Information Systems, Data Analytics and Technology
This domain tests IT governance, control, and the use of data analytics in assurance and decision-making. Candidates must understand how systems create and protect data, and how analytics tests a population. Questions often ask for a control test, a data-quality check, or an interpretation of exceptions.
Core rules
- IT general controls cover access management, change management, IT operations, and backup and recovery. If general controls fail, application controls and reports may be unreliable.
- Segregation of duties prevents one person from initiating, approving, recording, and reconciling a transaction. Privileged access requires monitoring.
- Data analytics types are descriptive, diagnostic, predictive, and prescriptive. Assurance analytics commonly tests completeness, duplicates, outliers, and policy exceptions.
- Data quality depends on completeness, accuracy, validity, consistency, timeliness, and uniqueness. Population completeness must be established before testing.
- Privacy and cybersecurity controls protect confidentiality, integrity, and availability. Cloud arrangements require vendor due diligence and exit planning.
Worked example
An auditor tests duplicate payments by joining the purchase ledger to the vendor master. The procedure selects invoices with the same vendor, invoice number, and amount, and excludes credit notes and legitimate instalments. The population is reconciled from the general ledger to the purchase ledger and then to the payment file. Exceptions are investigated; a match is not automatically a duplicate. If the test finds payments to a bank account changed shortly before payment, the auditor reviews change approvals and confirms the account with the vendor. The conclusion states the exception rate, the cause, and the effect on control reliance.
Traps that cost marks
Do not test a sample when the objective is to test a population and data are reliable. Do not treat a data match as fraud without investigating cause. Do not ignore incomplete or stale data. Do not confuse an application control with an IT general control. Do not assume cloud providers remove the organisation's accountability for data.