Information Technology and Accounting Systems: Controls, Risks and Data
Information Technology and Accounting Systems tests whether you can evaluate the control environment around an accounting system - ERP, cloud ledger or e-filing portal - and describe how data integrity is preserved. Answers score when they separate general IT controls from application controls and name the specific risk each control addresses.
General IT controls and application controls
- General IT controls support the reliable operation of every application: user access management, privileged access, change management and testing of system changes, backup and recovery, physical and network security, and IT operations. If these fail, application controls cannot be trusted.
- Application controls operate inside the process: input controls (mandatory fields, validation checks, authorisation limits, batch and hash totals, sequence checks), processing controls (reconciliations, exception reports, duplicate invoice checks) and output controls (distribution lists, review of reports before use).
- Segregation of duties in the system means separating master data maintenance, transaction entry, payment release and reconciliation.
- Audit trail must be preserved; Cyprus tax law requires accounting records to be kept for six years.
Risks and assurance over systems
- Cybersecurity risks include phishing, ransomware, misuse of privileged accounts and weaknesses at cloud providers. Relevant controls are multi-factor authentication, timely patching, tested restorable backups and log monitoring.
- When using CAATs or data analytics to test a full population, confirm the completeness and accuracy of the extracted data before drawing a conclusion.
- Under the GDPR, personal data needs a lawful basis, data minimisation, retention limits, and breach notification within 72 hours.
Worked example
A purchase ledger clerk can create supplier master records, amend bank details and post payments. The risk is a fictitious supplier: the clerk creates a supplier with their own bank account, posts an invoice and releases the payment. Effective control design addresses each step - restrict master data creation to a separate officer, require dual authorisation for bank-detail changes with a call-back to the supplier on a known number, and give the financial controller a monthly exception report of all supplier bank-detail changes. The reasoning is what earns marks: the design is layered and preventive, whereas a single year-end review is merely detective.
Traps that cost marks
Treating IT controls as solely the IT department's responsibility; confusing general controls with application controls; accepting a system-generated report without testing the parameters; and ignoring the service auditor's report for a hosted accounting package.