Nowadays, the role of the Internet as a medium of communication and information grow rapidly. This can be seen with the number of companies or organizations that use the internet as a media campaign and information, and even business transactions. One of the many facilities that are used World Wide Web (www) or homepage that allows a company to have its own website on the internet.
Through the company’s homepage can display more informations about the profile, products or services that are owned by the company with just write the address the company’s homepage (http://www.companyname.co.id).
Compared to the benefits of the Internet media campaign and other information is a very broad scope, covering all the world, the availability of information for 24 hours and costs that are cheaper.
We offer several web design services as follows:
Search the site
Random Testimonial
- ~ How do you Audit an ERP System?
"There are few rules that can be applied to all ERP auditing situations. As each system serves the client in a different capacity and has been altered to fit the client?s business model, ERP auditors must be flexible and creative in designing an audit plan. On the same note, there are no hard rules on splitting roles and responsibilities between audit groups. Role differentiations are determined on a client-to-client basis, as a function of auditor experience, expertise and training. A common distinction is made between financial auditors and information systems auditors. However, with ERP, financial reporting and especially internal accounting controls, must be audited working through the computer; therefore, it is important that auditors have knowledge of both accounting and technology, learning new skills sets in the process (Moulton). Specialists are also commonly hired to determine if complex technology is working correctly. The concept of an ?integrated auditor,? who has enough accounting and IT knowledge to work both sides of the audit, has emerged as workable solution to the complexities of ERP auditing (Hahn).
~ ~ ~ ~ ~ ~ ~ ~ ~ ~
ERP systems are technically complex, with the system residing on multiple computers and the flexibility to support multiple configurations and customizations (Hahn). To begin understanding a client's ERP system, auditors must evaluate how the technology relates to the business environment. To determine the scope of the audit, they must take into consideration:
~ ~ ~ ~ ~ ~ ~ ~ ~ ~
- How the technology is used in the organization
- the number of people using the technology
- which ERP models have been implemented
- the existence of distributed applications
- whether legacy systems are used and to what capacity (Hahn)
Auditors must go through a significant amount of training to acquire the knowledge necessary to adequately understand the functioning of an ERP system and how it intakes data and produces financial reports. Auditors must also consider learning new tools to take advantage of functions in ERP systems. SAP?s language, ABAP/4, would be useful for an auditor to know so that he can examine the programming code when there is a question about the functioning of the system (Hahn). As another example, Oracle?s database comes with its own set of basic auditing actions designed to detect unauthorized access and internal abuse of the data being stored (Finnigan).
~ ~ ~ ~ ~ ~ ~ ~ ~ ~
ERPs have specifically influenced the auditing profession in four main ways: the interaction and flow of information, issues with data and the processing of data, controls and security of the data and the systems, and training of employees who use the ERP systems.
~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Interaction and the Flow of Information - With an ERP system, operational and financial data are tied together through a complex information flow. Transactions can be automatically entered without review or pre-checking. Therefore, ERP?s make it difficult to perform financial audits without relying on system controls. Such controls should be designed, in part, to prevent inaccurate or false information from entering the system. As many transactions are automated functions of modules creating information entries for other modules, it is impossible to audit ?around the computer? (i.e. comparing input to output). Rather, auditing must be done ?through the computer? (i.e. testing the system process that the input went through to create the output), using such methods as test decks and parallel simulation. In order to conduct a proper audit through the computer, the auditor must have a certain level of understanding about technology and how the system functions.
~ ~ ~ ~ ~ ~ ~ ~ ~ ~
The ideal of a paperless office? is facilitated through an ERP system, because the system is centralized and communicates data from a common internal source, the database. Instead of hardcopy evidence, ERP?s create event history logs for a visible trail of evidence to trace information to the original input source (Adint). These audit trails allow an auditor to both detect when an undesirable event has occurred and reconstruct an event by what happened. At a minimum, the trails should contain the user ID, the data and time of the event, and the action taken. Other information could include previous and current field values (Adint). Auditors of ERP systems need to be cognizant of how to use these audit trails and the appropriateness of their design because it impacts the ability to rely on system controls or the output created.
~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Because ERPs are customizable and often changed by an organization?s internal programmers, auditors must pay attention to how these changes take place. The production code forms the basis of running the ERP system. To protect this valuable asset, changes in the production code should be:
~ ~ ~ ~ ~ ~ ~ ~ ~ ~
- authorized by the business owner (if functional) or IT manager (if technical)
- tested thoroughly
- approved by the business owner or IT manager
- performed by an authorized person
- documented
To verify the controls of authorization and approval are valid, any change to the code should be traceable to a request. Access to the production code should be limited and traceable to the authorized individual who made changes. To check these, auditors must look for hard-copy documentation, such as change request forms, as well as documentation embedded in the code itself (Adint).
~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Controls and Security - It is important for any entity to segregate the duties of authorization of transactions, recording of transactions, and custody of transactions. Auditors should examine the business process flows to identify where authorization, recording, and custody of a business transaction takes place, and compare it to how the user responsibilities have been designed. Often user responsibilities are given wide-open access for the initial installation, but rarely are access restrictions introduced once the system has proven functional. Also, the auditors should check to see if the segregation of duties is accomplished with a combination of system and off-line controls. Segregation of duties should be designed into user responsibilities and functions, and"
- Read more testimonials »
