                           3    We h a v e no c h o i c e .        The s y s t e m s a r e
t h e r e a n d m u s t b e examined.
         I n t h e e x e c u t i v e a g e n c i e s o f t h e F e d e r a l Government, w i t h
t h e i r v a s t i n v e n t o r y of computers, t h e tremendous a n n u a l c o s t
of o p e r a t i n g them, and t h e g r o w i n g d e p e n d e n c e o f managers--at

a l l levels--upon           c o m p u t e r s and t h e i r o u t p u t p r o d u c t s f o r t h e
management o f major p r o g r a m s ,                          a u d i t o r s must p l a y a v i t a l


                                               - 2 -
r o l e i n h e l p i n g assure management t h a t t h e c o m p u t e r s y s t e m s
a r e w o r k i n g e f f e c t i v e l y , a r e p r o d u c i n g a c c u r a t e and r e l i a b l e
r e p o r t s , and a r e u n d e r a d e q u a t e c o n t r o l .   LThe r o l e of        the
General Accounting O f f i c e 2 a s a l e g i s l a t i v e branch agency,

-i                       h s y s t e m s and p r o m o t e w h a t e v e r
is t o e v a l u a t e t h e s                                                        changes a r e
n e c e s s a r y t o make them a s e f f e c t i v e a s p o s s i b l e 3
        The q u e s t i o n s you a r e a s k i n g t o d a y , "Can management r e l y
o n a u d i t o r s ' r e p o r t s i n t h o s e a r e a s where t h e c o m p u t e r is
i n v o l v e d ? " and f u r t h e r , "Can t h e p u b l i c i t s e l f depend o n
t h e s e a s s u r a n c e s ? " are most important.                 They g o t o t h e h e a r t
o f a l o n g - e s t a b l i s h e d s y s t e m o f c h e c k s a n d b a l a n c e s i n which
a u d i t o r s have had a key r o l e .             What i s r e a l l y b e i n g a s k e d here
i s , "Has t h e ' m y s t i q u e ' o f computer s y s t e m s reduced t h e a u d i t o r s '
effectiveness?"              I b e l i e v e w e s h o u l d welcome s u c h q u e s t i o n s

and t h e n address them f o r t h r i g h t l y .
         I t i s i n t h e formulation o f answers t o t h e s e q u e s t i o n s

t h a t w e c a n d e m o n s t r a t e t h a t t h e r e r e a l l y i s no m y s t i q u e
i n computer s y s t e m s .          We m e r e l y f i n d a d i f f e r e n t a n d t o u g h e r
technology t o cope with.                    There is a s h i f t i n t h e s k i l l s and
u n d e r s t a n d i n g n e e d e d t o a u d i t t h e s e s y s t e m s . (The    challenge
t o a u d i t o r s i s o n e o f h a r d work, a c q u i s i t i o n of s p e c i a l i z e d
e x p e r i e n c e , new a n d demanding t r a i n i n g , a n d a n a b i l i t y t o s h i f t
t o u s i n g t h e computer i t s e l f a s a t o o l f o r c a r r y i n g o u t a u d i t
procedures.


                                                - 3 -
            However, n o t h i n g i n a l l t h i s c h a n g e s t h e f u n d a m e n t a l

    p r i n c i p l e s of t h e a u d i t o r ' s p r o f e s s i o n .   The q u e s t i o n r e m a i n s ,

    "Have a u d i t o r s i n g e n e r a l met t h i s c h a l l e n g e ? "            In the

    F e d e r a l Government,&e             i n GAO d o n o t f e e l t h a t enough i s b e i n g
    done by a u d i t o r s i n t h e a r e a of computer a u d i t i n g . >
             T h e i n t e g r i t y o f c o m p u t e r i z e d s y s t e m s c o n t i n u e s t o be

    t h e t a r g e t of much p u b l i c c r i t i c i s m .          C e r t a i n l y , one purpose
    of a u d i t i n g computer s y s t e m s i s t o g i v e management o f f i c i a l s

    and p o l i c y makers i n f o r m a t i o n on w h e t h e r t h e s y s t e m s a r e

    r e l i a b l e and c o r r e c t l y p r o d u c e o r summarize t h e d a t a p r o -

    cessed.         F u r t h e r , t h e s e o f f i c i a l s s h o u l d demand s u c h i n f o r -
    mation. G u d i t o r s cannot avoid a measure of a c c o u n t a b i l i t y
    when computer s y s t e m s l a c k c o n t r o l s , a r e used i n e f f i c i e n t l y ,
    o r uneconomically, or are t o o l s f o r c r i m i n a l a c t i v i t y 2
             We a r e a l l w e l l aware t h a t t h e u s e o f c o m p u t e r s c o n t i n u e s
    t o reach i n t o e v e r y a r e a o f o u r s o c i e t y .            Each o f u s , w h e t h e r
    w e l i k e i t o r n o t , i s becoming more and more d e p e n d e n t upon
    a n d a f f e c t e d by c o m p u t e r s a n d a u t o m a t e d s y s t e m s .     Those o f
    you from t h e b a n k i n g community a r e v e r y c o n c e r n e d w i t h
    t h e q u e s t i o n s a n d c h a l l e n g e s p r e s e n t e d by t h e e l e c t r o n i c

    t r a n s f e r of f u n d s .
             How a r e a u d i t o r s p r e p a r i n g t o c o p e w i t h t h e s e p r o b l e m s ?
.   How do w e cope w i t h t h e p o i n t - o f - s a l e            s y s t e m s which a r e
    steadily increasing?                   How d o w e d o o u r j o b i n s e r v i c e b u r e a u s

