Internal Control Questionnaires and Verification Procedures

Verification Procedures

1. Using an appropriate sampling technique, select an additional MIS project(s) from the organization’s development plan.

   1. Review project objectives and determine if they address reported MIS weaknesses and meet business unit plans.

   2. Determine whether the MIS projects follow an approved and implemented development methodology that encompass the following phases:

      • Analysis of system alternatives, organization of tasks, and approval of phases by system users/owners.

      • Program development and contracts for equipment and software vendors.

      • Development of user instructions and testing the system changes.

      • Installation and maintenance of the system.

2. Using the expanded sample, check copies of relevant user instructions. Verify whether the guidelines are meaningful, easy to understand, and current.

3. Test whether user manuals provide adequate guidelines in the following areas:

   1. Complete description of the system.

   2. Input instructions, including collection points and times to send updated information.

   3. Reconciliation instructions.

   4. Full listing of output reports, including sample formats.

4. Obtain workflows from the user manuals or managers showing data from the point-of-entry, through user processes, to final product.

   1. Test the processes with users to determine if they know where the data is coming from, where it is going, and how it gets there.

   2. Identify the points in which data adjustments occur.

   3. Identify the individuals accountable for contributing to data and reports. Compare information with the material acquired in the step immediately preceding this step.

   4. Test the preparation and reconciliation processes to verify the integrity of information.

   5. Determine if data adjustments are adequately documented.

5. Expand the sample by interviewing additional managers and experienced unit employees to determine their perceptions of MIS.

   1. Discuss MIS principles of timeliness, accuracy, consistency, completeness, and relevancy.

   2. Determine if the employees hold any significant perceptions that the MIS is ineffective.

6. If available, obtain samples of important recurring executive reports for the targeted MIS area(s). Test the following areas to determine if:

   1. Information originates from the expected source business area.

   2. Users of the information are the employees one would expect and the data is being used for correct purposes.

   3. Distribution of the reports ultimately is supplied to all appropriate users.

7. Review a sample of audit work papers relating to reports that disclosed material MIS weaknesses.

   1. Review documents to determine if auditors tested MIS activities against policies or practices and processes.

   2. Test to determine if documented findings support the audit scope and report comments.

Previous: Conclusion Next: Mortgage Banking