Limiting the search space during controls evaluation of a modified information system

Yair Wand, Ron Weber

    Research output: Contribution to journalArticleResearchpeer-review


    Controls must be changed when information systems are modified. Audit, assurance, and quality-control (AAQC) personnel must evaluate the reliability of controls in the new system versions. Based on Bunge (1977, 1979) and Wand and Weber (1989a, 1990), we describe a model and search-space algorithm that AAQC personnel can use to determine where required control changes are likely to be located in the new system version, thereby mitigating the need for an exhaustive evaluation of all controls. To use the model and algorithm, AAQC personnel must have (1) accurate and complete requirements specifications for the old and new versions of the system, (2) a controls specification for the old version that covers all errors and irregularities that might occur, (3) evidence to conclude all controls for the old version are in place, adequate, and working, and (4) specifications for the new version expressed as a level structure of systems and subsystems.

    Original languageEnglish
    Pages (from-to)91-111
    Number of pages22
    JournalJournal of Information Systems
    Issue number3
    Publication statusPublished - 2018


    • Assurance
    • Audit
    • Information systems change
    • Internal controls
    • Quality control
    • Search-space algorithm
    • System modeling

    Cite this