                                                     - 4 -
t h a t s u p p o r t l a r g e numbers of c l i e n t s a n d where o u r t a s k
may j u s t involve a small p a r t o f t h a t o p e r a t i o n ?                       The
s p e a k e r s who f o l l o w i n t h i s s e m i n a r w i l l h e l p p r o v i d e
some answers t o these s p e c i f i c q u e s t i o n s ,                    I think the

key q u e s t i o n , however, i s o n e w e m u s t a s k o u r s e l v e s ; t h a t
i s , "Are w e a s i n d i v i d u a l s r e a d y f o r t h e s e c h a l l e n g e s ? "
        Have w e a s a u d i t o r s made t h a t p e r s o n a l commitment
t o a c q u i r e t h e new knowledge, new e x p e r i e n c e s , a n d new
s k i l l s t h a t w e know a r e needed t o r e s p o n d t o t h e s e c h a l l e n g e s ?

Your s e s s i o n s h e r e w i l l c e r t a i n l y i d e n t i f y some o f t h e
new knowledge and new s k i l l a r e a s .                      I hope you w i l l use

them a s a s o u r c e o f i n f o r m a t i o n t o g u i d e y o u r own p l a n n i n g

t o prepare yourself.
      G i t h i n t h e F e d e r a l Government, more t h a n 1 0 , 0 0 0 computers
a r e now i n o p e r a t i o n , and t h e b e s t estimate w e h a v e i s t h a t
a n n u a l ADP c o s t s e x c e e d $ 1 0 b i l l i o n 2
        P e r h a p s o f more s i g n i f i c a n c e t h a n t h e d o l l a r amount
expended f o r these services i s t h e i m p a c t t h e y h a v e o n
Federal programs a n d a c t i v i t i e s .
                                                            4The Government's d e c i s i o n s

r e s u l t i n g from computer-produced i n f o r m a t i o n is e v i d e n t
t h r o u g h t h e a c c o m p l i s h m e n t s made i n s u c h d i v e r s e f i e l d s
as s p a c e e x p l o r a t i o n , a g r i c u l t u r e , h o u s i n g , t r a n s p o r t a t i o n ,
n u c l e a r e n e r g y research, and l a r g e - s c a l e c l e r i c a l and
accounting                                 I t seems i n e v i t a b l e t h a t F e d e r a l



                                                  - 5 -
managers w i l l c o n t i n u e t o r e l y e v e n more h e a v i l y o n computer
s y s t e m s i n s o l v i n g complex p r o b l e m s and f o r managing l a r g e
p r o g r a m s and r e s o u r c e s .
        Because of t h e i r i m p o r t a n c e c o s t w i s e , a s w e l l a s
from t h e s t a n d p o i n t of i m p a c t on t h e p r o g r a m s and a c t i v i -
t i e s i n w h i c h t h e y a r e used, a u t o m a t i c d a t a p r o c e s s i n g s y s t e m s
m u s t be s u b j e c t e d t o i n d e p e n d e n t r e v i e w and e v a l u a t i o n t o f i n d
o u t whether t h e y a r e r e l i a b l e and t o i d e n t i f y ways and means
t o improve them. b h e v e r y m a g n i t u d e o f ADP c o s t s , t o g e t h e r
w i t h e x i s t i n g and p o t e n t i a l problem a r e a s , compels e v a l u a t i n g
t h e i m p a c t o f ADP on p r o g r a m s , o p e r a t i o n s , and r e s o u r c e use.
A u d i t o r s s h o u l d be h e l p i n g t o p management f i n d o u t whether
these r e s o u r c e s a r e u s e d e f f i c i e n t l y , managed e f f e c t i v e l y ,

a n d a r e p r o d u c i n g r e l i a b l e and a c c u r a t e i n f o r m a t i o n and
reports     .
                E
        B u t , o u r work i n GAO r e v e a l s t h a t t o o many a u d i t

o r g a n i z a t i o n s h a v e a v o i d e d e x a m i n i n g computer s y s t e m s and
applications>             I n o u r most r e c e n t r e p o r t d e a l i n g w i t h
computer a u d i t i n g i n t h e e x e c u t i v e d e p a r t m e n t s released
j u s t l a s t month--there              i s a copy i n y o u r s e m i n a r material--
w e p o i n t e d o u t t h a t t h e r e is a l o n g h i s t o r y o f Federal
agency a u d i t o r g a n i z a t i o n s ' a v e r s i o n t o w o r k i n v o l v i n g com-
p u t e r s a n d computer-based a p p l i c a t i o n s .         W e have noted t h a t
t h i s a v e r s i o n was p r e s e n t i n the p r i v a t e s e c t o r a s w e l l a s



                                             - 6 -
        i n t h e F e d e r a l Government.                  The p r o b l e m p r o b a b l y e x i s t s a t

        S t a t e and l o c a l government l e v e l s a s well.

