The auditor for a retail company that uses EDI wishes to establish that orders are placed only by those within the company having the authority to place orders. The company uses access control software; and it has specified product lists for each purchasing agent, authorized limits to buy the products, and established a password system.

Develop an audit program to determine that all purchases are by those authorized, to vendors authorized by the firm, and for products authorized for the purchasing agent.