Information Technology and Accounting Information Systems: Controls and Risks
Core concepts
This domain tests the accountant's understanding of information systems and the controls that protect them. Candidates must understand the components of an accounting information system (people, procedures, data, software, hardware), the transaction processing cycle, and the types of controls: general IT controls (access, change management, backup, physical security) and application controls (input, processing, output). Key risks include fraud, data loss, unauthorised access, and system failure. Concepts of segregation of duties, audit trails, and computer-assisted audit techniques (CAATs) are essential.
Traps
Questions often confuse general controls with application controls, or test whether a control is preventive, detective, or corrective. Watch for the risk of a single person having both custody of assets and record-keeping responsibility. In cloud computing questions, consider data ownership, availability, and confidentiality. Do not assume that a computer system eliminates the need for physical controls; backup and disaster recovery plans remain essential.
Worked example
A clerk who both receives customer payments and updates the receivables ledger has incompatible duties, creating a fraud risk. The control is segregation of duties: one person records the transaction, another handles cash. A detective control would be a monthly bank reconciliation performed by an independent person.
Rule of thumb
No single person should control an entire transaction from initiation to recording to custody.