                Does t h e a u d i t o r who a v o i d s t h e computer--or                      attempts
    *   t o a u d i t a r o u n d t h e computer--meet                  accepted a u d i t standards?
        The answer h a s t o b e a r e s o u n d i n g " n o . "
                O u r r e p o r t c o n c l u d e d t h a t n o t enough c o m p u t e r a u d i t i n g
        was b e i n g d o n e by e x e c u t i v e - b r a n c h a g e n c y a u d i t o r s , a n d
        i t p r e s e n t e d s e v e r a l recommendations t o a g e n c y h e a d s and

        their audit organizations for actions t o strengthen t h i s
        most i m p o r t a n t e l e m e n t o f management c o n t r o l .                 I n more p e r -
        s o n a l terms, here i s how we t h i n k i n d i v i d u a l a u d i t o r s
        s h o u l d l o o k a t what t h e y a r e d o i n g .
                F i r s t , o n e v e r y j o b , h e s h o u l d ask h i m s e l f , " W i l l

        t h e computer-pr0duce.d d a t a h a v e a n i , n f l u e n c e qn, my
                                -
                                5,-. I   I            i.-u,
                                                         -----"--I
                                                                   \&--  ";Lv&>,
                                                                              /-I

                  ?Ig I f t h e answer i s y e s a n d h e d o e s n o x p u r s u e

.       t h e t r a i l i n t o the-computer (wherever i t g o e s )
                                                                                        3     t h e n h e is
        a v o i d i n g t h e computer.                Sometimes t h e s e r i s k s a r e t a k e n
        t o k e e p a u d i t c o s t s down, b u t h e s h o u l d know t h a t t h e
        r i s k s i n c l u d e having q u e s t i o n s r a i s e d on t h e i n t e g r i t y
        o f his work--the                    v e r y theme of t h i s s e m i n a r .
                S e c o n d l y , & h e a u d i t o r s h o u l d i d e n t i f y t h e t y p e s o f ADP
        a u d i t t a s k s t h a t he might be c o n f r o n t e d w i t h i n t h e n e x t
        3 y e a r s o r s o and t h e n i d e n t i f y t h e ADP knowledge a n d s k i l l s

        h e w i l l need t o perform t h e s e t a s k s p r o f e s s i o n a l l y .
                                                                                               3      T h i s may


                                                             - 7 -
seem l i k e a n u n i m p o r t a n t s t e p , b u t i t i s p e r h a p s t h e m o s t
important one he can take.                      The c o m p u t e r f i e l d i s s o wide

t h a t h e c o u l d a t t e n d c o u r s e s i n d e f i n i t e l y and s t i l l n o t

b e f o c u s i n g o n h i s r e a l n e e d s a s an a u d i t o r . [He          should
i n v e s t h i s t r a i n i n g time w i s e l y a n d aim f o r s p e c i f i c r e s u l t s
f r o m t h e t r a i n i n g 2 O t h e r w i s e , h e a n d his e m p l o y e r may f i n d
t h e m s e l v e s g e t t i n g f r u s t r a t e d a n d t u r n e d o f f because o f
unwise t r a i . n i n g c h o i c e s .
        With r e s p e c t t o c o m p l i a n c e w i t h a u d i t i n g s t a n d a r d s ,
t h e GAO " S t a n d a r d s f o r A u d i t o f Governmental O r g a n i z a t i o n s ,

Programs, A c t i v i t i e s & F u n c t i o n s " s t a t e s :
        ".If t h e a u d i t work r e q u i r e s e x t e n s i v e r e v i e w
        of computerized systems, t h e a u d i t s t a f f m u s t
        include persons having t h e a p p r o p r i a t e s k i l l s .
        T h e s e s k i l l s may be p o s s e s s e d by s t a f f members
        o r by c o n s u l t a n t s t o t h e s t a f f . "
        The need f o r a u d i t o r s t o d e v e l o p t h e i r t e c h n i c a l
c o m p e t e n c e and p e r f o r m work i n t h e c o m p u t e r a r e a is
f u r t h e r b r o u g h t o u t by t h e r e c e n t r e p o r t o f t h e I n s t i t u t e
o f I n t e r n a l A u d i t o r s on s y s t e m s a u d i t a b i l i t y a n d c o n t r o l .
        Among t h e p r i n c i p a l c o n c l u s i o n s o f t h a t s t u d y w e r e
the following:
        L I n t e r n a l auditors must participate i n the
         L
            system development p r o c e s s t o i n s u r e t h a t appro-
            p r i a t e a u d i t and c o n t r o l features a r e d e s i g n e d
            i n t o new computer-based               information systems.


