Auditing Computer-Based Systems: Additional GAO Audit Standards

Since the audit coverage accorded computer-based systems often does not measure up to the quality needed to ensure proper results, these standards were issued as a supplement to the 1972 pamphlet entitled "Standards for Audit of Governmental Organizations, Programs, Activities, and Functions." To maintain professionalism in the performance of audit work, the auditor should: (1) actively participate in reviewing the design and development of new data processing systems or applications, and significant modification thereto, as a normal part of the audit function; (2) review general controls in data processing systems to determine that controls have been designed according to management direction and legal requirements and that such controls are operating effectively to provide reliability of the data being processed; and (3) review application controls of installed data processing applications to assess their reliability in processing data in a timely, accurate, and complete manner.