CHAPTER 4
AUDITING DATABASE SYSTEMS
XAUDCIS
HO LY A N GEL U NI V ER S I T Y
WHAT IS A DATABASE
A database is an organized collection of data. The data are typically organized to model
relevant aspects of reality in a way that supports processes requiring this information.
For example, modeling the availability of rooms in hotels in a way that supports finding a
hotel with vacancies.
Database management systems (DBMSs) are specially designed applications that interact
with the user, other applications, and the database itself to capture and analyze data. A
general-purpose database management system (DBMS) is a software system designed
to allow the definition, creation, querying, update, and administration of databases.
DBMS responsible for maintaining the integrity and security of stored data, and for
recovering information if the system fails.
2
EXAMPLES OF DBMS
MySQL
MariaDB
PostgreSQL
SQLite
Microsoft SQL Server
Oracle
SAP
Dbase
FoxPro
IBM DB2
LibreOffice
Base and FileMaker Pro
3
FLAT-FILE VERSUS DATABASE ENVIRONMENTS
Computer processing involves two components: data and
instructions (programs).
Conceptually, there are two methods for designing the
interface between program instructions and data:
▪ File-oriented processing: A specific data file was created for each application.
▪ Data-oriented processing: Create a single data repository to support numerous
applications.
Disadvantages of file-oriented processing include
▪ redundant data and programs
▪ varying formats for storing the redundant data
4
Flat-File Data Management
(Single User View, Exclude Attributes Useful to Others)
User 1 Data
Transactions
Program 1
A,B,C
User 2
Transactions
Program 2
X,B,Y
User 3
Transactions
Program 3
L,B,M
Figure 9-1
5
DATA REDUNDANCY AND FLAT-FILE
PROBLEMS
Data Storage - creates excessive storage costs of
paper documents and/or magnetic form.
Data Updating - any changes or additions must be
performed multiple times.
Currency of Information – has the potential problem
of failing to update all affected files.
Task-Data Dependency - user unable to obtain
additional information as his or her needs change
6
The Database Concept
User 1
Database
Transactions
Program 1
A,
User 2
D B,
Transactions B C,
Program 2 M X,
S Y,
User 3 L,
Transactions M
Program 3
Figure 9-2(b)
7
ADVANTAGES OF THE DATABASE APPROACH
Data sharing/centralized database resolves flat-file
problems:
No data redundancy: Data is stored only once, eliminating
data redundancy and reducing storage costs.
Single update: Because data is in only one place, it
requires only a single update, reducing the time and
cost of keeping the database current.
Current values: A change to the database made by any
user yields current data values for all other users.
Task-data independence: As users’ information needs
expand, the new needs can be more easily satisfied
than under the flat-file approach.
8
DISADVANTAGES OF THE DATABASE APPROACH
Can be costly to implement
▪ additional hardware, software, storage, and network resources are required.
Can only run in certain operating environments
▪ may make it unsuitable for some system configurations.
Because it is so different from the file-oriented approach, the
database approach requires training users
▪ may be inertia or resistance.
9
ELEMENTS OF THE DATABASE ENVIRONMENT
Figure 9-3
10
FOUR ELEMENTS OF A DATABASE
1.DATABASE MANAGEMENT SYSTEM
2.USERS
3.DATABASE ADMINISTRATOR
4.PHYSICAL DATABASE
11
INTERNAL CONTROLS AND DBMS
The database management system stands between the user and the database per se.
Thus, commercial DBMS’s (e.g., Access or Oracle) actually consist of a database plus…
▪ software to manage the database, especially controlling access and other internal
controls
▪ software to generate reports, create data-entry forms, etc.
The DBMS has special software to control which data elements each user is authorized to
access.
12
DATA DEFINITION LANGUAGE (DDL)
DDL is a programming language used to define the database per se.
▪ It identifies the names and the relationship of all data elements, records, and files
that constitute the database.