                                                - 8 -
 ...
..




               --Controls        m u s t be v e r i f i e d b o t h b e f o r e a n d a f t e r
                  i n s t a l l a t i o n o f computer-based s y s t e m s .
               --As a r e s u l t of t h e g r o w t h i n c o m p l e x i t y and
                  use o f computer-based i n f o r m a t i o n s y s t e m s ,
                  needs e x i s t f o r g r e a t e r i n t e r n a l a u d i t involve-
                  ment r e l a t i v e t o auditing i n the data processing
                  environment.
               --An    i m p o r t a n t need e x i s t s f o r EDP a u d i t s t a f f
                  d e v e l o p m e n t b e c a u s e few i n t e r n a l a u d i t s t a f f s
                  have enough d a t a p r o c e s s i n g knowledge and
                  experience t o a u d i t e f f e c t i v e l y i n t h e data
                  processing environment.
               --Many     organizations-are not adequately evaluat-
                  i n g t h e i r a u d i t and c o n t r o l f u n c t i o n s i n t h e
                  data processing environment.                       Top management
                  should i n i t i a t e a p e r i o d i c assessment of i t s
                  a u d i t and c o n t r o l programs
                                                              -3
               I n t o d a y ' s e n v i r o n m e n t , good a u d i t s of c o m p u t e r s and
       a u t o m a t e d a p p l i c a t i o n s r e q u i r e t e c h n i c a l competence f a r
       beyond t h a t r e q u i r e d of a u d i t o r s i n t h e p a s t .          The time

       is l o n g gone t h a t a u d i t o r s c a n b o t h i g n o r e t h e e x i s t e n c e
       o f t h e computer and s u c c e s s f u l l y d i s c h a r g e t h e i r r e s p o n s i -
       bilities.         Again, r e f e r r i n g t o w h a t I s a i d e a r l i e r , w e a s
       a u d i t o r s must t a k e t h e needed a c t i o n s t o a c q u i r e t h e


                                                      - 9 -
I   I       . . =.   . . ,,

....   I.




                     n e c e s s a r y t e c h n i c a l s k i l l s and knowledge t o s u c c e s s f u l l y

                     a u d i t i n t h e computer environment.                    W i t h o u t t h e s e capa-
                     b i l i t i e s , our work w i l l be s u b s t a n d a r d , and t h o s e who r e l y
                     on s u c h a u d i t s w i l l b e m i s l e d .      I n a d e q u a t e work i n t h i s

                     area can b a d l y damage t h e a u d i t o r ' s r e p u t a t i o n f o r
                     r e l i a b i l i t y and competence.
                                I do n o t wish t o convey n o t h i n g b u t gloom a n d doom

                     t o you, however.              Many a u d i t o r g a n i z a t i o n s have t h e c a p a b i l i t y

                     t o do e x c e l l e n t computer a u d i t i n g , and many o f you a r e t r y -
                     i n g t o f u r t h e r your c a p a b i l i t i e s .
                                B u t , i n many a u d i t o r g a n i z a t i o n s , a s t r u c t u r e d , long-

                     r a n g e approach i s needed t o b r i n g i n t e r n a l a u d i t o r s t o
                     t h e p o i n t w h e r e t h e y can d e a l e f f e c t i v e l y w i t h computer
                     s y s t e m s and a p p l i c a t i o n s .   To a c h i e v e t h e d e s i r e d l e v e l ,

                     t o p management m u s t p r o v i d e s t r o n g d i r e c t i o n t o a u d i t o r s
                     t o d e v e l o p a program f o r a p p r o p r i a t e involvement and
                     p e r i o d i c r e p o r t i n g of p r o g r e s s made.
                     CATEGORIES OF COMPUTER A U D I T I N G-
                              c o m p u t e r a u d i t i n g c a n b e d i v d e d i n t o two broad
                     categories         .
                                One c a t e g o r y c o n s i s t s o f a u d i t i n g what i s done by
                     a c o m p u t e r 3 i n o t h e r words I a u d i t i n g a computer a p p l i c a t i o n .
                     An example would b e a review o f a n automated a c c o u n t s p a y a b l e
                      system.         Such a n a u d i t might w e l l encompass t h e adequacy


