© 2008 Prentice Hall Business Publishing Accounting Information Systems, 11/e Romney/Steinbart
71 of 151
OBJECTIVE 3: PROGRAM MODIFICATION
Auditors should observe testing and implementation, review related authorizations, and, if necessary, perform independent tests for each major program change.
If this step is skipped and program change controls are subsequently deemed inadequate, it may not be possible to rely on program outputs.
Auditors should always test programs on a surprise basis to protect against unauthorized changes being inserted after the examination is completed and then removed prior to scheduled audits.