Information Technology and Data Analytics: Controls and Evidence
What the exam tests
Information Technology and Data Analytics tests IT general controls, application controls, cyber risk, ERP environments and the use of data analytics as audit and decision evidence.
Core rules
- IT general controls cover access management, change management, IT operations and backup/recovery. Application controls cover input, processing and output.
- Segregation of duties prevents one person from initiating, authorising, recording and reconciling the same transaction.
- RTO is the maximum acceptable downtime after disruption; RPO is the maximum acceptable data loss measured in time.
- Analytics types: descriptive (what happened), diagnostic (why), predictive (what will happen) and prescriptive (what to do).
- Computer-assisted audit techniques include test data, parallel simulation, embedded audit modules and generalised audit software.
Worked example
An auditor tests three-way matching between purchase orders, goods receipt notes and invoices. Tables are joined on PO number; the analytics flags invoices whose quantity exceeds the matched receipt, duplicate invoice numbers, and vendor master changes made after the PO date. Reasoning: the test is stronger than a sample because it covers the population, but only if the extract is complete and the join keys are reliable. Exceptions are investigated, not automatically treated as fraud.
Traps
- Confusing RTO with RPO.
- Treating analytics output as audit evidence without testing completeness and accuracy of the source data.
- Relying on a sample when the full population is available and reliable.
- Ignoring master data, which drives transaction processing.
- Overlooking the possibility that controls operate but are poorly designed.