                                                                     -   10   -
 ....
.. 1




        of c o n t r o l s over i n p u t d a t a , o v e r t h e i n t e g r i t y o f t h e

        c o m p u t e r ' s p r o c e s s i n g , a n d o v e r computer o u t p u t p r o d u c t s .
             &he        second t y p e of computer a u d i t i n g i s much b r o a d e r

        and g o e s f a r beyond t h e computer i t s e l f .
                                                                          -3    T h i s type

                      i
        i n v o l v e s examining q u e s t i o n s s u c h a s t h e f o l l o w i n g :
                --Is t h e system p r o p e r l y d e s i g n e d ?
                --Is t h e r e a v a l i d r e q u i r e m e n t f o r t h e system
                   or application?
                --Is t h e computer b e i n g o p e r a t e d e f f i c i e n t l y ?
                --Are      t h e system p r o c e d u r e s documented p r o p e r l y ,
                   and a r e t h e y up t o d a t e ?
                --Are. t h e f u n c t i o n a l users s a t i s f i e d w i t h t h e
                    output products?
                --Is t h e computer c o n f i g u r a t i o n a p p r o p r i a t e f o r
                    t h e work t o be performed?
                --Are     a l l p e r s o n n e l (ADP a s w e l l a s f u n c t i o n a l
                    s t a f f ) a d e q u a t e l y t r a i n e d f o r o p e r a t i o n and
                    u s e o f t h e system?
                                                   3
              YBoth t y p e s o f computer a u d i t i n g a r e w i t h i n t h e a r e a
              L-


                                                                             3
        of r e s p o n s i b i l i t y of t h e i n t e r n a l a u d i t o r who i s r e s p o n s i b l e
        t o management f o r h e l p i n g assure t h a t o p e r a t i o n s a r e b e i n g
        c a r r i e d o u t e c o n o m i c a l l y , e f f i c i e n t l y , and e f f e c t i v e l y i n
        a c c o r d a n c e w i t h t h e d i r e c t i v e s of management.             But, as I

        have a l r e a d y i n d i c a t e d , however, w e have o b s e r v e d t h a t t o o


                                                       -   11   -
many i n t e r n a l a u d i t g r o u p s s h u n ADP a u d i t i n g , p a r t i c u l a r l y t h e
second o r broader a s p e c t .
AUTOMATED DECISIONMAKING          -
        To i l l u s t r a t e t h e need f o r c l o s e l y s c r u t i n i z i n g ADP

a p p l i c a t i o n s , l e t me b r i e f l y d e s c r i b e t h e outcome o f o n e
of o u r computer a u d i t s .
        About a y e a r a g o , w e r e l e a s e d a r e p o r t e n t i t l e d
"Improvements Needed i n Managing Automated D e c i s i o n m a k i n g
by Computers T h r o u g h o u t t h e F e d e r a l Government."                     I n our
a u d i t work a t a n a v a l i n s t a l l a t i o n , w e o b s e r v e d t h a t cer-
t a i n t y p e s of s t o c k s i n a n a u t o m a t e d i n v e n t o r y s y s t e m w e r e
b u i l d i n g . u p , though t h e y should n o t have been.                     A f t e r some

d i g g i n g , w e d i s c o v e r e d a q u i r k i n t h e computer program
which h a d t h e e f f e c t of d o u b l e c o u n t i n g r e q u e s t s f o r i s s u a n c e

of p a r t s and s u p p l i e s .       N a t u r a l l y , t h e computer o r d e r e d
r e p l a c e m e n t s a u t o m a t i c a l l y t o accommodate t h i s a p p a r e n t
i n c r e a s e i n t h e need f o r s u c h p a r t s a n d s u p p l i e s .          But t h e
r e s u l t was t h a t unneeded s t o c k was o r d e r e d .
        No o n e had q u e s t i o n e d t h e c o m p u t e r ' s o u t p u t .        Before
w e l o o k e d i n t o t h e c a s e s , t h e c o m p u t e r ' s a c t i o n s were
assumed t o b e c o r r e c t .          Our a u d i t o r s worked t o g e t t h e
s i t u a t i o n remedied.         Then w e began t o wonder how f r e q u e n t l y
o t h e r s i t u a t i o n s o f t h i s t y p e m i g h t e x i s t where a c o m p u t e r ' s
i n p u t was r e s u l t i n g i n a c t i o n s b e i n g t a k e n a u t o m a t i c a l l y - -
a c t i o n s t h a t c o u l d be wrong--with            no r e v i e w b y human b e i n g s .
                                                -   12   -
.,-
,
    ...



