They should not have the capacity to alter user profiles or perform transactions. Be aware that the system administrator can add unauthorized users after printing the list for the auditor. In many systems, such activity can be detected by reviewing a log of changes to the system user Ids. Unfortunately, however, the systems administrator can usually delete part or all of the information in the log file. The auditor s next step is to examine each user s access level, making certain that the levels are commensurate with current duties.
Access levels vary by operating system and application program.
However, common access levels include read-only, update, and system administration. The auditor should be familiar with access levels that exists in the system being audited, as well as what activities may be performed at each level. Only key personnel should be allowed update capabilities. Only the system administrator and the designated backup administrator should have the ability to add, change, and delete users and access levels. The next step is to document changeable and non-changeable system security parameters.