2005-274 - Laserfiche WebLink

Home Browse Search

Commitment to Quality Service Audit Approach Information Systems Audit Procedures Michael Lockwood, our firm ' s Director of Information Technology, will perform the review of the County ' s information systems environment. Mike performs such reviews for clients throughout our firm, particularly county and city governments . With Mike , the County will have the assurance of direct review by a senior level individual with 19 years of experience directly related to information systems . Further, his presence will provide continuity from year to year and insight to the industry' s best practices . Mike will assess the effect of systems processing on the County ' s business and the reliability of systems processing. He will focus on providing constructive service comments intended to improve the quality of information and systems controls . The results of this assessment will be integrated into our audit approach to improve audit efficiency and to further define the manner in which we address identified risk factors . Examples of computer controls that will be reviewed for each system include the following: • Information Security. The information security function is responsible for the administration and maintenance of a client ' s information security program, including both physical and logical security. The primary goal of such a program is to ensure that access to programs, data, on-line transactions, and other computing resources is restricted to authorized users . Our review of general computer controls in the information security area will include an appropriate consideration of the level of security that is adequate for a particular processing environment and the availability of access control mechanisms in that environment. • Systems Acquisition, Development, and Maintenance. Systems development personnel are responsible for the selection and/or design, programming, and maintenance of the application systems processed to meet the needs of the various users . Our audit procedures are designed to ensure that application programs are designed, implemented, and maintained according to management ' s intentions and in accordance with industry accepted practices . • Computer Operations . The computer operations department is responsible for the day-to -day processing activities of the systems, ensuring that jobs are scheduled and processed in accordance with established routines . It is also responsible for the physical control of data stored on portable media and timely, accurate distribution of reports to users . Our review will be to test that these control procedures were effective throughout the review year. Determining Laws and Regulations Our compliance audit procedures will be designed to identify and test those transactions and activities that are likely to have a financial impact on the County ' s basic financial statements and to determine whether they were carried out in accordance with the provisions of laws, rules , contracts, and grantor guidelines . Our reports will note instances of noncompliance that could have a material effect on the County ' s financial statements . The nature and extent of our compliance tests are derived from the following: • Results of our analysis of internal control over compliance matters . • Review of bond documents . • Review of federal OMB Circulars, Compliance Supplement, and other pronouncements . • Correspondence with federal and state agencies . • Review of County agreements . • Review of County internal policies . 37