Académique Documents
Professionnel Documents
Culture Documents
DATA STRUCTURES
Organization
Access method
Access:
Non-Index
Methods
INDEX
File
Access:
Index Methods
Hashing
Pointers
DATA File
Data
Organizatio
n
SEQUENTIAL
SEQUENTIAL
ISAM
RANDOM
IT Auditing & Assurance, 2e, Hall & Singleton
RANDOM
FILE PROCESSING
OPERATIONS
1.
2.
3.
4.
5.
6.
7.
DATA STRUCTURES
Flat file structures
Sequential structure [Figure 8-1]
All records in contiguous storage spaces in
specified sequence (key field)
Sequential files are simple & easy to process
Application reads from beginning in sequence
If only small portion of file being processed,
inefficient method
Does not permit accessing a record directly
IT Auditing & Assurance, 2e, Hall & Singleton
DATA STRUCTURES
Flat file structures
Indexed structure
In addition to data file, separate index
file
Contains physical address in data file
of each indexed record
DATA STRUCTURES
Flat file structures
Indexed random file [Figure 8-2]
DATA STRUCTURES
Flat file structures
Indexed Sequential Access Method (ISAM) [Figure 8-3]
Large files, routine batch processing
Moderate degree of individual record processing
Used for files across cylinders
Uses number of indexes, with summarized content
Access time for single record is slower than Indexed
Sequential or Indexed Random
Disadvantage: does not perform record insertions efficiently
requires physical relocation of all records beyond that
point SOS
Has 3 physical components: indexes, prime data storage
area, overflow area [Figure 8-4]
Might have to search index, prime data area, and overflow
area slowing down access time
Integrating overflow records into prime data area, then
reconstructing indexes reorganizes ISAM files
Very Efficient: 4, 5, 6
IT Auditing
& Assurance,
Moderately
Efficient:
1, 3 2e, Hall & Singleton
Inefficient: 2, 7
om
d
n
Ra
Legacy systems
M
A
IS
l
a
i
t
n
e
u
q
e
S
1960
DBMS etc.
Legacy systems
1970
1980
1990
Efficient
AM
S
I
l
a
i
t
n
e
u
q
e
S
Ra
nd
o
Inefficient
Access single records
IT Auditing & Assurance, 2e, Hall & Singleton
HASHING STRUCTURE
Employs algorithm to convert
address
Efficient: 1, 2, 3, 6
Inefficient: 4, 5, 7
IT Auditing & Assurance, 2e, Hall & Singleton
POINTER STRUCTURE
Efficient: 1, 2, 3, 6
Inefficient: 4, 5, 7
IT Auditing & Assurance, 2e, Hall & Singleton
DATABASE STRUCTURES
Hierarchical & network structures
[Figure 8-9]
Uses explicit linkages b/w records to
establish relationship
Figure 8-9 is M:N example
Relational structure
Uses implicit linkages b/w records to
establish relationship:
foreign keys / primary keys
IT Auditing & Assurance, 2e, Hall & Singleton
CUSTOMERS
INVOICES
INVENTORY
IT Auditing & Assurance, 2e, Hall & Singleton
DATABASE STRUCTURES
Relational structure
User views
Data a particular user needs to achieve his/her
assigned tasks
A single view, or view without user input, leads to
logical
view
or schema
IT Auditing
& Assurance,
2e, Hall & Singleton
DATABASE STRUCTURES
Relational structure
Creating views
Designing output reports, documents, and
8-3
Then apply normalization principles to the
conceptual
user views
design the database
IT Auditing & Assurance,
2e, Hall &to
Singleton
tables
DATABASE STRUCTURES
Relational structure
Importance of data normalization
Critical to success of DBMS
Effective design in grouping data
Several levels: 1NF, 2NF, 3NF, etc.
Un-normalized data suffers from:
Insertion anomalies
Deletion anomalies
Update anomalies
IT Auditing & Assurance, 2e, Hall & Singleton
DATABASE STRUCTURES
Relational structure
Normalization process
Un-normalized data [Table 8-4]
Eliminates the 3 anomalies if:
All non-key attributes are dependent on the
primary key
There are no partial dependencies (on part of
the primary key)
There are no transitive dependencies; non-key
attributes are not dependent on other non-key
attributes
foreign
keys
IT Auditing
& Assurance, 2e, Hall & Singleton
Normalized database tables examples:
DATABASE STRUCTURES
Relational structure
Query function
Allows users to create customized lists from database
Users stipulate, using English-like commands, which tables,
DATABASE STRUCTURES
Relational structure
Auditors and data normalization
Database normalization is a technical matter that
is usually the responsibility of systems
professionals.
The subject has implications for internal control
that make it the concern of auditors also.
Most auditors will never be responsible for
normalizing an organizations databases; they
should have an understanding of the process and
be able to determine whether a table is properly
normalized.
In order to extract data from tables to perform
audit procedures, the auditor first needs to know
how the data are structured.
IT Auditing & Assurance, 2e, Hall & Singleton
The objective of the EAM is to identify important transactions while they are being processed and extract
copies of them in real time
Examples
Errors
Fraud
Compliance
SAS 78, SAS 94, SAS 99 / S-OX
usage of
COA/EAM/CA
IT Auditing
& Assurance, 2e, Hall & Singleton
GENERALIZED AUDIT
SOFTWARE
Brief history
Most widely used CAATT [Figure 8-19]
Usages include:
1) Footing and balancing entire files or selected data
papers!)
5) Printing confirmations
IT Auditing & Assurance, 2e, Hall & Singleton
GENERALIZED AUDIT
SOFTWARE
Popular because:
1. GAS software is easy to use and requires
little computer background
2. Many products are platform independent,
works on mainframes and PCs
3. Auditors can perform tests independently
of IT staff
4. GAS can be used to audit the data
currently being stored in most file
structures and formats
IT Auditing & Assurance, 2e, Hall & Singleton
GENERALIZED AUDIT
SOFTWARE
Simple structures [Figure 8-19]
Complex structures [Figures 8-20, 8-21]
Auditing issues:
Auditor must sometime rely on IT personnel to
produce files/data
Risk that data integrity is compromised by
extraction procedures
Auditors skilled in programming better prepared
to avoid these pitfalls
IT Auditing & Assurance, 2e, Hall & Singleton
ACL
ACL is a proprietary version of GAS
Leader in the industry
Designed as an auditor-friendly meta-
ODBC interface
IT Auditing & Assurance, 2e, Hall & Singleton
ACL
See ACL tutorial #1
Input file definition
Customizing a view
[Figure 8-23]
Filtering data
[Figures 8-24 thru 8-27]
Stratifying data [Figure 8-28]
Statistical analysis
IT Auditing & Assurance, 2e, Hall & Singleton
Chapter 8:
CAATTs for Data
Extraction and Analysis
IT Auditing &
Assurance,
2e, Hall &
IT Auditing & Assurance,
2e,
Hall & Singleton
Singleton