Evaluating access control - all the data in the ERP are in one single database. Access to the data has to be secured not only at the application level, but also at the operating system, database and network levels through suitable controls. The IS auditor will review the network, OS and DBMS before evaluating the access controls in the application