Information Systems and Data Analytics
Systems, controls and analytics
Understand the role of information systems in organisations: transaction processing, management information and executive support systems, ERP, and cloud computing. Know the components of internal control over IT: general controls (access, change management, backup, physical security) and application controls (input, processing, output). Understand the audit trail, segregation of duties, and the risks of cyber threats, data privacy and business continuity. Data analytics content covers data quality, descriptive and diagnostic analytics, sampling, visualisation, and the use of CAATs to test full populations. Candidates should be able to interpret basic outputs and identify when analytics provides audit evidence.
Traps to watch
- General controls affect all applications; application controls affect specific processes.
- Analytics over a full population can reduce sampling risk but does not eliminate the need for professional judgement.
- Correlation is not causation; do not overstate conclusions from data patterns.
- Weak input controls create downstream processing and reporting errors.
- Data privacy obligations apply to personal data even when held in the cloud.
Worked example
An auditor extracts all 50,000 sales invoices and tests whether invoice dates fall in the correct period. Testing the full population removes sampling risk for cut-off but still requires evaluating whether the system's date field is reliable, which depends on application controls.
Rule of thumb
Classify every control as general or application, then ask what could go wrong and how the control prevents or detects it.