TO-DO_LIST RELATED APP: JOB DONE v5 versi MOBILE-PURPOSE aka +Bootstrap

Aspect	Forward Tracing (Information System)	Backward Vouching (Information System)
Direction of Analysis	Tracing data flow from the original input of the information system toward the final system output.	Tracing system outputs or reports backward to the original input data.
Starting Point	User input interfaces, data entry forms, sensors, or source transactions.	Reports, dashboards, logs, or database records produced by the system.
Main Objective	Verify that all input data is processed correctly and appears in system outputs.	Verify that the outputs originate from valid and authorized inputs.
Typical Data Flow	Input Interface → Application Processing → Database Storage → Reports	Reports → Database Records → Application Processing → Input Source
Risk Detected	Missing transactions, incomplete data processing, or unrecorded system inputs.	Fictitious transactions, manipulated outputs, or unauthorized data entries.
Audit Focus	Completeness and reliability of data processing.	Validity and authenticity of stored and reported data.
Example in Information Systems	Tracing a customer order from a web form submission through the system processing to the sales report.	Selecting a transaction from a sales report and tracing it back to the original web form input.

Audit Trail + Logging + Database Flow (Information System)

User Input
(Web Form / Interface)

→

Application Processing

→

Database Storage

→

Reports / System Output

→

Auditor Review

↘

Audit Trail
System Logs
Transaction History
Access Logs

Forward Tracing (Input → Output Verification)

User Input

→

Input Interface

→

Application Processing

→

Database Storage

→

System Reports

→

Audit Verification

Backward Vouching (Output → Source Verification)

System Reports

←

Database Records

←

Application Processing

←

Input Interface

←

Original User Input

Forward Tracing (Completeness)

Path: Auditor follows the normal system data flow to ensure no data was lost.

Input
Web Form

→

Processing
Validation

→

Database
Record

→

Output
Sales Report

Example Tracing a customer web order until it appears in the final sales report.

Backward Vouching (Validity)

Path: Auditor follows the reverse data flow to ensure the output is legitimate.

Input
Source Doc

←

Processing
System Logs

←

Database
SQL Record

←

Output
Sales Report

Example Selecting a transaction from a report and verifying the original web form submission.

Information System Audit Architecture: Forward Tracing, Backward Vouching, Audit Trail, and Logging

User Input

→

Input Interface

→

Application Processing

→

Database Transaction

→

Database Storage

→

Reports / System Output

→

Auditor Analysis

Application Logs

→

Database Transaction Logs

→

Access Logs

→

Audit Trail Records

→

Security Monitoring / Audit Review

Integrated Information System Audit Architecture

User Input

Input Interface

↔

App Processing

Logic Layer

↔

DB Transaction

SQL Execution

↔

DB Storage

Data at Rest

↔

System Output

Reports/Exports

FORWARD TRACING (Completeness)

BACKWARD VOUCHING (Validity)

AUDIT TRAIL LAYER

User Activity Logs | Processing Timestamps | Transaction IDs | System State Snapshots

Application Logs Tracks internal errors, logic execution, and validation checks.

DB Transaction Logs Audit of INSERT, UPDATE, and DELETE operations.

Access Logs Records login/logout, IP addresses, and permission elevation.

Advanced Information System Audit Architecture (Forward Tracing, Backward Vouching, Logging, SIEM, and Audit Trail)

User (Client / Browser)

→

Web Server

→

Application Server

→

API / Business Logic

→

Database Transaction

→

Database Storage

→

Reports / System Output

→

Auditor Investigation

Web Server Logs

→

Application Logs

→

API Logs

→

Database Transaction Logs

→

Centralized Logging Server

→

Audit Trail Storage

Security Monitoring

→

SIEM System (Security Information and Event Management)

→

Fraud Detection & Compliance Review

Enterprise IS Audit Framework

Multi-Tier Architecture with Integrated SIEM & Logging

User / Client Web Form / App

↔

Web Server HTTP/S Traffic

↔

App Server Business Logic

↔

API Gateway Integration Layer

↔

Database SQL/NoSQL Store

↔

Reports System Output

FORWARD TRACING: Source → Report (Completeness)

BACKWARD VOUCHING: Report → Source (Validity)

CENTRALIZED LOGGING SERVER & AUDIT STORAGE

Web/App Logs: Session IDs, HTTP Status, Method Execution.

DB Logs: Transaction Commit, SQL Triggers, Data Delta.

API Logs: Payload Checksums, Auth Tokens, IP Geolocation.

Audit Trail: Immutable timestamped records of CRUD operations.

SIEM

Security Information & Event Management

• Real-time Alerting
• Threat Correlation
• Anomaly Detection
• Incident Response

Auditor Workflow: Compare Centralized Logs against System Outputs to ensure that 100% of inputs were recorded (Tracing) and 100% of outputs are authentic (Vouching). SIEM provides the forensic layer for detecting unauthorized tampering.

---

APPENDIX (Additional Section of Latest Update IMO)

Presentation Layer (User Interaction)

User / Client Device

→

Browser / Mobile App

→

Web Server

Application Layer (Business Logic)

Application Server

→

API Gateway

→

Business Logic Processing

Data Layer (Transaction & Storage)

Database Transactions

→

Database Storage

→

Reports / Analytics

Audit Trail & Logging Layer

Web Server Logs

→

Application Logs

→

API Logs

→

Database Transaction Logs

→

Centralized Logging Server

→

Audit Trail Storage

Security Monitoring & Fraud Detection

Security Monitoring

→

SIEM System

→

Fraud Detection

→

Compliance Audit

How Forward Tracing Works in This Architecture

Forward tracing follows the natural system data flow from the beginning of the transaction until it reaches the final system output.

User
↓
Web Server
↓
Application Server
↓
Business Logic
↓
Database Transaction
↓
Database Storage
↓
Reports

Purpose:

• Ensure all inputs are processed by the system
• Detect missing transactions
• Verify data completeness

Example: A customer order submitted through a website form is traced through the web server, application server, and database until it appears in the sales report.

How Backward Vouching Works in This Architecture

Backward vouching follows the reverse direction of the system flow. The auditor starts from the report or output and traces the data back to the original source.

Reports
↑
Database Storage
↑
Database Transactions
↑
Application Logic
↑
Web Server
↑
User Input

Purpose:

• Verify data validity
• Detect fraudulent or fictitious transactions
• Ensure that every report entry originates from a real transaction

Example: A transaction found in a financial report is traced backward to the database record and then to the original user input.

Audit Checkpoints in the System

Auditors typically examine several checkpoints in the system where important information about transactions is recorded.

• Application logs – record internal system activities and processing events
• Database transaction logs – record INSERT, UPDATE, and DELETE operations
• Access logs – record user login activity and access attempts
• Audit trail storage – record historical actions performed in the system

These checkpoints allow investigators to reconstruct every action performed within the system.

Fraud Detection Points

Fraud detection in information systems usually occurs through automated monitoring and analysis of system logs.

• Security Information and Event Management (SIEM) systems
• Transaction anomaly detection
• User behavior monitoring
• Compliance and audit review

By analyzing logs and audit trails, organizations can detect suspicious activities, unauthorized access, and potential fraud.