DDL defines the database on three viewing levels
▪ Internal view – physical arrangement of records (1 view)
▪ Conceptual view (schema) – representation of database (1 view)
▪ User view (subschema) – the portion of the database each user views (many views)
13
DATA MANIPULATION LANGUAGE (DML)
DML is the proprietary programming language that a particular DBMS uses to
retrieve, process, and store data to / from the database.
Entire user programs may be written in the DML, or selected DML commands can be
inserted into universal programs, such as COBOL and FORTRAN.
Can be used to ‘patch’ third party applications to the DBMS
14
QUERY LANGUAGE
The query capability permits end users and professional programmers to access data in
the database without the need for conventional programs.
▪ Can be an internal control issue since users may be making an ‘end run’ around the
controls built into the conventional programs
IBM’s structured query language (SQL) is a fourth-generation language that has
emerged as the standard query language.
▪ Adopted by ANSI as the standard language for all relational databases
15
FUNCTIONS OF THE DBA
16
PHYSICAL DATABASE
Lowest level of database and the only level that exists in physical form
Logical collection of records and files that constitute the firm’s data source.
Table 4.2 contains file processing operations that data structures must support.
DATA STRUCTURE
DATA STRUCTURE COMPONENTS
1. Data Organization – physical arrangement of files
2. Data Access Methods – technique to locate records
***SIX CRITERIA INFLUENCING THE SELECTION OF DATA STRUCTURE
17
DATABASE CONCEPTUAL MODELS
Refers to the particular method used to organize records in a database.
▪ a.k.a. “logical data structures”
Objective: develop the database efficiently so that data can be accessed quickly and
easily.
There are three main models:
▪ hierarchical (tree structure)
▪ network
▪ relational
Most existing databases are relational. Some legacy systems use hierarchical or
network databases.
18
HIERARCHICAL MODEL
Navigational Database – traversing the files following a predefined path;
explicit linkages through networks. (Figure 4.10)
Limitations1: A parent record may have one or more child records.
Limitation2: No child can have more than one parent.
19
NETWORK MODEL
ANSI thru CODASYL
Most popular model of network is IDMS
Navigational thru multiple linkages
A child can have multiple parents
20
RELATIONAL MODEL
The relational model portrays data in the form of two dimensional ‘tables’.
Its strength is the ease with which tables may be linked to one another.
▪ a major weakness of hierarchical and network databases
Relational model is based on the relational algebra functions of restrict, project, and join.
Implicit linkages, rows are dependent on the primary key and independent of the other
attributes
Linkages are established through logical operations of the DMBS rather than explicit
addresses that are structured into the database.
Figure 4.14
ATTRIBUTES
TUPLES
21
The Relational Algebra Functions
Restrict, Project, and Join
Figure 9-9
22
DISTRIBUTED DATA PROCESSING (DDP)
Data processing is organized around several information processing units (IPUs)
distributed throughout the organization.
▪ Each IPU is placed under the control of the end user.
DDP does not always mean total decentralization.
▪ IPUs in a DDP system are still connected to one another and coordinated.
▪ Typically, DDP’s use a centralized database.
▪ Alternatively, the database can be distributed, similar to the distribution of the data
processing capability.
23
CENTRALIZED DATABASES IN DDP
ENVIRONMENT
The data is retained in a central location.
Remote IPUs send requests for data.
Central site services the needs of the remote IPUs.
The actual processing of the data is performed at the remote IPU.
24
ADVANTAGES OF DDP
Cost reductions in hardware and data entry tasks
Improved cost control responsibility
Improved user satisfaction since control is closer to the user level
Backup of data can be improved through the use of multiple data storage sites
25
DISADVANTAGES OF DDP
Loss of control
Mismanagement of resources
Hardware and software incompatibility
Redundant tasks and data
Consolidating incompatible tasks
Difficulty attracting qualified personnel
Lack of standards
26
DISTRIBUTED DATABASES: PARTITIONED DATABASE
APPROACH (PARTITIONING)
Splits the central database into segments that are distributed to their primary
users.
Advantages:
▪ users’ control is increased by having data stored at local sites.
