The committee also expressed some concern regarding the difficulties of delineating system boundaries. Data is received from elsewhere, e.g. online input, but the description is clear that SysTrust covers processing when transactions are received by the data center. The problem is that, these days, systems seldom have such tidy boundaries. Outsourcing is common. In most of the recent outsourcing announcements, finance and accounting staff in the client firm move over to the outsourcer, where the processing occurs.
Contracts are typically for ten years.
For example, GM hired Arthur Andersen to provide GM with payroll, dealer billing, accounts receivable, accounts payable, fixed asset accounting and travel and entertainment expenses. GM is to assist Andersen in marketing these services to other companies. To be fair to the authors of the exposure draft, these developments have accelerated over the last year. Still, it is increasingly difficult to draw boundaries around processing systems. These developments may soon pose challenges for traditional audits, but the difficulties are far more pronounced for SysTrust and the exposure draft should address them in greater detail.