Auditing Information Systems, Second Edition

Chapter 5. Auditing Service Organization Applications

Many firms employ the services of external organizations to provide business applications and data processing resources that would otherwise be too expensive or time consuming to develop and maintain internally. These external organizations are often referred to as service organizations, service bureaus, or third-party processors. Numerous service organizations provide a variety of applications to virtually all sectors of industry and government. These include services for payroll processing, mortgage loan servicing, investment safekeeping, software development and maintenance, automated teller machine (ATM) transaction processing, check processing, electronic bill payment, wire transfers, credit card operations, and trust services.

Service organizations enjoy economies of scale by developing and maintaining applications and computer systems that may be used by hundreds or thousands of client companies. By processing high volumes of client transactions, the cost to process each individual transaction through a service organization often is significantly less than if each client were to hire a programming and development staff and purchase or lease the computer hardware necessary to process the transactions. As a result of technological advances, changes in laws and regulations, and other business risks, a company might invest significant financial resources in a major computer system only to find it obsolete in a few years. ...