IT Governance and Data Analytics
The CPA exam increasingly tests technology competencies as the accounting profession evolves. The Information Systems and Controls (ISC) discipline and the BAR discipline both include IT governance, internal controls over information technology, and data analytics. These topics appear on the CPA exam in both multiple-choice and task-based simulation formats.
IT Governance Frameworks
IT governance ensures that an organization's IT strategy aligns with business objectives and manages IT-related risks. Key frameworks CPA candidates should know:
- COBIT (Control Objectives for Information and Related Technologies): Developed by ISACA, COBIT provides a comprehensive framework for IT governance and management. It defines processes across governance and management domains including Evaluate, Direct and Monitor (EDM); Align, Plan and Organize (APO); Build, Acquire and Implement (BAI); Deliver, Service and Support (DSS); and Monitor, Evaluate and Assess (MEA).
- COSO Internal Control Framework: While not IT-specific, COSO's five components (control environment, risk assessment, control activities, information and communication, monitoring) apply to IT controls. The 2013 framework explicitly addresses the role of technology in internal control.
- NIST Cybersecurity Framework: Organized around five functions: Identify, Protect, Detect, Respond, and Recover. Used by many organizations as the basis for their cybersecurity programs.
- SOC Reports: System and Organization Controls reports are critical for understanding service organization controls:
- SOC 1: Controls relevant to user entities' internal control over financial reporting (ICFR)
- SOC 2: Controls related to security, availability, processing integrity, confidentiality, and privacy (Trust Services Criteria)
- SOC 3: General-use version of SOC 2 (less detailed)
- Type I: Design of controls at a point in time
- Type II: Design and operating effectiveness over a period
IT General Controls (ITGCs)
IT general controls are policies and procedures that apply broadly to information systems and support the effective functioning of application controls. The four categories of ITGCs:
- Access controls: Logical access (user authentication, authorization, password policies, multi-factor authentication) and physical access (server room security, badge access, environmental controls). Principle of least privilege - users should have only the minimum access necessary.
- Program change controls: Change management processes ensure that modifications to applications and systems are properly authorized, tested, approved, and implemented. This includes segregation between development, testing, and production environments.
- Program development controls: System development life cycle (SDLC) controls ensure new systems are properly designed, developed, tested, and implemented. Phases include planning, analysis, design, development, testing, implementation, and maintenance.
- Computer operations controls: Job scheduling, backup and recovery procedures, incident management, and problem management. Business continuity and disaster recovery planning fall under this category.
Application Controls
Application controls operate within specific applications to ensure completeness, accuracy, and validity of transactions:
- Input controls: Validity checks, range checks, limit checks, check digits, batch totals (hash totals, financial totals, record counts), sequence checks, and data type validation
- Processing controls: Run-to-run totals, reasonableness checks, programmed control totals, and limit/reasonableness tests
- Output controls: Distribution controls, reconciliation of output to input, exception reporting, and audit trail maintenance
Data Analytics for CPAs
Data analytics is an emerging area with increasing CPA exam coverage. Key concepts include:
Types of Data Analytics
| Type | Question Answered | Example |
|---|---|---|
| Descriptive | What happened? | Summarizing revenue trends, aging of receivables |
| Diagnostic | Why did it happen? | Variance analysis, root cause analysis of cost overruns |
| Predictive | What will happen? | Forecasting cash flows, predicting bad debt rates using regression |
| Prescriptive | What should we do? | Optimizing inventory levels, recommending pricing strategies |
Analytics Techniques in Auditing
- Benford's Law: The distribution of leading digits in naturally occurring numerical data follows a predictable pattern. Deviations may indicate fabricated data or errors.
- Regression analysis: Used to identify relationships between variables and detect anomalies in financial data.
- Visualization: Charts, dashboards, and heat maps help identify patterns, trends, and outliers in large datasets.
- Continuous auditing/monitoring: Automated procedures that test transactions in real-time or near-real-time rather than periodically.
Cybersecurity Considerations
CPAs must understand common cybersecurity threats and controls:
- Phishing/social engineering: Manipulating individuals to reveal sensitive information
- Ransomware: Malware that encrypts data and demands payment for decryption
- Encryption: Symmetric (single key) vs. asymmetric (public/private key pairs); used for data at rest and in transit
- Network security: Firewalls, intrusion detection/prevention systems, VPNs, and network segmentation
Build your IT knowledge with CPA flashcards and practice exams. Start free to access all study materials.