This sample audit work program outlines steps to audit an organization’s data management process and includes a self-assessment questionnaire that gives the auditee an opportunity to inform internal audit about controls and processes employed.

Risk indicators to consider include frequent and costly database reorganization needed to support new business processes, and frequent manual intervention required for keeping databases operational. Potential impacts of inadequate management are considered, for example: decision-making becomes impaired because data critical to support key business processes may not exist, may be difficult to obtain or may be inaccurate.