Information Technology: Systems, Controls and Data
Core concepts
IT in accounting and finance covers information systems (transaction processing, management information, decision support), controls (general IT controls and application controls), data integrity (input, processing, output controls), cyber security (confidentiality, integrity, availability; access control; encryption; backups), and emerging technologies (cloud, ERP, data analytics, automation, blockchain basics). Candidates should understand how systems support the accounting cycle and where risks arise.
Traps that appear in questions
- Confusing general controls (access management, change control, backups, disaster recovery) with application controls (input validation, batch totals, exception reports).
- Assuming a backup is a disaster recovery plan - backup is data; DRP is the full recovery process.
- Treating encryption as access control - it protects data in transit/at rest, not who may log in.
- Ignoring segregation of duties in IT: the person who develops a system should not deploy it to production.
- In data analytics questions, forgetting that population testing can replace sampling but requires complete, reliable data.
Worked rule of thumb
For any system risk, classify the control: Is it about who can access the system (general/access)? Is it about what data goes in (application/input)? Is it about what comes out (application/output)? Example: a check that a date field cannot be in the future is an input validation control (application control).
Security triad
Confidentiality, integrity and availability (CIA) is the standard framework. A control should be mapped to one of these.