Guidelines for Requesting Data from Computer Systems
The following guidelines will save time and improve the chances for successfully obtaining and testing computer data.
I. PLAN FOR THE REQUEST
Before requesting computer-generated data from IS departments, you should have the following:
1. A basic understanding of the computer system, including the purpose of the system, who uses the system, what data elements (or fields) are available, what reports are routinely generated, and what the data is used for.
2. An audit plan for reviewing or testing the data, including why you are testing the data, who will test it, and what other files will be required.
3. The name and phone number of: 1) the person responsible for maintaining the system; and 2) the person responsible for creating the computer data in response to your request.
To help understand the data in a computer system and identify exactly what data elements (fields) you will need for testing, you must obtain and review the appropriate DATA DICTIONARY or file layout. The dictionary should provide information such as the name, source, purpose, and a narrative explanation of each data element in the system.
II. REQUEST THE DATA IN WRITING
Once you have the above information, you are ready to make your data request. The request letter, usually signed by a manager or above, should include the name of the data elements requested as they are identified in the data dictionary. Request only those data elements that are relevant to your audit test; never request a copy of all the data elements in the system, unless they are all needed to complete your planned test.
Your request letter should include:
~ The date by which you need to have the data;
~ The name and phone number of a person to contact if there are any questions regarding the request;
~ A list of data parameters, such as specific transaction codes or a cut-off date for the data;
~ The format in which you want the data; for example, .dbf, .wkl, flat ASCII or EBCDIC files;
~ The media on which the data is to be put; such as, disk, tape, download, etc.
~ The name and the phone number of the auditor requesting the data; and
~ The name and address to which the data should be sent.
It is very important that the client provide, in writing, the total number of records in the database and the dollar amount (control totals) for all-important numeric fields.
Attachment I provides a list of technical specifications and documentation requirements that the client should use when providing computer data to you. You should provide a copy of the checklist to the client and request that they complete the list and forward it to you with the computer data. Failure to include these specifications may cause a delay in processing the data.
III. AVOID POTENTIAL PROBLEMS
To reduce the probability of delays in processing your data, you should be aware of the following general rules.
1. 1. Be cautious with print files. Print files are usually a copy of data listed on hard copy reports that is stored as a computer file. Accordingly, they often contain data such as headers, footers and subtotals that are shown on reports. If you do request a print file, you should also request some pages of the hard copy report. Also remember that the data in the report file has already been processed. Your test of the original data could be compromised if you limit yourself to just report files.
2. Request fixed length files. Fixed length means that each record in the file has the same number of characters. If the client cannot provide fixed length files, you may have to perform additional steps to import the data into IDEA.
3. Verify that the client provided the required documentation. Incomplete documentation is often the cause of problems in processing computer data. Accordingly, we recommend that you verify that the client has provided all the needed documentation and that the data is in the format you requested. If it is not, you should immediately contact the person responsible for providing the data.
4. Microcomputer files can usually be imported into IDEA. However, there are a wide variety of possible formats. Some formats can be troublesome. For this reason, if the client plans on giving you data in microcomputer format, .dbf files (dbase format) are the easiest file formats to import into IDEA.
ATTACHMENT I
TECHNICAL SPECIFICATIONS FOR COMPUTER DATA
1. Storage Medium:
3480, 3490, or 3490E Cartridge
9-track, 6,250 bytes per inch
Floppy diskette
CD-ROM
Network Server
Other (please explain):
Is the file compressed? Yes No
2. Data Specifications:
File Format:
EBCDIC
ASCII
Dbase
Other (please explain):__________________________________________
File Type:
Fixed Length File
Variable Length File
Field Separator______________________________
Record Delimiter(s)_____________________________________
String Encapsulator__________________________
3. Required Documentation:
a. Record layout that includes:
The beginning and ending position of each data element in the system;
Each data element's width; and
Each data element's type, such as character, numeric with sign embedded, or alphanumeric, etc.
b. Name and phone number of person(s) responsible for creating and providing the file.
c. File Name (Data Set Name)
d. Total number of records in file.
e. Control totals for important numeric fields.