Council on archives international records management trust

Base Transaction Data

The accounting component of an IFMS deals with the recording and categorisation of transactions, so it is here that the base records of the transaction are to be found. At the initial entry level, the requirement is to record and explain all transactions in sufficient detail that the transaction can be understood. This will involve recording the date, the amount and the character of the transaction. The recording of initial transactions will usually take place at the budgetary unit level, and it is here that the responsibility for maintaining an adequate record of the transaction lies.

The process of reconciliation, which ensures that the individual entries balance with the totals recorded in the system, takes place within the system. Reconciliations of transactions usually take place at a set time: the end of the day, the end of a shift work period, weekly, monthly etc. The transactions and the reconciliations together provide a complete picture of the financial activities for the set period. Reconciliations occur throughout the system and may be the responsibility of the budgetary unit, the finance section of a department, or the central Ministry.

Aggregations of transactions take place in those parts of the system that produce ledgers, journals and financial statements. These are summary records of the individual transactions with various degrees of specificity. The ledger contains summary details about each transaction. Journals record variations in the ledger. Financial statements are summaries of the ledgers and journals reporting on financial transactions against specified categories at various time periods (such as monthly, quarterly and so on). By studying the specification of responsibility and accountability for the system it will be possible to identify responsibility for record keeping. It may be at the level of the budgetary unit, or may be at the level of the department.

The major point of record keeping in any financial system is the point of entry of data into the system. The data reflecting the transaction must explain the transaction and be accurate. This general rule applies to any points of data entry into the IFMS.

Audit Trails

Audit trails are essentially no more than a chronological log of every transaction that happens within a system. In other words these are electronic records generated by the system that are essential for demonstrating that the system has integrity. They ensure that transaction records the system produces are complete, accurate and authorised. Reconstructing the path of a transaction using these trails is very time consuming, but possible. Audit trails allow a transaction to be traced through a system forward to its ultimate destination and backwards to relevant source transactions. More sophisticated logging techniques also record who had access to the system at a particular time, what data was viewed in addition to the normal logging, and what data was added, deleted or changed.

Event logging is a common computing protection technique. In large systems, these logs create very big files. This data can easily be segregated by time chunks (daily, weekly, monthly) and stored in back up or ‘archive’ systems. Typically these logs are not kept beyond the time it takes to audit the annual accounts.

Legal and Audit Issues

An IFMS is a record keeping system. The system is consistent with the archival principle that the records of an organisation are different in quality from literary manuscripts because they arise from the regular business of an organisation. These records have been created by staff following procedures that are reinforced by a variety of controls that ensures their completeness, accuracy and authenticity. The archival principle of continuous custody is important because it guarantees that this system of control has not been broken. In the world of electronic records, the traditional techniques for achieving these guarantees are harder to apply. Auditors and lawyers are the professions that have a particular concern for ensuring that financial records complete, authentic, authorised and admissible in a court of law. Archivists and records managers need to understand the legal and audit issues in order to ensure that the financial records generated by an IFMS meet the needs of the government, management and the public.

There are few precedents that address the admissibility of computer records in a court of law. Where computer evidence has been submitted in legal cases the courts have taken into account expert evidence on the effectiveness of the IT control environment before assessing the reliability of the computer data. Computerised transactions or images of documents may be inadmissible as legal evidence unless controls can be shown to be so strong as to remove reasonable doubt about the authenticity and integrity of data held by the system. Some of these controls are recorded on paper. It is therefore important that both the electronic records and the paper records that document the control environment are managed properly.

Because of the integrated nature of an IFMS (that is, data is entered once and rolls through the system according to a pre-programmed route), the controls on the system itself are critical. To be able to verify that the information which is accumulated, aggregated or moved within the system itself, is accurate and reliable, it is essential to ensure that the system is reliable and that it is doing what it is supposed to do. Some of the auditing controls used to verify this are

• 
  access controls: controls over access to the computer system by some form of identity recognition, such as password, card system, personal identification number and so on
  
• 
  input and output controls: controls which ensure the accuracy and security of the information received and transmitted
  
• 
  processing controls: controls which protect and ensure the integrity of the information processed by the system
  
• 
  back-up controls: controls that guarantee the retention of back-up copies of computer files, computer programs and the recovery of computer records in case of system failure.
  

Auditors also need assurance that the system is understood by the staff who use it and that it is operating effectively. It is essential that records are available to explain the basic aspects of the system operation, including

• 
  the operation of the various components of the system
  
• 
  the controls built into the system
  
• 
  the flow of data from input to output
  
• 
  details of file organisation and controls
  
• 
  details of record content, context and structure
  
• 
  the program logic
  
• 
  audit trails or logs of records added, deleted and amended that relate to the system
  
• 
  disaster recovery procedures.
  

Records must be available to allow an auditor to understand:

• 
  the access controls on who is permitted to access and alter data
  
• 
  procedures for monitoring access
  
• 
  all changes or upgrades to the software and hardware employed
  
• 
  migration of data which may have taken place across either software or hardware
  
• 
  back-up procedures and procedures for compliance.