                  We r e v i e w e d t h e r e p o r t s of o t h e r i n t e r n a l a u d i t
          a g e n c i e s w i t h i n t h e Government t o f i n d o u t w h e t h e r
          s i m i l a r s i t u a t i o n s had been e n c o u n t e r e d e l s e w h e r e .      These
          r e p o r t s p r o v i d e d u s t h e answer i n a s h o r t time.                 We were

                                                S
          s u r p r i s e d t o f i n d t h a t i t was r a t h e r common f o r i n t e r n a l
          a u d i t o r s t o e n c o u n t e r a u t o m a t e d s y s t e m s t u r n i n g o u t bad
          decisions--decisions                n o t b e i n g d e t e c t e d by o p e r a t o r s a n d
          users o f t h e s y s t e m .
                                           3    The i n t e r n a l a u d i t o r s had u n e a r t h e d

          t h e e r r o r s i n a u t o m a t e d s y s t e m s , had r u n them down, and

          had c o r r e c t i v e a c t i o n s t a k e n .     But--and        h e r e is t h e important
          point-&ach          of these had been t r e a t e d a s a n i n d i v i d u a l case
          when, i n f a c t , t h e r e was a p a t t e r n o f s u c h bad d e c i s i o n s
          E v e n t u a l l y , w e were a b l e t o a t t r i b u t e t h e s e s i m i l a r c a s e s
                                                                                                          >
          t o bad p r o g r a m i n g , bad d a t a , o r a c o m b i n a t i o n o f t h e
          two.      These f a c t o r s , t o g e t h e r w i t h a l m o s t u n q u e s t i o n i n g

          a c c e p t a n c e o f t h e o u t p u t s of c o m p u t e r s a s c o r r e c t , had
          r e s u l t e d i n losses amounting t o h u n d r e d s o f m i l l i o n s o f d o l -
          l a r s t h r o u g h e r r o n e o u s payments, o r d e r i n g unneeded items,
          i n c o r r e c t e l i g i b l i t y d e t e r m i n a t i o n s , and t h e l i k e .

               i  By e s t a b l i s h i n g t h a t t h i s p a t t e r n e x i s t e d r a t h e r
          g e n e r a l l y a c r o s s t h e Government, and i n d i s c l o s i n g t h e
          m a g n i t u d e o f t h e e r r o r s b e i n g made, w e were a b l e t o c o n v i n c e
          t h e O f f i c e o f Management and Budget o f t h e need t o i s s u e

          s p e c i f i c d i r e c t i v e s t o a l l Federal d e p a r t m e n t s and a g e n c i e s


                                                           -   13   -
d i r e c t i n g them t o t a k e t h e b r o a d c o r r e c t i v e s t e p s

recommended i n o u r r e p o r t .
                                            3
        One o f t h e most i m p o r t a n t o f t h e s e s t e p s i s t h e
p r o v i s i o n f o r i n t e r n a l a u d i t o r s t o make p e r i o d i c r e v i e w s
o f t h e o u t p u t o f a u t o m a t e d s y s t e m s t o see w h e t h e r t h e
d e c i s i o n s b e i n g made a r e c o r r e c t .          Another is t o e n c o u r a g e
e a r l y a u d i t o r involvement i n t h e development of s u c h
s y s t e m s t o m a k e s u r e t h a t a p p r o p r i a t e c o n t r o l s and a u d i t
t r a i l s are b u i l t i n .        T h l s r e p o r t h a s made a n i m p o r t a n t

c o n t r i b u t i o n t o improving t h e u s e o f c o m p u t e r s i n t h e
Federal Government and t o d e m o n s t r a t i n g t h e need f o r

c o n t i n u e d , c a r e f u l s u r v e i l l a n c e by i n t e r n a l a u d i t o r s
of computer s y s t e m s .
CURRENT COMPUTER AUDITING PRACTICE
         I n o u r more r e c e n t r e p o r t on computer a u d i t i n g t h a t
I mentioned e a r l i e r , w e cited s e v e r a l examples of t h e

a v o i d a n c e o f computer work by a u d i t o r g a n i z a t i o n s .                   We

a l s o found i n o u r r e v i e w t h a t some a g e n c i e s h a v e d e v e l o p e d
t h e c a p a b i l i t y t o p e r f o r m computer a u d i t s .            T r u e , t h e capa-
b i l i t i e s v a r y w i d e l y among t h e d e p a r t m e n t s and a g e n c i e s ,

b u t n e v e r t h e l e s s , w e Learned t h a t , where s u c h c a p a b i l i t y
had b e e n d e v e l o p e d , e x c e l l e n t - - e v e n    spectacular--audit
r e s u l t s have b e e n r e p o r t e d .


                                                  -   14   -
.   C




              r e p o r t e d t h a t some i n t e r n a l a u d i t g r o u p s i n t h e
Federal Government a r e c o n d u c t i n g c r i t i c a l a n d s e a r c h i n g

a n a l y s e s o f ADP r e s o u r c e s , d e t e r m i n i n g t h e e f f e c t i v e n e s s
of a u t o m a t e d s y s t e m s , and a s s e s s i n g t h e a d e q u a c y o f t h e
ADP f u n c t i o n s t o meet u s e r s ' needs-e                    a l s o learned that
                                                              /-i
ADP a u d i t i n g c o v e r s a wide spectrum i n t h e d e p a r t m e n t s

and a g e n c i e s .     O u r r e p o r t d e s c r i b e d o r c i t e d examples
o f computer a u d i t i n g work i n t h e a r e a s of s y s t e m d e s i g n
a n d d e v e l o p m e n t , e q u i p m e n t a c q u i s i t i o n , ADP i n s t a l l a t i o n
management, and s p e c i f i c a p p l i c a t i o n s .
A I R FORCE EXAMPLE

