ICAB CL Management Information flashcards
ICAB CL Management Information · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Information system
- A set of interrelated components that collect, process, store, and distribute information to support decision making, coordination, and control in an organization.
- Data vs information
- Data are raw, unorganized facts; information is data processed into a meaningful form that supports decisions. Knowledge adds experience and context to information.
- IPO model
- Input, Processing, Output model describing any system: inputs are captured and validated, processing transforms them, outputs are produced and compared to standards via feedback.
- BPMN gateways
- Diamond symbols in process models that control flow branching: exclusive (one path), inclusive (one or more paths), parallel (all paths), and event-based (path chosen by event).
- Separation of duties
- An internal control principle requiring that no single person controls all stages of a transaction, reducing fraud and error risk by distributing authorization, custody, and recording.
- IT governance
- The system by which IT is directed and controlled, defining decision rights, accountability, and performance measurement for IT investments and resources.
- COSO components
- Five internal control components: control environment, risk assessment, control activities, information and communication, and monitoring activities.
- COBIT 2019 domains
- Governance objectives grouped into EDM (Evaluate, Direct, Monitor) plus management domains APO, BAI, DSS, and MEA covering planning, building, delivering, and monitoring IT.
- Preventive control
- A control designed to stop errors or fraud before they occur, such as access restrictions, approvals, segregation of duties, and input validation.
- Detective control
- A control that identifies errors or irregularities after they occur, such as reconciliations, exception reports, log reviews, and audits.
- IT steering committee
- A governance body of senior business and IT leaders that prioritizes IT investments, approves policy, and monitors IT performance against strategic objectives.
- Data governance
- The exercise of authority and control over data management, defining decision rights, accountability, data quality standards, and lifecycle policies across the organization.
- Data quality dimensions
- Measurable characteristics of data including accuracy, completeness, consistency, timeliness, validity, uniqueness, and integrity, each with defined acceptance criteria.
- Descriptive analytics
- The analytics stage that summarizes historical data to answer what happened, using reports, dashboards, and aggregation techniques.
- Predictive analytics
- The analytics stage that uses statistical models and machine learning on historical data to estimate the likelihood of future outcomes.
- Data warehouse
- A centralized repository of structured, schema-on-write data integrated from multiple sources and optimized for business intelligence querying and reporting.
- Data lake
- A repository storing raw structured, semi-structured, and unstructured data with schema-on-read, supporting exploration, data science, and machine learning.
- ETL
- Extract, Transform, Load: data is extracted from sources, transformed to target format and quality rules, then loaded into the warehouse.
- CIA triad
- The core information security model: confidentiality (authorized access only), integrity (accurate and complete), and availability (accessible when needed).
- Risk treatment options
- Four responses to identified risk: avoid the activity, mitigate or reduce likelihood/impact, transfer via insurance or contracts, or accept with documented tolerance.
- Multi-factor authentication
- Authentication requiring two or more different factor types: something you know, something you have, or something you are.
- Role-based access control
- An access control model granting permissions based on job roles rather than individuals, simplifying administration and supporting least privilege.
- Symmetric encryption
- Encryption using the same key for encryption and decryption, such as AES; it is fast and suited to bulk data protection but requires secure key distribution.
- Incident response phases
- Preparation, detection and analysis, containment/eradication/recovery, and post-incident lessons learned; each phase has defined roles and documentation.
- Recovery time objective
- The maximum acceptable time to restore a system or process after disruption; it drives DR architecture and investment decisions.
- SDLC phases
- Planning/feasibility, requirements analysis, design, build, testing, deployment, and maintenance, each with entry/exit criteria and deliverables.
- Functional requirements
- Statements describing what a system must do, such as calculations, workflows, and data processing rules; they must be testable and traceable.
- User acceptance testing
- Testing performed by business users to confirm the system meets business requirements and is fit for purpose before go-live.
- Change advisory board
- A group that assesses, prioritizes, and approves IT changes, balancing risk and business need; emergency changes receive expedited approval and retrospective review.
- Build vs buy
- A sourcing decision comparing custom development against purchasing a vendor product, weighing total cost, time, customization, integration, and strategic value.
- Cloud shared responsibility
- A cloud security model where the provider secures infrastructure, while the customer secures data, identities, access, and configuration in the cloud.
- Robotic process automation
- Software bots that automate rule-based, repetitive, structured-data tasks, best suited to high-volume, low-variation processes with clear rules.