According to IIA guidance on IT auditing, which of the following would not be an area examined by the internal audit activity?