MANAGEMENT INFORMATION SYSTEMS REVIEW PROCEDURES :

Review of management information system requires a systematic approach. Following steps are require to be taken for review of MIS system of an organisation

1. Obtain following documents

a. MIS-related audit/compliance reviews?

b. Institution’s formal MIS policies and practices framework/guidelines

c. Board/MIS Committee-related minutes
d. Organization charts detailing MIS responsibility.

2. Study previous MIS review’s findings and management’s response to those findings. Study the deficiencies or strengths pointed out in the reports. On the basis of deficiencies reported, set priorities for review. Study the recommendations provided for resolving MIS deficiencies and management’s responses. Check whether corrective actions have been initiated and/or completed and see follow-up audit activities.

3. Determine any material changes in regard to the five MIS elements i.e. Timeliness, Accuracy, Consistency, Completeness, and Relevance. Review MIS-related policies, practices and processes. See if any changes have been made since the previous review.

4. Review the Internal Control Questionnaire (ICQ) and determine the scope and objectives of the MIS review.

5. Identify each of the functional or product related areas to be reviewed. Provide copies of the MIS review objectives, review procedures and highlight the areas of MIS review that need to be addressed during the review. Aggregate these observations, conclusions, and recommendations for each of the functional areas addressed and incorporate them (as appropriate) into the final MIS review conclusions.

6. For the selected sample of MIS system(s) and as appropriate to support the defined scope, obtain user manual, user training manual/instructions, project plan and related work papers, Sample of MIS output Reports, MIS project development/enhancement work papers.

7. Test for compliance with established policies or practices and processes, and the existence of appropriate internal control measures. Refer to the Internal Control Questionnaire as needed.

8. Identify any area with inadequate supervision and/or undue risk. As required, perform appropriate verification procedures.

9. Select and review samples of ongoing executive reports for the targeted MIS area(s). Determine whether

a. The source of the information collected originates from the expected business area.

b. Users of the information are the appropriate employees or managers within that area of activity.

c. The reports are ultimately distributed to the appropriate users.

d. The flow of these MIS information/reports is consistent with the responsibilities reflected on the area’s official organization chart.

10. Determine the degree to which management and the staff in an area under review use MIS adequately and can support that the MIS being used is appropriate and effective. Discuss the five MIS elements with a senior manager(s) of the respective business unit. Repeat this work step with an employee of the business unit who has experience with the MIS system. Based on management’s self-assessment of the usability of its MIS, identify any planned activities to enhance, modify, or expand these systems.

11. Review minutes of the board of directors or committee(s) representing the MIS target area(s) for a  relevant time period. Determine any areas where MIS does not seem to meet the five required elements of MIS. Identify MIS issues for follow up.

12. Request a copy of the development plan for significant MIS-related projects. Review MIS project objectives and determine if they address reported MIS weaknesses and meet business unit plans. Review the project management technique used by management and determine the status of important MIS projects. Sample a significant MIS project(s) and determine whether it follows an approved and implemented development methodology.

13. Select a system and request copies of relevant user instructions. Determine whether the guidelines are meaningful, easy to understand, and current.

14. Determine whether user manuals provide adequate guidelines about complete description of the system, Input instructions, including collection points and times to send updated information, Balancing/ reconciliation instructions, full listing of output reports, including sample formats.

15. To review how information is identified, gathered, merged, manipulated, and presented, obtain a work flow showing data from the point-of-entry, through user processes, to final product. Discuss the area’s MIS process with a representative sample of users and determine if they know where the data is coming from, where it is going, and how it gets there. Identify and note the points where adjustments to data occur. Identify the department staffs who are responsible for the MIS related input data and reports. Determine if preparation and reconciliation processes are sufficient to reasonably ensure integrity of information. Check whether data adjustments are adequately documented.

16. Review the effectiveness of MIS in communication linking executives, appropriate users, and information systems employees. Review the effectiveness of the flow of communication throughout the organization and the documentation of which underlying MIS process supports the area’s management.

17. Determine the adequacy of MIS training including whether training needs are properly identified and prioritized. Check whether training is organized in a formal classroom setting, or on-the-job, or is a combination of both approaches. Check whether training material is provided or not. Check whether any training manual exist or not. Check whether training material adequately covers relevant and current issues.

18. Determine whether established procedures are sufficient to ensure the proper testing of system developments or enhancements. Determine if authorized processes are followed as data is acquired, merged, manipulated, and up-loaded from subsystems.

19. Check if the organization has had recent merger and/or acquisition activity, determine how management at the senior and departmental levels ensure that the resulting MIS supports and includes the five MIS elements. If mergers and acquisitions are frequent, determine whether appropriate policies or practices and procedures have been developed to support such activity from an integrated MIS perspective and
the consolidation of MIS systems in a merger still meets the requirements of a quality MIS system.

20. Review the results of your work, summarize your findings and initial conclusions, and discuss issues with an appropriate officer(s):

a. How well risks are controlled.

b. Identify significant control deficiencies.

c. Recommend action to remove deficiencies.

d. Obtain management’s corrective commitments and firm time frames.

21. Prepare a memorandum of your conclusions and supporting findings. Identify suggested follow-up actions, prepare a memorandum and document work programs to facilitate future examinations.