(iii) Other techniques
There are increasing numbers of other techniques that can be used; the main two are:
Integrated test facility – used when test data is run live; involves the establishment of dummy records, such as departments or customer accounts to which the dummy data can be processed. They can then be ignored when client records are printed out, and reversed out later.
Embedded audit facilities (embedded audit monitor) – also known as resident audit software; requires the auditor’s own program code to be embedded into the client’s application software. The embedded code is designed to perform audit functions and can be switched on at selected times or activated each time the application program is used. Embedded facilities can be used to:
– Gather and store information relating to transactions at the time of processing for subsequent audit review; the selected transactions are written to audit files for subsequent examination, often called system control and review file (SCARF)
– Spot and record (for subsequent audit attention) any items that are unusual; the transactions are marked by the audit code when selection conditions (specified by the auditor) are satisfied. This technique is also referred to as tagging.
The attraction of embedded audit facilities is obvious, as it equates to having a perpetual audit of transactions. However, the set-up is costly and may require the auditor to have an input at the system development stage. Embedded audit facilities are often used in real time and database environments.