▪ transaction processing response time is improved.
▪ volume of transmitted data between IPUs is reduced.
▪ reduces the potential data loss from a disaster.
27
THE DEADLOCK PHENOMENON
Especially a problem with partitioned databases
Occurs when multiple sites lock each other out of data that they are currently
using.
▪ One site needs data locked by another site.
Special software is needed to analyze and resolve conflicts.
▪ Transactions may be terminated and restarted.
28
THE DEADLOCK CONDITION
Mutual exclusion to data resource and the transactions are in wait until the locks are
removed.
DEADLOCK RESOLUTION - terminating on or more transactions to complete
processing of the other transactions in the deadlock.
Figure 9-26
29
DISTRIBUTED DATABASES:
REPLICATION
Effective when there is high degree of sharing
but no primary user
The duplication of the entire database for
multiple IPUs
Effective for situations with a high degree of
data sharing, but no primary user
▪Supports read-only queries
Data traffic between sites is reduced
considerably.
30
CONCURRENCY CONTROL: CONCURRENCY
PROBLEMS AND CONTROL ISSUES
Database concurrency is the presence of
complete and accurate data at all IPU sites.
With replicated databases, maintaining current
data at all locations is difficult.
Time stamping is used to serialize transactions.
▪Prevents and resolves conflicts created by updating data
at various IPUs.
31
DISTRIBUTED DATABASES AND THE ACCOUNTANT
The following database options impact the organization’s ability to maintain database
integrity, to preserve audit trails, and to have accurate accounting records.
▪ Centralized or distributed data?
▪ If distributed, replicated or partitioned?
▪ If replicated, total or partial replication?
▪ If partitioned, what is the allocation of the data segments among the sites?
32
DATABASE MANAGEMENT CONTROLS
Two crucial database control issues:
Access controls
Audit objectives: (1) those authorized to use
databases are limited to data needed to perform
their duties and (2) unauthorized individuals are
denied access to data
Backup controls
Audit objectives: backup controls can adequately
recovery lost, destroyed, or corrupted data
ACCESS CONTROLS
User views - based on subschemas.
A database schema (/ˈski.mə/ skee-ma) of a database system is its structure described in a formal
language supported by the database management system (DBMS) and refers to the
organization of data as a blueprint of how a database is constructed (divided into database
tables in case of Relational Databases).
Database authorization table - allows specific authority rules
Data encryption - encoding algorithms
Biometric devices - fingerprints, retina prints, or signature characteristics
Inference Controls – prevent users from inferring, through query features, specific data values that
should not be accessed.
Positive Compromise, Negative Compromise & Approximate Compromise
34
ACCESS CONTROLS
Audit procedures: verify…
▪Who has responsibility for authority
tables & subschemas?
▪Granting appropriate access authority
▪Are biometric controls used?
▪Are inference controls used?
▪Encryption?
COMPUTER RESOURCE
User 1 works in A/R
AUTHORITY TABLE Dept. Can Read, Add,
& Delete data.
Resource Employee Shared Cash Receipts
User AR File File Printer Program
Read data
User 1 Change No Access Use No Access
Add
Delete
Read only Read code
User 2 No Access Use Modify
Delete
User 3 No Access Read only Use No Access
SUBSCHEMA RESTRICTING ACCESS
BACKUP CONTROLS (FIGURES 4.22 & 4.23)
Database backup – automatic periodic copy of data
Transaction log – list of transactions which provides an audit trail
Checkpoint features – suspends data during system reconciliation
Recovery module – restarts system after a failure
BACKUP CONTROLS
Grandparent-parent-child backup –the number of generations to backup is up to company
policy
Direct access file backup - back-up master-file at pre-determined intervals
Off-site storage - guard against disasters and/or physical destruction
39
BACKUP CONTROLS
Audit procedures: verify…
▪that production databases are copied or
backed up at regular intervals
▪Verify automatic back up
▪backup copies of the database are stored
off site to support disaster recovery
The End
41
