ICAB CL Management Information cheat sheet

An information system is a set of interrelated components (people, processes, data, software, hardware, networks) that collect, process, store, and distribute information to support decision making and control.

Data are raw, unorganized facts; information is data processed into a meaningful form; knowledge is information combined with experience and context to enable action.

The IPO model: Input (capture and validation) -> Processing (computation, sorting, aggregation) -> Output (reports, transactions, dashboards); feedback loops compare output to standards.

Process decomposition hierarchy: value chain > core/support processes > sub-processes > activities > tasks; each level should have an owner, defined inputs/outputs, and measurable KPIs.

Core processes are customer-facing and revenue-generating (order-to-cash, procure-to-pay, hire-to-retire); support processes (IT, HR, finance) enable them.

Business process modeling notation (BPMN) uses events (circles), activities (rounded rectangles), gateways (diamonds), and sequence flows (arrows) to document as-is and to-be processes.

A business process management (BPM) lifecycle: model -> deploy -> monitor -> optimize; monitoring uses process mining or KPI dashboards to detect bottlenecks and rework loops.

Transaction processing systems (TPS) are the operational backbone; management information systems (MIS) summarize TPS data into periodic reports; executive information systems (EIS) provide high-level dashboards.

Separation of duties within a process (e.g., requisition, approval, receipt, payment) reduces fraud and error risk and is a key internal control design principle.

IT governance is the system by which IT is directed and controlled: it defines decision rights, accountability, and performance measurement for IT investments.

COSO internal control framework components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

COBIT 2019 defines governance objectives across five domains: Evaluate, Direct, Monitor (EDM) and Align, Plan, Organize (APO); Build, Acquire, Implement (BAI); Deliver, Service, Support (DSS); Monitor, Evaluate, Assess (MEA).

ITIL 4 service value chain activities: Plan, Improve, Engage, Design and Transition, Obtain/Build, Deliver and Support; governance is the means by which an organization is directed and controlled.

Segregation of IT duties: developers should not have production access; system administration should be separate from security administration; change approval should be independent of change execution.

Key IT governance KPIs: percentage of IT projects delivered on time/on budget, IT cost as percentage of revenue, system availability, incident resolution time, and audit finding closure rate.

A steering committee (IT governance board) typically includes CIO, CFO, business unit leaders, and risk/compliance; it prioritizes IT investments and approves policy.

Control types: preventive (access controls, approvals), detective (logs, reconciliations, audits), corrective (backups, incident response), and compensating (manual checks when automated controls are infeasible).

IT balanced scorecard perspectives adapted from Kaplan/Norton: business contribution, user orientation, operational excellence, and future orientation.

Data governance defines who can take what action, with what data, when, and under what circumstances; it includes data ownership, stewardship, quality, and lifecycle management.

DAMA-DMBOK data management knowledge areas include data architecture, modeling, storage, security, integration, quality, master data, and reference data management.

Data quality dimensions: accuracy, completeness, consistency, timeliness, validity, uniqueness, and integrity; each dimension needs measurable acceptance criteria.

Analytics maturity progression: descriptive (what happened) -> diagnostic (why) -> predictive (what will happen) -> prescriptive (what should be done).

Decision support systems (DSS) combine data, models, and a user interface; model-driven DSS uses simulation/optimization, data-driven DSS uses OLAP and query/reporting.

Data warehouse vs. data lake: warehouse stores structured, schema-on-write data for BI; lake stores raw structured/semi-structured/unstructured data with schema-on-read for exploration and ML.

ETL vs. ELT: ETL transforms before loading into the warehouse; ELT loads raw data first and transforms inside the target platform, leveraging its compute.

Key analytics techniques: regression (relationship between variables), classification (assign categories), clustering (group similar records), time-series forecasting, and optimization.

A KPI must be specific, measurable, achievable, relevant, and time-bound (SMART), with a defined formula, data source, owner, and target.

CIA triad: confidentiality (authorized access only), integrity (accurate and complete), availability (accessible when needed); non-repudiation and authenticity are supporting properties.

Risk = likelihood x impact; risk treatment options are avoid, mitigate/reduce, transfer (insurance, contracts), and accept (with documented tolerance).

Defense in depth layers: physical, network (firewalls, segmentation, IDS/IPS), endpoint (antivirus, EDR), application (input validation, secure coding), data (encryption, DLP), and human (awareness training).

Authentication factors: something you know (password), something you have (token, smart card), something you are (biometrics); MFA requires two or more different factor types.

Access control models: discretionary (owner decides), mandatory (classification labels), role-based (job function), and attribute-based (contextual policies).

Encryption: symmetric (AES) is fast for bulk data; asymmetric (RSA, ECC) supports key exchange and digital signatures; hashing (SHA-256) provides integrity, not confidentiality.

Incident response phases: preparation, detection and analysis, containment/eradication/recovery, post-incident lessons learned.

Business continuity (BCP) vs. disaster recovery (DRP): BCP keeps critical business functions running; DRP restores IT infrastructure; both depend on RTO and RPO targets.

Common threats: phishing/social engineering, ransomware, insider threat, SQL injection, man-in-the-middle, and denial of service; controls should map to each threat vector.

SDLC phases: planning/feasibility, requirements analysis, design, build/development, testing, deployment, and maintenance; each phase has entry/exit criteria and deliverables.

Development methodologies: waterfall (sequential, document-heavy), iterative/incremental, agile/Scrum (sprints, backlog, daily standups, retrospectives), and DevOps (CI/CD, automation).

Requirements types: functional (what the system does) and non-functional (performance, security, usability, availability); both must be testable and traceable.

Testing levels: unit, integration, system, user acceptance (UAT), regression, and security/performance testing; UAT confirms fitness for business purpose.

Build vs. buy decision criteria: total cost of ownership, time to market, customization needs, integration complexity, vendor stability, and strategic differentiation.

Change management (ITIL) process: request for change (RFC) -> assessment/approval by change advisory board (CAB) -> build/test -> release and deployment -> post-implementation review (PIR).

Emergency changes require expedited approval and retrospective review; all changes should be logged with requester, approver, test evidence, and rollback plan.

Segregation in development: development, test, and production environments must be separated; developers must not promote their own code to production without independent approval.

Configuration management maintains the configuration management database (CMDB) of configuration items (CIs) and their relationships to support impact analysis.

Digital transformation is the integration of digital technology into all areas of a business, fundamentally changing how it operates and delivers value to customers.

Transformation pillars: customer experience, operational processes, business models, and organizational culture/capabilities.

Cloud service models: IaaS (infrastructure), PaaS (platform), SaaS (software); deployment models: public, private, hybrid, community.

Cloud shared responsibility model: provider secures the cloud infrastructure; customer secures data, identities, access, and configurations in the cloud.

RPA (robotic process automation) automates rule-based, repetitive tasks via software bots; it is best suited to high-volume, low-variation, structured-data processes.

AI/ML lifecycle: problem framing -> data collection/preparation -> model training -> evaluation -> deployment -> monitoring for drift and bias.

Blockchain is a distributed, append-only ledger with cryptographic hashing and consensus; use cases include provenance, smart contracts, and tamper-evident records.

IoT architecture layers: device/sensor, connectivity, data processing, application; security concerns include weak device authentication, unpatched firmware, and data privacy.

Digital transformation KPIs: digital revenue share, customer digital adoption, process cycle time reduction, automation rate, and cloud migration percentage.