1. Is the EDP function independent from the accounting and operating functions for which it processes data?
2. Does appropriate segregation of duties exist within the data processing function for systems developments (design and programming), technical support (maintenance of systems software), and operations?
3. In smaller and minicomputer installations with limited opportunities for segregation of duties, do procedures exist for user departments to:
a. utilize batch or other input controls?
b. control master file changes?
c. balance master files between processing cycles?
4. Do the personnel policies of the EDP function include such procedures as reference checks, security statements, rotation of duties, and terminated employee security measures that enhance segregation of duties and otherwise improve controls?
5. Do controls exist over preparation and approval of input transactions outside the EDP function, and is the EDP funtion prohibited from initiating transactions? ~_
6. Does the user exercise control procedures over input to ensure that all approved input is processed correctly, and only once through the system?
7. Do controls exist over entry of data in on-line systems to restrict access to terminals and data entry to authorized employees?
8. Do on-line systems controls exist that prevent documents from being keyed into the system more than once, and that permit tracing from computer output to data source and vice versa?
9. Do controls exist over changes to master files, such as requiring preparation of specific forms indicating data to be changed, approval by a supervisor in the user department, and verifying against a printout of changes?
10. Do user controls exist over rejected transactions through the use of a computerized suspense file of rejected transactions or an auxiliary manual system?
11. Does user department management reconcile output totals to input totals for all data submitted, reconcile the overall file balances, and review outputs for reasonableness?
12. Do procedures exist within the data processing function that ensure that data is properly controlled between the user and the EDP functions?
13. Do controls exist over data entry, for example, that include adequate supervision, up-to-date instructions, key verification of important fields, and self-checking digits?
14. Do program controls exist over entry of data into on-line systems?
15. Is input data edited and validated?
16. Do data processing controls exist over rejected transactions?
17. Do controls exist for balancing transactions and master files?
18. Do procedures exist within the data processing control function concerning review and distribution of output?
19. Do controls exist over changes to system software?
20. Do controls exist over use and retention of tape and disk files, including provisions for retention of adequate records to provide back-up capabilities?
21. Do controls exist that limit access to data processing equipment, tapes, disks, system documentation, and application program documentation to authorized employees?
22. Is a job accounting system (or console logs) used to ensure that scheduled programs are processed and proper procedures followed and that supervisory personnel know that only required programs have been processed?
23. Are EDP department employees supervised for all shifts?
24. Are procedures to be followed by computer operators documented?
25. Is the data processing system documented such that the organization could continue to operate if important data processing employees leave?
26. Do procedures exist to protect against a loss of important files, programs, or equipment?
27. Are equipment, programs, and data files covered by insurance?
28. Are there user-approved written specifications for new systems and modifications to existing application systems?
29. Are there written procedures to test and implement new systems and modifications to existing application systems?
30. Has the project and implementing entity considered the Year 2000 issue and how it may impact the systems relied on by the project? Has management decided upon a course of action to mitigate this impact? (new step) | ___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___ | ___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___ | ___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
___
|
