I have an audit coming up, and I was wondering what physical, electronic, and logical access controls an auditor would look for when auditing a database for an ERP system. I'm really new to this process and any guidance would be appreciated.


I do agree with DeCosta's answer. What requirements, specifications are you going to be audited on? But, as my best shot in the dark: This is a "best practice" publication for security related to SQL 2005 that was published by Microsoft


And the books online article:


Also, here is a list of things that PricewaterhouseCoopers covers in their services related to Audits of ERP systems. It may give you some ideas. The menu on the left hand side covers a lot of topics that may be helpful in sparking things to research.


| improve this answer | |
  • No problem, good luck with audit. – RThomas May 25 '11 at 16:05

I applaud your effort, however the question asked is probably too vague. Different rules apply to different industries and furthermore, sometimes you have the opportunity to set your own rules, you just need to follow them.

I would suggest checking with someone as to what audit you are expected to pass, then finding the specific requirements.

| improve this answer | |
  • 3
    Agreed - they can't very well expect you to meet expectations without publishing what those expectations are. Is it related to HIPPA, Sarbanes Oxley, specific legal requirements related to the storage of criminal histories etc... – RThomas May 18 '11 at 5:22

To add to the excellent links above; I found the following documents as helpful reference regarding security and auditing:

  • PCI White paper Deploying SQL Server 2008 Based on Payment Card Industry Data Security Standards (PCI DSS) : Link
  • HIPPA white paper: Link
  • Microsoft SQL Server security bench mark from Center for Internet Security. Link
  • Also google for a document called Microsoft SQL Server database security checklist from US Department of Defense (unclassifed) --
| improve this answer | |

A point missed by those above is around identifying exactly what you are protecting - if it is credit card data, then it is easy to realise you need PCI-DSS, but in the wider scheme of things, PCI-DSS is not really that useful except as a bare minimum baseline. You need to identify what is of value to your company, whether for commercial reasons or because the regulator or shareholders say so, and ensure your audit takes these into account.

I would also suggest looking at security.stackexchange.com, which caters specifically for the security and risk professional, and there are a lot of us there who have carried out security audits, assisted with audit preparation, led large scale security improvement and testing programmes etc.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.