Electronic data interchange is the electronic transfer of documents between businesses. EDI was developed to enhance just-in-time JIT) inventory management. Advantages include speed, reduction of clerical errors, and elimination of repetitive clerical tasks and their costs. A multinational company has an agreement with a value-added network VAN) that provides the encoding and communications transfer for the company's electronic data interchange EDI) and electronic funds transfer EFT) transactions. Before transfer of data to the VAN, the company performs online preprocessing of the transactions. The internal auditor is responsible for assessing preprocessing controls. In addition, the agreement between the company and the VAN states that the internal auditor is allowed to examine and report on the controls in place at the VAN on an annual basis. The contract specifies that access to the VAN can occur on a surprise basis during the second or third quarter of the company's fiscal year. This period was chosen so it would not interfere with processing during the VAN's peak transaction periods. This provision was not reviewed with internal auditing. The annual audit plan approved by the board of directors specifies that a full audit would be done during the current year.

Auditor objectivity is not impaired when she recommends standards of control for systems or reviews procedures before implementation. However. drafting procedures for systems and designing, installing. and operating systems are not audit functions. Thus, reviewing the methodology used by an organization is an appropriate activity that enables the internal auditor to determine whether s)he can rely on the systems development activity to design and implement appropriate automated controls within applications.

According to the outline of a possible e-commerce audit protocol for key areas given in PA 2100-6, the internal auditor should evaluate how well business units are managing the e-commerce when addressing the possible key audit area of management issues. The following is a list of some relevant topics that the internal auditor should review when doing their evaluation:
Project management reviews of individual initiatives and development projects.
System development life cycle reviews.
Vendor selection, vendor capabilities, employee confidentiality, and bonding.
Post-implementation economic reviews: Are anticipated benefits being achieved? What metrics are being used to measure success?
Post-implementation process reviews: Are new processes in place and working
effectively?