Limiting the Search Space during Controls Evaluation of a Modified Information System.

Controls must be changed when information systems are modified. Audit, assurance, and quality-control (AAQC) personnel must evaluate the reliability of controls in the new system versions. Based on Bunge (1977, 1979) and Wand and Weber (1989a, 1990), we describe a model and search-space algorithm that AAQC personnel can use to determine where required control changes are likely to be located in the new system version, thereby mitigating the need for an exhaustive evaluation of all controls. To use the model and algorithm, AAQC personnel must have (1) accurate and complete requirements specifications for the old and new versions of the system, (2) a controls specification for the old version that covers all errors and irregularities that might occur, (3) evidence to conclude all controls for the old version are in place, adequate, and working, and (4) specifications for the new version expressed as a level structure of systems and subsystems. [ABSTRACT FROM AUTHOR]