        One o f t h e s e a u d i t s was p e r f o r m e d by t h e A i r F o r c e
A u d i t Agency.         I t reviewed proposed system c o n c e p t s ,

s u p p o r t i n g r a t i o n a l e , and d o c u m e n t a t i o n f o r a n a u t o m a t e d
management i n f o r m a t i o n s y s t e m .          Matters c o n s i d e r e d i n c l u d e d
t h e a d e q u a c y o f o b j e c t i v e s i n r e l a t i o n t o user n e e d s , c o s t
r e l i a b i l i t y , and whether t e c h n i c a l r e q u i r e m e n t s were v a l i d .
         The a u d i t o r s d e t e r m i n e d t h a t u s e r n e e d s , s y s t e m c a p a -

                                                 -
b i l i t i e s , a n d r e s o u r c e s had n o t b e e n s u b s t a n t i a t e d i n

t h e o r i g i n a l r e q u i r e m e n t s document.          T e c h n i c a l and e q u i p m e n t
s p e c i f i c a t i o n s were n o t s u b s t a n t i a t e d by adequate s t u d i e s ,
and users i n d i c a t e d t h e r e w a s l i t t l e need f o r t h e proposed
o n l i n e d a t a base.




                                                 -   15   -
        The o r i g i n a l economic a n a l y s i s - - w h i c h        identified
t h e estimated c o s t s and b e n e f i t s - - w a s          i n a c c u r a t e and unsub-
s t a n t i a t e d , according t o the auditors,                    F u r t h e r examina-
t i o n d i s c l o s e d t h a t t h e p r o j e c t e d manpower r e d u c t i o n ,
c o m p r i s i n g most o f t h e p r o j e c t e d s a v i n g s , was n o t
realistic.
        T h i s a u d i t r e s u l t e d i n a major change i n t h e s c o p e ,

e q u i p m e n t , and p e r s o n n e l r e q u i r e m e n t s f o r t h e s y s t e m .
The r e v i s e d r e q u i r e m e n t s , a p p r o v e d a t j u s t u n d e r $5 m i l l i o n ,

reflected a c o s t avoidance d i r e c t l y a t t r i b u t a b l e t o t h e
a u d i t o f o v e r $31 m i l l i o n .

        Of c o u r s e , computer a u d i t s w i l l n o t a l w a y s p r o v i d e

such spectacular results.                     T h i s i s t r u e o f all a u d i t i n g .

T h i s example a l s o i l l u s t r a t e s t h a t i n t h e a u t o m a t i c d a t a

p r o c e s s i n g a r e a , a s w e l l a s i n many o t h e r a r e a s , t h e ’ a u d i t o r
c a n o f t e n m a k e a n i m p o r t a n t c o n t r i b u t i o n by g e t t i n g i n v o l v e d
b e f o r e f i n a l d e c i s i o n s a r e made.

                   -
THE PROBLEM OF FRAUD

         B e f o r e c l o s i n g , l e t m e b r i n g o u t o n e o t h e r problem--
a n d t h a t i s d e t e c t i n g t h e e v e r - p r e s e n t p o s s i b i l i t y of
fraud.        Fraud i s a b r o a d term c o v e r i n g many k i n d s o f s i n s ,

b u t i n e s s e n c e , it amounts t o u n l a w f u l l y s e p a r a t i n g p e o p l e

o r o r g a n i z a t i o n s from money o r r e s o u r c e s t h a t r i g h t f u l l y
b e l o n g t o them.


                                                -   16   -
                       .


        F e d e r a l a u d i t o r s have t o k e e p a wary e y e o u t f o r t h i s
p o s s i b i l i t y a t a l l times.        T h e a d v e n t o f computer t e c h n i -

q u e s and s y s t e m s h a s n o t lessened t h e i r c o n c e r n o r r e s p o n -
s i b i l i t y i n a n y way.        I n f a c t , i t h a s p r o b a b l y made it
worse.
        Those of you who read The N e w Yorker magazine saw t h e
r e c e n t l e n g t h y a r t i c l e by Thomas W h i t e s i d e on t h i s s u b j e c t .
H i s v e r y readable a r t i c l e made i t c l e a r t h a t o u r s o c i e t y

i n c l u d e s many who a r e q u i t e w i l l i n g t o t a c k l e t h e t e c h n i -
c a l c h a l l e n g e of m a s t e r i n g t h e w o r k i n g s o f computer
s y s t e m s t o d i v e r t money o r o t h e r r e s o u r c e s u n l a w f u l l y f o r
their personal use.

