Information Technology and Information Systems
Systems in the finance function
Understand the role of enterprise resource planning systems, general ledger and subledger architecture, and how master data (chart of accounts, customer and vendor records) drives reporting integrity. Know the difference between transaction processing, management reporting and decision-support layers.
Controls in IT environments
Revise general IT controls (access management, change management, backup and recovery, physical and environmental controls, network security) versus application controls (input, processing, output). Know the purpose of segregation of duties, particularly between developers, operators and users, and why IT general controls underpin reliance on automated controls.
Emerging technology
Be able to describe, at a conceptual level, cloud computing (shared responsibility, service models), robotic process automation, data analytics, blockchain and artificial intelligence, and their implications for audit evidence, control risk and the finance professional's role. Understand data quality dimensions: completeness, accuracy, validity, timeliness and uniqueness.
Threats and response
Know malware, phishing, ransomware, social engineering and insider threat, and the layered defence concept. Understand business continuity versus disaster recovery objectives, and the meaning of recovery point and recovery time objectives.
Traps
Questions confuse general controls with application controls, or assume automated controls are reliable without testing the underlying IT general controls. Watch for cloud questions where the customer retains responsibility for data and access.
Worked rule of thumb
If a company relies on an automated three-way match, the auditor must first test the IT general controls over the matching program's change management and access. No reliable program, no reliance.