Information Technology
Core concepts
The IT section tests whether you can control and audit a computerised environment. Know the components of an information system (hardware, software, data, people, procedures, networks), the benefits and risks of ERP systems, database concepts and data integrity, e-commerce and cloud models, and the CIA triad - confidentiality, integrity and availability. You must distinguish general IT controls (access management, change management, backup, physical security, business continuity) from application controls (input, processing and output). Understand audit trails, segregation of duties, encryption and hashing, disaster recovery metrics (RTO and RPO), and computer-assisted audit techniques. In Kenya, the Data Protection Act 2019 and the Computer Misuse and Cybercrimes Act 2018 are frequently referenced.
Traps
- Labelling backup as an application control; it is a general IT control.
- Confusing RTO (how quickly systems must be restored) with RPO (how much data loss is tolerable).
- Mixing preventive, detective and corrective controls.
- Treating encryption and hashing as interchangeable - hashing is one-way and protects integrity, encryption is reversible and protects confidentiality.
- Forgetting that computers never remove the need for human review; they change where the review happens.
Worked example
A payroll system rejects any entry whose employee number fails a check digit and forces the operator to re-key it. That is an input validation control, preventive in nature. A monthly reconciliation of total net pay to the general ledger is a detective output control. Both are needed - the first stops bad data entering, the second catches what got through.
Rule of thumb: control the input, verify the processing, reconcile the output.