Auditor Involvement in Systems Deployment - Auditing Information Systems: Enhancing Performance of the Enterprise - page 114

system. Training users is a key process because it can determine whether the system suc-
ceeds or fails. Users may point to lack of adequate training as the reason why they are not
using the system after deployment.
Training for system administrators should also be conducted immediately after the system
is ready for deployment as these are the specialists that will support the system and ensure
that it is available 24/7.
The system administrators need to have thorough training and understanding of the system
functionalities. They should be able to administer the system with minimum support from
the vendors unless it is by design. The administrators also should be provided with properly
developed system administration manuals. The administrators will require regular training
updates so that they are able to support new releases of the software.
The enterprise should also ensure that they have appropriate service-level agreements
(SLAs) signed with the software vendor or developer so that adequate support is provided.
It is often recommended that user training should be conducted at two or more levels. Be-
fore the implementation of the project, management should identify the champions of the
project. Where there are many modules in the system, it is appropriate to have one or two
champions per module. The champions will be responsible for the module and may also be
the administrators of that module responsible for all user functions from training users, al-
locating user rights, recommending module updates, and monitoring the use of the module.
The champions should receive a higher level of training than ordinary users.
Users should be trained after the champions have done their training. Champions can be
involved in the training of users in order to give them an opportunity to develop their skills
and have experience in the use of the application system. User training should cover all the
required system functions or limited to a particular module allocated to a user.
In order to have an effective training program, users should have access to training manuals
during and after training. These documents can be available through soft copy or hard copy.
Online copies are usually desired as they are always available and consistent since they are
regularly updated. Users in the course of their duties often would like to refer to procedures
manuals. These documents should also be available online. When procedures change, these
documents should also be updated immediately.
The IS auditor may not be a user of the system but is required to be trained on the function-
alities of the system so that he is able to conduct effective audits. Where the IS auditor is
required to conduct highly technical audits, more advanced training may be required by the
IS auditor, which will include all the technical functionalities and supporting systems such
as databases and integration tools. It is also a good consideration to have the IS audit team
receive training on how to read and interpret data collected by reporting tools such as the
system audit trails.