| Foreword | p. xiii |
| Preface | p. xv |
| Acknowledgments | p. xvii |
| The Frontier: An EDI Overview | p. 1 |
| Exactly What Is EDI? | p. 1 |
| Growth of EDI | p. 1 |
| EDI Market Acceptance | p. 2 |
| The Costs and Benefits of Imppementing EDI | p. 5 |
| Who Should Use EDI? | p. 6 |
| EDI Operating Issues | p. 7 |
| EDI Risks | p. 8 |
| Management Control Concerns | p. 9 |
| General Controls in EDI Standards | p. 10 |
| ANSI | p. 11 |
| UN/EDIFACT | p. 12 |
| Acknowledgments | p. 12 |
| EDI Audit Implications | p. 12 |
| Summary | p. 13 |
| EDI Infrastructure and Standards | p. 15 |
| The Essential Components of EDI | p. 15 |
| Standards | p. 15 |
| Telecommunications Hardware and Software | p. 16 |
| Translation Software | p. 16 |
| Standards: Evolution of a Business Tool | p. 18 |
| The Development of North American Standards | p. 18 |
| The Development of International Standards | p. 21 |
| The Standards Controversy | p. 23 |
| ANSI ASC X12 Transaction Set Table, Segment Dictionary Format, and Data Element Definition | p. 25 |
| Networks and Telecommunications | p. 29 |
| Third-Party Networks | p. 29 |
| Benefits of Value-Added Networks | p. 30 |
| Interconnectability: VAN Versus Point-to-Point | p. 31 |
| Selecting a Third-Party Network | p. 33 |
| Internal Controls in Third-Party Networks | p. 34 |
| Access Control | p. 34 |
| Data Integrity | p. 35 |
| Transmission Security | p. 37 |
| Liability of Third-Party Network Vendors | p. 40 |
| Cross-Vulnerabilities in EDI Partnerships | p. 43 |
| What is Cross-Vulnerability in EDI? | p. 43 |
| Cross-Vulnerabilities Involving Security | p. 43 |
| Point-of-Sale and EDI Security | p. 44 |
| Limitations of Current Security Structures | p. 45 |
| Security Solutions | p. 47 |
| Cross-Vulnerabilities in Other Business Areas | p. 48 |
| Difficulties with Shared Standards | p. 49 |
| The Uncertain Legal Status of EDI Contracts | p. 50 |
| Conflicts in Partners' Competitive Profiles | p. 52 |
| More EDI-Related Exposures | p. 53 |
| Summary and Recommendations | p. 54 |
| Control Self-Assessment Worksheet and Summary | p. 57 |
| Managing Interenterprise Partnerships | p. 61 |
| Characteristics of Interenterprise Partnerships | p. 61 |
| Selecting Trading Partners | p. 61 |
| The Trading Partner Agreement | p. 62 |
| Other EDI Agreements | p. 64 |
| Third-Party Network Agreements | p. 65 |
| Application Software Agreements | p. 65 |
| Legal Issues, Lawyers, and Auditors | p. 66 |
| Fundamental Questions | p. 67 |
| Creating an Enforceable Contract | p. 69 |
| A Matter of Evidence | p. 69 |
| Managing Liability and Risk | p. 71 |
| Conventions, Guidelines, and Agreements | p. 72 |
| Summary | p. 72 |
| EDI Application Control Issues | p. 75 |
| Internal Controls in Information Systems | p. 75 |
| Application Controls | p. 75 |
| Security Controls | p. 78 |
| Environmental Controls | p. 78 |
| Project Controls | p. 78 |
| EDI Standard-Driven Controls | p. 78 |
| Other EDI-Specific Controls | p. 79 |
| Controls for Transaction Accuracy and Completeness | p. 80 |
| Inbound Transaction Control Considerations | p. 81 |
| Outbound Transaction Control Considerations | p. 81 |
| Transmission Control Considerations | p. 82 |
| Control Agreements Between Partners | p. 83 |
| EDI Management and Environmental Control | p. 85 |
| Environmental Controls: An Overview | p. 85 |
| Operations and Management | p. 85 |
| Computer Operations | p. 86 |
| Data and Program Security | p. 86 |
| Contingency Planning and Disaster Recovery | p. 87 |
| Project Management | p. 88 |
| Learn About EDI | p. 89 |
| Gain Executive Commitment and Management Buy-In | p. 89 |
| Establish Quality Project Plan | p. 89 |
| Review Business Processes and Internal Systems | p. 90 |
| Conduct Surveys | p. 90 |
| Review Standards and Documents to be Exchanged | p. 91 |
| Choose Translation Software | p. 91 |
| Choose a Network Provider | p. 91 |
| Design, Develop, and Test the System | p. 92 |
| Cut Over to and Implement the EDI System | p. 92 |
| Perform Postimplementation Review | p. 92 |
| Vendor-Supplied Translation Software | p. 92 |
| EDI and Records Retention | p. 95 |
