Skip to Main Content
  • Questions
  • Auditors requesting missing sequence gaps

Breadcrumb

Question and Answer

Tom Kyte

Thanks for the question, Kelly.

Asked: June 13, 2007 - 7:02 pm UTC

Last updated: June 14, 2007 - 11:26 am UTC

Version: 10.2.0

Viewed 1000+ times

You Asked

Tom,
Are the sequence numbers that are discarded from the cache available anywhere? We are aware that sequence numbers will NEVER be gap-less, but our auditors want us to prove that we didn't just delete transactions.

and Tom said...

this is the thing of audit trails.

You cannot prove a negative.


You need to audit modifications so you can say "see, no audit trail record for a delete there, so no delete took place"


the sequence values that are gapped over - they never existed anywhere, they were never available to be "available somewhere" in the first place.

Rating

  (6 ratings)

Is this answer out of date? If it is, please let us know via a Comment

Comments

Fresher auditors

Jim, June 14, 2007 - 12:17 pm UTC

Unfortunately, accounting firms usually send junior accountants to do audits. So the junior accountant doesn't know that looking at sequence numbers with gaps isn't something to worry about. (like writing VOID on a check and throwing it away.) There are more effective ways to audit businesses than this type of thing. Unfortunately, it involves some domain knowledge of the business and experience.

Why audit a sequence?

Greg Forestieri, June 14, 2007 - 1:13 pm UTC

Kelly - Could you give an example of what sort of table they are auditing for sequences? What is the auditor rationale for auditing a sequence?

thx

Caching?

Don, June 15, 2007 - 4:49 am UTC

It's possible too, that you have cached say 100 sequence numbers in your CREATE SEQUENCE statement, and the instance is stopped before those cached numbers are used, discarded, and the sequence.nextval then becomes the next highest number ater what was last cached.

Vikas Atrey, June 16, 2007 - 4:19 am UTC

Business users should not be exposed to such information which has no business meaning. If such information is of business use then do not use sequences and generate it in such a manner devoid of any holes.

or even better if we can educate the auditors if it possible with other constraints in place.

Wow

Chuck Jolley, June 25, 2007 - 3:57 pm UTC

And I thought I had it bad with government auditors.
If they are that interested in sequences, how do they feel about receipt and check numbers in a multi-user system!?

That's the problem with auditors.
You can tell users that they can have single user input and no gaps (not using sequences), or multi user input and gaps (using sequences). You don't care, you'll code it up which every way they want it.
Auditors don't care about office organization, they just don't want any gaps.

Assuming you have a good audit of your transactions that do take place, a written explanation by you of how sequences work, why they are used in this situation, and why there are gaps might satisfy them.

Auditors

Joel H., July 02, 2007 - 10:55 am UTC

heh...you think you haveit bad?
We had to turn on as much db auditing as possible for our auditors.
Why?
They wanted to make sure that we didn't have someone in a back room somewhere typing in data manually as the auditors used the product.