Audit Management control framework

1. The Management Control Framework
How can an auditor evaluate top mgt and EDP
mgt involvement in a computer installation?

2. The Management Control Framework
Evaluating the Planning Function
The major plans formulated for a computer
installation include:
• feasibility study
• changeover plan
• master plan
• project plan
• disaster recovery plan.

3. The Management Control Framework
Evaluating the Organizing Function
• The planning process establishes goals and objectives for a
computer installation and the organizing process structures
personnel, facilities, and information flows to enable these
goals and objectives to be achieved.
Centralization Vs Decentralization
• A major organization design issue often facing top and EDP
mgt is whether to centralize or decentralize computer
facilities.
• Some computer operations can be centralized or
decentralized

4. The Management Control Framework
Organizational
Strategy
Advantages Disadvantages
Decentralize
Systems analysis
Better systems
designed through
greater awareness
of user needs
Greater difficulties
in standardizing and
integrating systems
Centralize
Programming
Decentralize H/W
Centralize S/W

5. The Management Control Framework
Selecting hardware/software facilities
• Another aspect of organizing is choosing
suitable hardware/software facilities.
• This involves preparing a manual of
specifications for distribution to vendors and
evaluating vendor proposals and selecting a
final hardware/software configuration.

6. The Management Control Framework
Methods/Performance Standards
• To guide and control its activities, a computer
installation must have: a methods standards
and performance standards.
• Methods standards have four major purposes
(a) Facilitate communication between
interdependent parties, e.g, between systems
analysts and programmers.

7. The Management Control Framework
(b) Reduce the effects of personnel turnover;
new staff are not affected by the
idiosyncrasies of their predecessors.
(c) Reduce the effects of technological change,
for e.g, by facilitating hardware/software
changeover.
(d) Form the basis for perfomance standards by
providing a common measurement base

8. The Management Control Framework
Evaluating the Staffing Function
• Staff planning involves taking an inventory of
the current staff capabilities, determining
future staff requirements, assessing the likely
turnover of staff, and determining how
positions will befilled.
Personnel acquisition
• For each position in the computer installation,
a formal documented job specification must
exist defining the nature of the job, its duties,
and opportunities for advancement.

9. The Management Control Framework
Personnel Termination
• Personnel termination may be voluntary or
involuntary, in either case, some control
procedures must be exercised
(a) Upon an employees giving notice, if the
employee is a key person, mgt must be
immediatelyinformed.
(b) Upon termination, a checklist must be
prepared.
(c) The terminating employee should provide
training for the replacement employee.

10. The Management Control Framework
(d) If the employee is disgruntled, the employee
should be assigned to non critical areas.
(e) Exit interviews should be given
• Any areas of discontent are determined
• Reminders are given on secrecy oaths etc
• Potential problems are identified

11. The Management Control Framework
Evaluating the Directing Function
• The process of directing is based upon three
major principles:
1. unity of command whereby individuals should
report to a single supervisor to avoid conflict
in instructions and promote a greeter feeling
of responsibility for results achieved
2. direct supervision whereby mgt should
supplement objective methods of supervision
with direct personal conduct

12. The Management Control Framework
3. Appropriate variation of supervisory
techniques to suit different people, tasks and
organisational environments.
• To evaluate how well top mgt and EDP mgt
perform the directing function, it requires the
auditor to understand areas fundamental to
effective directing.
(a)Human motivation
• An auditor can evaluate human motivation, by
examining variables that indicate when
motivation problems exist e.g. staff turnover

13. The Management Control Framework
Leadership
• As with motivation, the auditor must be aware
of indicators that suggest poor leadership:
staffturnover, projects failing to meet budgets
etc.
Communications
• The auditor has both formal and informal
sources of evidence for evaluating how well
top and EDP mgt communicate with their
subordinate staff.

14. The Management Control Framework
• Formal evidence include minutes of meetings
and informal evidence include interviews with
installation staff. General awareness of the
staff of other developments within the
installation even though they may not be
directly involved with the developments.

15. The Management Control Framework
Evaluating the Controlling Function
• The controlling function involves determining
when the actual activities of the computer
installation deviate from the planned
activities.
The means of control
• Mgt exercises control over computer
installations activities through normal means:
plans andbudgets, measuring actual
performance, and determining variances from
budgets.

16. The Management Control Framework
• Some essential control elements in a
computer installation include; performance
standards, documentation standards,
checkpoint reviews, project control aids and
postaudits