| The Risks of Poor Records Retention | p. 95 |
| The Objectives of Good Records Retention | p. 96 |
| The Basic Principles of Records Retention | p. 96 |
| Paper Versus Electronic Copies | p. 97 |
| The Admissibility of Electronic Records | p. 98 |
| Key Considerations for an EDI Records Management Program | p. 99 |
| Storage Media | p. 100 |
| Auditability of Records | p. 101 |
| Records to Consider Keeping | p. 102 |
| Retention Requirements for EDI | p. 103 |
| The Control Dimensions of Financial EDI | p. 105 |
| What is Financial EDI? | p. 105 |
| ANSI ASC X12 Versus UN/EDIFACT Payment Formats | p. 106 |
| Financial EDI in Insurance | p. 109 |
| The Financial EDI Information Component | p. 109 |
| The Canadian Financial EDI Audit Trail | p. 112 |
| Uniform Commerical Code Article 4A: Funds Transfer | p. 114 |
| The Model Electronic Payments Agreement and Commentary | p. 115 |
| Canadian Inter-Financial Institution EDI Control and Audit Standards | p. 115 |
| Uniform Conduct for the Interchange of Trade Data by Teletransmission | p. 115 |
| Financial EDI Controls | p. 116 |
| The Payor's Perspective | p. 116 |
| The Payee's Perspective | p. 117 |
| The Financial Institution's Perspective | p. 119 |
| Evaluated Receipt Settlement and Financial EDI: An Application at the Macro Level | p. 119 |
| Summary | p. 121 |
| EDI Audit Considerations | p. 123 |
| The Auditor as Control Consultant | p. 123 |
| General Audit Implications for EDI | p. 123 |
| The External Auditor's Role | p. 125 |
| Knowledge of the Business | p. 125 |
| Assessment of Risk | p. 126 |
| Evaluation of General Controls | p. 127 |
| Evaluation of Processing Controls | p. 128 |
| Testing | p. 130 |
| Use of Computer-Assisted Audit Techniques | p. 130 |
| The Internal Auditor's Role | p. 131 |
| Final Thoughts on the Auditor's Changing Role | p. 135 |
| Epilogue | p. 139 |
| General Considerations for an EDI Audit | p. 143 |
| Management Control Concerns | p. 143 |
| Loss of the Paper Audit Trail | p. 143 |
| Business Continuity | p. 143 |
| Exposure of Data to Third Parties | p. 143 |
| Potential Legal Liability | p. 144 |
| Records Retention and Retrievability | p. 144 |
| Segregation of Duties | p. 144 |
| Managing Interenterprise Relationships | p. 144 |
| Implications for Information Systems Auditors | p. 144 |
| An EDI Implementation Audit Program | p. 147 |
| Audit Objective | p. 147 |
| Implementation Audit Program | p. 147 |
| A Financial EDI Audit Program | p. 151 |
| Overview | p. 151 |
| Audit Procedures for Generic Funds Transfer | p. 151 |
| Management and Administrative Controls | p. 152 |
| System Controls | p. 152 |
| User (Operational) Controls | p. 153 |
| Financial EDI-Specific Audit Procedures | p. 154 |
| Management Controls | p. 154 |
| Application Controls | p. 154 |
| Environmental Controls | p. 155 |
| Audit Considerations for Trading Partner Agreements | p. 157 |
| Review Model Trading Partner Agreements | p. 157 |
| Evaluate Controls to be Included in the Trading Partner Agreement | p. 158 |
| Evaluate Interorganizational Control Assurances | p. 158 |
| Audit Considerations for Third-Party Network Agreements | p. 159 |
| Complete Statement of Terms | p. 159 |
| Data Ownership | p. 160 |
| Confidentiality | p. 160 |
| Investigations and Audits | p. 161 |
| Liability for Errors | p. 161 |
| Amendments | p. 161 |
| Termination | p. 162 |
| Environmental Audit Considerations: Contingency Planning and Disaster Recovery | p. 163 |
| Telecommunications Services and Support | p. 163 |
| Additional Audit Considerations | p. 165 |
| Recommended Readings | p. 167 |
| General Readings | p. 167 |
| Management Topics | p. 170 |
| Standards | p. 172 |
| Audit and Control Issues | p. 173 |
| Security Issues | p. 175 |
| Legal Issues | p. 175 |
| Network and Telecommunications Issues | p. 177 |
| Software and Third-Party Network Vendors | p. 178 |
| Productivity Enhancements | p. 179 |
| Contingency Planning and Disaster Recovery | p. 179 |
| Association Addresses | p. 182 |
| Glossary | p. 183 |
| About the Authors | p. 205 |
| Index | p. 207 |
| Table of Contents provided by Syndetics. All Rights Reserved. |