ICAG Paper 1.2 BMIS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines model

A governance structure: operational management owns risk (first line), risk and compliance functions monitor and advise (second line), and internal audit gives independent assurance to the board (third line).

IT governance definition

The structures and processes by which IT decisions are directed, authorised and monitored, defining accountability for IT. It is distinct from day-to-day IT management execution.

COSO five components

Control environment, risk assessment, control activities, information and communication, and monitoring activities. They apply across operations, reporting and compliance objectives in the internal control framework.

Segregation of duties

Separating custody of assets, authorisation and record-keeping so no single person controls a transaction end to end. In ERP systems, conflicts arise from role combinations rather than job titles.

Risk appetite

The amount of risk an organisation is willing to accept in pursuing its objectives, expressed as acceptable variation in performance rather than as a simple list of risks.

Audit trail requirements

Records must allow reconstruction of who, what, when, where and why for each transaction. System-generated, immutable timestamps and logs provide stronger evidence than user-maintained records.

COBIT purpose

An IT governance framework separating governance and management objectives and providing capability and maturity assessments, used to evaluate how well IT supports organisational objectives.

Input controls

Controls applied as data enters a system: field validation, edit checks, format checks, maker-checker authorisation and batch totals. They aim to prevent errors rather than detect them later.

Processing controls

Controls operating during processing, such as run-to-run balancing, exception reports and reconciliation of control totals, designed to detect errors or omissions while transactions are being processed.

Hash total

A batch total computed over a non-financial field, such as summing account numbers, used to prove that all records in a batch were processed without loss or duplication.

General IT controls

Controls over access management, change management, IT operations and backup that apply across all applications. Weak general controls undermine reliance on related application controls.

Application controls

Transaction-specific controls within a single application, covering input, processing and output, ensuring completeness, accuracy and validity of the data that application handles.

Change management evidence

Documented request, risk assessment, authorisation, testing results, and segregation between developers and those who promote changes to production, with no developer access to live data.

Test data technique

A computer-assisted audit technique where dummy valid and invalid transactions are processed through a copy of the live system to test whether programmed controls operate as designed.

Parallel simulation

An audit technique where the auditor reprocesses client data using independent software and compares results with the client's output to test processing accuracy and completeness.

Embedded audit module

Audit code built into a live application that captures or flags transactions meeting defined criteria, providing continuous evidence without extracting the full data set.

Automated control testing

Requires a one-time test of design and logic plus periodic re-testing of the automated rule and the supporting IT general controls, especially after any system change.

Recovery time objective

The maximum acceptable time to restore a system or process after disruption. It drives disaster recovery design and differs from recovery point objective, which concerns data loss.

Recovery point objective

The maximum acceptable amount of data, measured in time, that may be lost in a disruption. It determines backup frequency and replication design.

Business continuity versus disaster recovery

Business continuity keeps critical business processes operating during disruption; disaster recovery restores IT infrastructure and systems. Continuity depends on recovery but is broader in scope.

Cloud shared responsibility

The provider secures infrastructure and platform layers, while the customer remains accountable for access management, data classification, configuration and user behaviour in the hosted environment.

SaaS configuration risk

Configuration changes in a hosted application can bypass or disable controls, so each change should be treated as a formal change request with testing and approval.

Data minimisation principle

Only personal data adequate, relevant and limited to what is necessary for the stated purpose should be collected and retained, reducing breach impact and compliance exposure.

Purpose limitation principle

Personal data collected for one stated purpose must not be reused for an incompatible purpose without a lawful basis, and secondary use should be documented and approved.

Data lineage

Documentation tracing data from source through transformation to report or dashboard. It supports the reliability of analytics and the auditability of reported figures.

Model bias risk

The risk that training data or model design produces systematically unfair or inaccurate outputs, requiring validation, monitoring and human review of material decisions.

RPA bot controls

Bots should be inventoried with named owners, use dedicated credentials rather than shared accounts, and be subject to the same access and change controls as human users.

Privileged access risk

Excessive or unmonitored administrative accounts allow users to bypass application controls and alter logs. Mitigations include least privilege, multi-factor authentication and session logging.

SOC report review

When relying on a service organisation, check report type, the period covered, exceptions noted, and whether complementary user entity controls have been implemented by the client.

Right-to-audit clause

A contract term allowing the client or its auditor to examine a service provider's controls and records, supporting assurance over outsourced processes and third-party risk.

Maker-checker control

A control requiring a second, independent user to review and approve an entry created by another user, preventing unauthorised or erroneous transactions from being processed.

Data analytics in audit

Analysing full populations rather than samples to identify anomalies, duplicates or control breaches. It reduces sampling risk but depends on complete, reconciled source data.