what does an AIS consist of?
- people who use it
- processes
- tech
- data, transaction stream files, databases
- controls to safeguard info
six criteria tested as part of processing integrity?
- procedures
- system inputs and outputs
- data is processed, stored, maintained
- modification of data is auth and processed
must be CAT to meet requirements and commitments
types of PI controls
- input/output
- data entry
- processing
- data transmission
- data integrity
- availability
input controls?
- turnaround documents and forms designed (sequentially numbered source docs)
data entry controls?
- check fields, signs, limits, range, sizes, completeness, validity, reasonableness
- check digit verification
- batch processing - check sequence, and batch totals
- closed loop verification (use data to check other related info)
processing controls?
- datasets must match and will disregard duplicates
- label files for easy ID
- compare totals before and after processing
- calculate totals in diff ways to see if they end up the same
- eliminate poss of overwriting, erasing data
- reconciliation
what is a concurrent update?
locking fields/records when theyre being updated so that multiple users arent updating them the same time
data transmission controls?
- checksums
- parity checking
what is parity checking?
bit added to each character transmitted so they can be verified for accuracy depending on system parity mode
what is a checksum?
a value computed from a data packet to check its integrity. the checksum field is added to the header to crosscheck data and checksum
what is the IP header checksum?
is calculated over IP header only so that data generally follows it
what is the complement of a binary number?
the inverse
data coding checks?
self checking codes which combat transposition errors
run-to-run?
the purpose is to ensure no records are lost, unprocessed/processed more than once for each of the computer runs that the record must flow through.
data integrity controls?
- referential integrity (ensures integrity of master files by identifying anomolies)
output controls?
- user review of output
- data transmission controls
- recons
availability controls?
- preventative maintenance
- fault tolerance
- data centre location and design
- patch mgmt and antivirus software
- back-procedures (incremental (last update only) or differential (copies all changes since last full backup)
- disaster recovery plan
- business continuity plan
