ICAG Paper 1.2 BMIS cheat sheet

Business information systems (BIS) are socio-technical systems: people, process, data, technology and controls must be assessed together; a technology-only view is an incomplete audit scope.

Governance is the set of structures and processes by which decisions on IT are made, directed and monitored; management executes those decisions. Distinguish governance (who decides, accountability) from management (how it is done).

COSO Internal Control framework has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities - mapped to operations, reporting and compliance objectives.

COSO ERM (2017) organises risk around strategy, performance and governance; ERM risk appetite is expressed as acceptable variation in performance, not merely a list of risks.

Segregation of duties separates custody of assets, authorisation, and record-keeping; in an ERP the same conflict can occur through role combinations, so test role-level conflicts, not just job titles.

The audit trail for a transaction should allow reconstruction of who, what, when, where and why; system-generated timestamps and immutable logs are stronger evidence than user-maintained logs.

IT governance frameworks: COBIT separates governance and management objectives and provides maturity/capability ratings; ISO/IEC 27001 addresses information security management systems, not general IT governance.

Three lines model: operational management owns and manages risk; risk and compliance functions monitor and advise; internal audit provides independent assurance to the governing body.

Input controls (edit checks, field validation, batch totals, maker-checker) prevent bad data entering; processing controls (run-to-run balancing, exception reports) detect errors mid-flow; output controls protect distribution and reconciliation.

Batch totals: hash total uses a non-financial field (e.g. account number sum); record count and financial total prove completeness of a batch through each processing stage.

General IT controls apply across applications: access management, change management, IT operations, backup and recovery. Application controls are transaction-specific; weak general controls can undermine reliance on application controls.

Change management evidence: documented request, risk assessment, authorisation, test evidence, and segregation between developer and person who promotes to production (no developer access to live data).

CAATs: test data (dummy transactions through a copy of the live system), parallel simulation, embedded audit modules, and data analytics on full populations; generalised audit software queries the database directly.

Automated controls require a one-time design test plus periodic tests of the automated logic and of the supporting IT general controls; they do not eliminate the need for re-testing when systems change.

Computer-assisted audit techniques on the full population reduce sampling risk but do not address completeness of the source data - reconcile the population to a control total first.

Disaster recovery focuses on restoring IT infrastructure; business continuity focuses on keeping critical business processes running. RTO is maximum tolerable downtime; RPO is maximum tolerable data loss.

Cloud shared-responsibility model: provider secures the infrastructure and platform; the customer remains accountable for access management, data classification, configuration and user behaviour.

SaaS customisation risk: configuration changes can bypass controls; each configuration change should be treated as a change request with testing and approval.

Data protection principles typically include lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability; cross-border transfers need a lawful basis.

Big data analytics risk: data quality and completeness, model bias, privacy re-identification, and the risk that dashboards hide source-data lineage; require lineage documentation.

Artificial intelligence controls: training-data governance, model validation and monitoring, human review of material decisions, explainability, and logging of model versions and inputs.

RPA bots should be inventoried, have named owners, use dedicated credentials (never shared user accounts), and be subject to the same change and access controls as human users.

Cyber risk indicators: phishing susceptibility, unpatched critical vulnerabilities, excessive privileged accounts, absence of multi-factor authentication, and unmonitored third-party access.

Third-party and supply-chain risk: right-to-audit clauses, SOC reports with a review of the period and complementary user entity controls, and exit/portability provisions in outsourcing contracts.