Auditing Information Systems, Second Edition

Chapter 2. Identifying Computer Systems

Before performing any assessment of computing system controls, all of the computing systems utilized by an organization must be identified. Creating an inventory of computing systems is essential so that the size and complexity of the computing system environment, or "universe," within an organization can be assessed. The inventory should include systems that have been developed internally as well as those purchased from vendors. It should also include systems in which an organization's data is processed by an external vendor's computer system (these vendors are often referred to as service bureaus, third-party processors, or service organizations). An organization's computing system inventory may prove to be quite challenging. Do not be surprised if the number of computing systems reaches into the thousands.