4.1 Audit objective relating to database access is verify that database access authority and privileges are granted to users in accordance with their legitimate needs. Audit procedures for testing data access controls are: Responsibility for authority tables and subschemas. The auditor should verify that database administration personnel retain exclusive responsibility for creating authority tables and designing user views. Evidence may come from three sources: (1) by reviewing company policy and job descriptions, which specify these technical responsibilities; (2) by examining programmer authority tables for access privileges to data definition language commands; and (3) through personal interviews with programmers and DBA personnel. Appropriate access authority. The auditor can select a sample of users and verify that their access privileges stored in the authority table are consistent with their job descriptions organizational levels. Biometric controls. The auditor should evaluate the costs and benefits of biometric controls. Generally, these would be most appropriate where highly sensitive data are accessed by a very limited number of users. Inference controls. The auditor should verify that database query controls exist to prevent unauthorized access via inference. The auditor can test controls by simulating access by a sample of users and attempting to retrieve unauthorized data via inference queries. Encryption controls. The auditor should verify that sensitive data, such as passwords, are properly encrypted. Printing the file contents to hard copy can do this.

4.2 Audit objective relating to database backup is verify that controls over the data resource are sufficient to preserve the integrity and physical security of the database. Audit procedures for testing database backup controls are: The auditor should verify that backup is performed routinely and