ICAB CL Management Information key terms

A set of linked activities that takes one or more inputs and produces an output of value to a customer or stakeholder. Processes cross departmental boundaries and are described by their triggers, steps, controls, and outcomes.

A technique that documents how work flows through an organisation, showing activities, decision points, handoffs, systems touched, and delays. The resulting diagram exposes bottlenecks, duplication, and control gaps that narrative descriptions hide.

A radical redesign of core processes to achieve dramatic gains in cost, quality, speed, or service, rather than incremental improvement. It questions why work is done at all and often removes whole steps instead of automating them.

A model that separates an organisation's activities into primary activities that create customer value and support activities that enable them. It helps identify where information systems can reduce cost or add differentiation.

The policies, procedures, and system features that give reasonable assurance that objectives are met, assets are safeguarded, records are reliable, and laws are followed. Controls are classified as preventive, detective, or corrective.

A widely used model describing internal control as five components: control environment, risk assessment, control activities, information and communication, and monitoring. Auditors and management use it to design, evaluate, and report on control systems.

A control that divides incompatible tasks, such as authorising a transaction, recording it, and having custody of the related asset, among different people. It reduces the chance that one person can both commit and conceal an error or fraud.

Controls that apply across systems and support the reliability of all applications, covering access management, change management, operations, and backup. If general controls fail, reliance on automated application controls is undermined.

Controls built into a specific business system, such as input validation, sequence checks, reconciliation totals, and authorisation limits. They address the completeness, accuracy, and validity of transactions processed by that application.

A chronological record of system activity that shows who did what, when, and from where. It supports investigation, dispute resolution, and compliance, and must itself be protected from alteration or deletion.

The decision rights and accountability framework that determines who may define, produce, and use data, and how quality is assured. It assigns ownership, sets standards, and resolves conflicts over data definitions and access.

A named person accountable for the quality, definition, and appropriate use of a defined data domain. Stewards resolve discrepancies, approve changes to definitions, and act as the contact point for data issues.

The degree to which data is fit for its intended use, commonly assessed on accuracy, completeness, consistency, timeliness, validity, and uniqueness. Poor quality raises operating cost and misleads decision makers.

Data that describes other data, such as definitions, formats, ownership, lineage, and access rules. Good metadata lets users find, interpret, and trust data, and underpins auditability of reports.

The discipline of creating and maintaining a single trusted version of core reference entities such as customers, products, suppliers, and employees across systems. It prevents conflicting records that distort reporting and service.

The documented path of data from its source through transformations to its final report or model. It supports impact analysis when a source changes and helps auditors verify that reported figures are traceable.

A central store that consolidates data from multiple operational systems, cleaned and structured for query and reporting. It separates analytical workload from transaction systems and preserves historical snapshots.

Extract, transform, load: the process that pulls data from source systems, cleanses and standardises it, and loads it into a warehouse. Errors in transformation logic silently corrupt downstream reports.

A measure chosen because it signals progress toward a specific objective, expressed with a target, owner, and reporting frequency. Good indicators are few, actionable, and tied to decisions rather than merely interesting.

A visual display that consolidates selected metrics for rapid monitoring, usually refreshed automatically. Design choices such as metric selection, scaling, and context determine whether it informs or misleads.

An information system that combines data, models, and an interactive interface to help managers analyse semi-structured problems. It supports judgement rather than replacing it with automatic decisions.

The use of historical data and statistical or machine learning models to estimate future outcomes such as demand, default, or churn. Results are probabilistic and require validation, monitoring, and awareness of bias.

The exploratory application of statistical and machine learning techniques to large datasets to find patterns, segments, and associations not obvious from summary reports. Findings must be tested to avoid spurious correlations.

Confidentiality, integrity, and availability: the three properties used to describe what protecting information means. Every control can be justified by which of the three it preserves, and trade-offs between them are explicit.

The process of identifying threats and vulnerabilities, estimating likelihood and impact, and comparing the result with a risk appetite. It prioritises treatment so limited resources go to the most significant exposures.

The mechanisms that decide who may read, change, or use a resource, typically through identification, authentication, authorisation, and logging. The principle of least privilege limits each user to what the role requires.

The transformation of readable data into ciphertext using a key so that only holders of the correct key can recover it. It protects data in transit and at rest, but does not prevent loss or misuse by an authorised user.

Documented arrangements for keeping critical operations running during and after a disruption, including alternate sites, staffing, and manual workarounds. It is validated by testing and aligned with recovery objectives.

The technical subset of continuity planning that specifies how systems, data, and infrastructure are restored after failure, with defined recovery time and recovery point objectives. It depends on tested backups and documented procedures.

The structured phases through which an information system is conceived, built, tested, implemented, operated, and retired. Each phase produces deliverables and approval points that govern progression to the next.

An iterative approach that delivers working software in short increments, guided by continuous customer feedback and adaptive planning. It changes control emphasis toward frequent testing, backlog governance, and automated checks.

Formal testing in which intended users confirm that a system meets agreed business requirements and is fit for purpose before go-live. Sign-off transfers ownership from the project team to operations.

The controlled process for requesting, assessing, approving, testing, and implementing modifications to systems or infrastructure, with rollback provision. It prevents unauthorised or untested changes from disrupting services or controls.

The practice of recording and controlling the components of an IT environment and their versions, so that what is running in production is known and reproducible. It underpins reliable change, recovery, and audit.

Delivery of computing resources such as storage, processing, and software over a network on a metered, elastic basis. It shifts capital cost to operating cost and moves part of the control environment to the provider.

The principle that data is subject to the laws and governance of the jurisdiction where it is stored or processed. It constrains where cloud services may hold personal or regulated information.

Software that mimics user actions to execute repetitive, rule-based tasks across systems without changing those systems. It speeds processing but requires strong exception handling and access controls.

The organisation-wide rethinking of strategy, processes, and customer experience enabled by digital technology, going beyond digitising existing steps. It typically demands new skills, data practices, and governance.

Systematic unfairness in automated outputs arising from unrepresentative training data, flawed labelling, or objectives that encode past discrimination. It creates legal, reputational, and ethical risk and requires ongoing testing.