Information Technology
Core concepts
IT questions cover information systems, controls, and security. Know the components of an information system (hardware, software, data, people, processes), the types of systems (transaction processing, management information, decision support, executive information), and the accounting information system. Understand internal controls in a computer environment: general controls (access, backup, change management, physical security) and application controls (input, processing, output). Study the audit trail, segregation of duties, and the risks of spreadsheets and cloud computing.
Common traps
A frequent trap is confusing general controls with application controls. General controls apply across systems; application controls apply to specific transactions. Another trap is assuming automated controls remove the need for manual review - they do not. Watch for questions on the difference between a hot site, warm site, and cold site in disaster recovery, and between data backup and business continuity planning.
Worked example / rule of thumb
A payroll system processes payments. Input control: validation checks on hours worked (range and reasonableness). Processing control: batch totals reconciled before and after. Output control: distribution restricted to authorised staff. General controls: password policy, periodic backups, change logs. Rule of thumb: ask whether the control acts on one transaction (application) or on the whole environment (general).
Exam technique
Name the control category and the specific control; vague answers lose marks.