This work program outlines steps for an AS400 review audit. It identifies major areas to investigate during a general or specific controls review in an AS400 installation as well as critical control validation tests to perform. These areas include: definition and communication of responsibilities, modifications to application programs, system software modifications, computer operations and security.

Sample testing procedures include: inquire whether formal policies and procedures exist within IT and whether there are formal hiring guidelines in the department; obtain a copy of the policies and procedures; etc.