Technology and Data: Controls, Analytics, and Governance
What you must understand
This domain tests whether you can govern financial systems and data rather than configure software. Core concepts: internal controls over financial reporting (ICFR) in automated environments - segregation of duties, change management, and access reviews; IT general controls (ITGCs) covering program changes, operations, and access; and application controls (input, processing, output) that ensure completeness and accuracy. Understand the data lifecycle: capture, validation, transformation, storage, retention, and disposal, plus data quality dimensions - completeness, accuracy, timeliness, consistency, and validity. Be able to distinguish descriptive, diagnostic, predictive, and prescriptive analytics, and know that data governance assigns ownership, stewardship, and definitions (a data dictionary) so reports reconcile across systems. Familiarity with ERP integration, automated journal entries, and audit trails matters; so does awareness of cybersecurity fundamentals (least privilege, multi-factor authentication, encryption, backup and recovery) and privacy/retention obligations.
Traps candidates fall into
- Confusing an ITGC with an application control: a password policy is general; an edit check on a purchase order is application-level.
- Assuming automation eliminates risk - automated interfaces can propagate errors to every record, so interface reconciliation controls are essential.
- Choosing predictive analytics when the question describes explaining a past variance (that is diagnostic).
- Treating data governance as an IT project rather than a business ownership structure.
- Overlooking change management as the control that prevents unauthorized modification of calculation logic.
Worked example / rule of thumb
A nightly interface posts 1,200 inventory transactions from the warehouse system to the ERP; 1,187 post successfully. The control is a record-count and dollar-total reconciliation between source and target, with exceptions investigated before close. Rule of thumb: for any automated data flow, ask what control proves completeness and accuracy at the boundary? If none exists, the risk is misstatement at scale.