This is a collection of consensus reports, each produced at a session of an invitational workshop sponsored by the National Bureau of Standards. The purpose of the workshop was to explore the state-of-the-art and define appropriate subjects for future research in the audit and evaluation of computer security. Leading experts in the audit and computer communities were invited. Ten topics are reported on: (1) internal audit standards, (2) qualifications and training, (3) security administration, (4) audit considerations in various system environments, (5) administrative and physical controls, (6) program integrity, (7) data integrity, (8) communications, (9) post-processing audit tools and techniques, and (10) interactive audit tools and techniques. (Author)