Information Technology and Data Analytics in Business
What this domain tests
Information Technology and Data Analytics in Business tests controls over IT systems, the quality of data used for decisions, and the analytical techniques accountants now apply.
Core rules
- IT general controls cover the environment: access management, change control, backups, disaster recovery and network security. Application controls cover specific processing: input validation, sequence checks, exception reports and reconciliations.
- Segregation of duties: creating a supplier, approving an invoice and releasing payment should sit with different people.
- Analytics types: descriptive (what happened), diagnostic (why), predictive (what will happen), prescriptive (what to do). Full-population testing is now practical; sampling remains valid for controls testing.
- Data quality: completeness, accuracy, validity, uniqueness and timeliness. Test the data before drawing conclusions.
- Privacy and security: collect only necessary personal data, keep it accurate and secure, retain it no longer than needed, and restrict access on a need-to-know basis.
Worked example
One clerk can both add a new supplier to the master file and approve its invoices for payment. This is a segregation-of-duties failure with a fraud risk. A detective control is a monthly review of changes to the supplier master file against approved purchase orders; a preventive control is splitting the two roles and requiring a second approver for changes to bank details.
Traps that cost marks
- Mixing general and application controls in an answer.
- Assuming more data means better evidence: incomplete or duplicated data misleads.
- Ignoring spreadsheet risk - unaudited models with hard-coded overrides.