YES          NO          N/A

This section should only be competed by agencies that perform electronic data 
processing.

DATA PROCESSING

Statutory References - CGS 3-112 and 4-70b

Segregation of Duties

1.     Is the Data Processing department physically independent from all other departments for 
        which it processes data?

2.     Is the Data Processing department administered independently from any department for 
        which it processes data?

3.     a) Do each of the following components of the Data Processing department operate as its 
            own entity:

                1.     Systems Development (design and programming)?

                2.     Technical Support (maintenance of systems software)?

                3.     Operations (job scheduling and processing)? 

        b) Do each of these components oversee its own security independent of the others?

        c) Are personnel from one data processing component allowed to work in another data 
            processing component? 

4.     Do user departments utilize batch controls as a means of tracking and reconciling input?

        a) Are the changes to the master file reconciled to the batch input by:

                1.     Dollar amount?

                2.     Transaction count (# of records accessed)?

        b) Is this a standard practice at the end of each processing cycle?

5.     a) Are there written data processing personnel policies?

        b) Do they include procedures for:

                1.     Reference checks? 

                2.     Security statements?

                3.     Rotation of duties?

                4.     Security procedure for terminating a data processing employee?

Procedural Controls

         User Controls:

 6.     Are input transactions prepared, approved, and controlled outside of the Data 
         Processing department? 

 7.     Does the user department maintain control of the documents processed through batch 
         control counts, transaction counts or other means to track input through the Data       
         Processing department?

 

        YES          NO          N/A

8.     Is an on-line data entry system in use (i.e., is data entered directly into the system and 
        immediately processed?

        a) Is this on-line data entry system "real time processing"?  

            1.     Are there immediate changes to the master file?

            2.     Are transactions collected in the maintenance master file?

        b) Is access to the on-line terminals restricted to all except authorized employees?

        c) Are the access codes to these on-line terminals changed on a predetermined 
            basis?

        d) Are the access codes sufficiently complex to deter unauthorized access to these 
            terminals?

        e) Is there a terminal or operator identifier on each transaction record?

9.     Are there supporting documents (specific forms) that can substantiate the changes to the 
        master file?

       a) Are changes to the master file supported by a printout of:

           1.     Individual changes?

           2.     Summary of changes?

      b) Are the changes authorized by a supervisor or by a person other than the one
           who inputs the transaction document? 

10.   Are rejected transactions held in a suspense file?       

11.   Can these rejected transactions be reconciled to the total number of transactions input 
        minus the transactions processed?

Applications Controls

12.   Are there written procedures for the control of data between user departments and the 
        Data Processing department?

13.   Are there written procedures for data entry operators on how data is entered into the 
        system for processing? 

14.   Is there an audit release by the supervisor if certain key fields are entered? 

15.   Can each transaction be traced to a specific terminal and/or specific terminal operator?

16.   Are there controls for balancing transaction input data to the master files?

17.   Are rejected transactions listed on a printout and balanced to total number of 
        transactions processed and transactions accepted?

General Controls

18.   Do changes to system software follow a control procedure that insures its integrity?

19.   Are there controls implemented that limit the use of tape and disk files to only 
        authorized persons?

20.   Are there security provisions that limit access to the data processing operations area to
        authorized personnel?

 

     
     
     
     
     
     

        YES          NO          N/A

21.   Are there controls that limit access to tapes, disks, system documentation and application 
        program documentation to authorized employees?

22.   Is there a job accounting control system to document that work scheduled was processed?

23.   Are there controls in the operating environment to document what programs were 
        processed?

24.   Are there controls to determine that proper procedures were followed in processing each 
        program?

25.   Is there EDP supervision for employees on all shifts?

26.   Does the set-up and documentation of each program provide a sufficient trail for transition 
        from one employee to another in case of a promotion, transfer or firing?

27.   Is there a disaster recovery plan in place for:

        a) Equipment?

        b) Programs?

        c) Data files?

28.   a) Is there insurance coverage for the equipment programs and files?

        b) Is this insurance coverage reviewed on an annual basis?

29.   Are there approved written specifications to update or modify existing applications 
        systems?

30.   Is there an approval and testing process for accepting changes to existing applications 
        systems?

        Comments: 

                                      DO NOT WRITE IN THIS BOX - AUDITORS USE ONLY

                                     Preliminary opinion on the above Internal Control Matters:

                                                                     Data Processing

                                                       Good          Fair          Poor