        GAO s e n t a r e p o r t t o t h e C o n g r e s s a l i t t l e o v e r a

y e a r a g o summarizing q u i t e a number o f computer f r a u d
cases i n t h e Federal Government.                        These cases had b e e n
brought t o l i g h t through agency checks and audits--not                                 by
GAO--but
                                                                     I
               t h e p o i n t o f t h e r e p o r t was t h a t managers a n d
a u d i t o r s h a v e t o b e a l e r t a l l t h e time t o t e s t t h e i r
s y s t e m s t o d e t e c t f r a u d and t i g h t e n them when f r a u d i s
found t o p r e v e n t it i n t h e f u t u r e
        The g e n e r a l p u b l i c - - t h e
                                                           >
                                                  man o r woman i n t h e s t r e e t - -
may know l i t t l e o r n o t h i n g a b o u t t h e t e c h n i c a l i t i e s of
c o m p u t e r s o r i n t e r n a l management c o n t r o l s .        B u t when t h e y

read a b o u t f r a u d s i n v o l v i n g t h e l o n g , u n d e t e c t e d s t e a l i n g


                                                  -   17   -
of money by m i l k i n g a n o r g a n i z a t i o n ' s s y s t e m , c o m p u t e r -
based o r n o t , t h e m o s t l i k e l y q u e s t i o n t o b e r a i s e d i n t h e i r
minds f i r s t w i l l b e , "Where w e r e t h e a u d i t o r s ? "

        Auditors cannot escape a c c o u n t a b i l i t y f o r weak
a c c o u n t i n g a n d c o n t r o l sy$tems.        T h i s i s t r u e even though
                                          p
                                          i'
primary r e s p o n s i b i l i t y for s t r o n g systems rests w i t h
                                    ..?
management.           Managemen't o f f i c i a l s h a v e t h e job o f d e s i g n -
i n g a n d i n s t a l l i n g good s y s t e m s t o s t a r t w i t h a n d i n c l u d -
ing a l l n e c e s s a r y measures t o p r e v e n t f r a u d .            Internal
a u d i t o r s s u p p o r t those h i g h l y l a u d a b l e o b j e c t i v e s through

t e s t i n g , e v a l u a t i n g , and r e p o r t i n g on t h e i r f i n d i n g s .   The
c o m p u t e r age h a s n o t changed t h i s l i n e u p i n b a s i c r e s p o n s i -
bilities.          I t h a s o n l y made t h e j o b t e c h n i c a l l y h a r d e r t o

perform.
-
C O N C L U D I N G OBSERVATIONS

        W e h a v e s e e n a u d i t o r s who knew l i t t l e o r n o t h i n g

a b o u t c o m p u t e r s become h i g h l y s k i l l e d i n a r e l a t i v e l y s h o r t
time by c o n c e n t r a t i n g on t h e knowledge and t e c h n i q u e s i n
which e x p e r t i s e was needed.
        We have a l s o s e e n p e o p l e t r a i n e d i n t h e computer
s c i e n c e s a c q u i r e t h e a u d i t s k i l l s needed t o p e r f o r m
expertly as auditors.




                                               -   18   -
                     I   .      .4    . *




                  Thus, it is p o s s i b l e f o r a u d i t o r g a n i z a t i o n s t o a c q u i r e

          t h e e x p e r t i s e t h e y need.       With t h a t e x p e r t i s e , t h e y s h o u l d h a v e
          t h e confidence t o tackle t h e d i f f i c u l t j o b o f examining t h e
          computer s y s t e m s i n t h e i r a g e n c i e s .         And, by d o i n g s o , t h e y

          c a n d e m o n s t r a t e t o management o f f i c i a l s t h a t t h e y a r e o n t o p

          of t h e i r j o b and a r e b e t t e r p r e p a r e d t o c o n s t r u c t i v e l y a s s i s t
          those o f f i c i a l s i n discharging their responsibilities.
                  I n c l o s i n g , l e t me r e f e r o n c e a g a i n t o t h e r e c e n t GAO

          r e p o r t o n computer a u d i t i n g .         Management o f f i c i a l s a n d a u d i -
          t o r s i n t h e F e d e r a l agencies--and               elsewhere--should         review               c


                                                                                                                         f-

          i t c a r e f u l l y and ask t h e m s e l v e s w h e t h e r t h e s h o e f i t s .     They
\-   _-
          s h o u l d a s k t h e m s e l v e s w h e t h e r t h e y a r e d o i n g enough a u d i t i n g
          of t h e i r s y s t e m s .       If t h e y conclude t h a t t h e y a r e n o t doing

          enough, t h e y s h o u l d t h e n b e a b l e t o r e c o g n i z e t h e r i s k s t h a t
          t h e y are t a k i n g .         I would hope t h a t s u c h r e c o g n i t i o n would

          i n t u r n l e a d them t o t a k e t h e v i g o r o u s a n d d e c i s i v e a c t i o n s
          needed t o s h o r e u p a s e r i o u s weakness i n t h e i r i n t e r n a l
          management c o n t r o l s y s t e m s .




                                                         -   19   -