Information Technology and Data Analytics: Systems, Controls and Insight
Information systems in the enterprise
Understand the layered architecture: hardware, software, data, networks and people. Know the main system types - transaction processing systems, management information systems, ERP, CRM and decision-support systems - and how they integrate data across functions. Recognise the benefits of ERP (single source of truth, standardised processes) against the risks (costly implementation, change management, single point of failure).
Controls and assurance
Distinguish general IT controls (access management, change control, backup and recovery, physical security) from application controls (input validation, processing controls, output controls). Understand the audit trail, segregation of duties in systems, and the risks of cyber threats, phishing and ransomware. Know the principles of data protection: lawful basis, minimisation, accuracy, retention and security.
Data analytics for accountants
Analytics moves from descriptive (what happened) to diagnostic (why), predictive (what will happen) and prescriptive (what to do). Know the difference between structured and unstructured data, and the basics of descriptive statistics, correlation versus causation, sampling and visualisation. Data quality - completeness, accuracy, consistency, timeliness - determines the value of any analysis.
Traps and rule of thumb
- Confusing general controls with application controls.
- Assuming a strong correlation proves causation.
- Treating more data as automatically better; poor-quality data misleads.
Rule of thumb: for any control question, ask what could go wrong, which control prevents or detects it, and whether it is preventive or detective. Worked example: a duplicate payment risk is best mitigated by a preventive input control (unique supplier and invoice validation) plus a detective exception report, not by manual review alone.