isca notes by ca vikram kapoor

Upload: ca-shivang-soni

Post on 02-Jun-2018

231 views

Category:

Documents


1 download

TRANSCRIPT

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    1/36

    INFORMATIONSYSTEMS CONTROL

    AND AUDIT

    (CA Final - Nov 14)

    U-186, Lane No. 4, Shakarpur, Vikas Marg, Delhi - 110092

    Ph: + 91-9999810262, 8510045779 E: [email protected]

    https://www.facebook.com/KiaraEduComp

    CA Vikram KapoorB.Com, FCA, CIA, ISA (India Rank 2), CISA, CFE, NCFM

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    2/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    2

    Dedicated to

    my mother Smt. Kiran Kapoor

    and my uncle Sh. Deepak Gulati,

    whose Ideals I follow

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    3/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    3

    About the Author

    CA Vikram Kapoor is a Fellow Chartered Accountant, having a postqualification experience of almost 10 years in various firms.

    His experience commenced after qualification as a Chartered Accountant inJanuary 2004 with Grant Thornton, one of the largest non-Big 4 consultingfirms in the Management Assurance and Risk Services division. Afterworking for over two years in Grant Thornton, he moved on to Ernst &Young, a Big 4 consulting firm, wherein he was a part of the Risk and Business Services. Prior tojoining practice, he had a two year stint withAmerican Express, one of the largest BPOs in thecountry. He has worked with people from different communities, cultures, aspirations andskills.

    During the last 10 years, he has gained considerable experience in the domains of Finance, Auditand Technology. He has obtained various professional qualifications including CertifiedInternal Auditor (CIA). He has also completed two premier certifications in the field of IT auditnamely Certified Information Systems Auditor (CISA) conducted by the Information SystemsAudit and Control Association, US and theInformation Systems Auditor (ISA) conducted byICAI, having securedAll India Rank 2. He is also a Certifiied Fraud Examiner (CFE). He hasalso done NSEs certification in FinancialMarkets.

    He has been an active contributor to the CA profession, and has been rendering valuableservices to the CA fraternity. He was a member of the Study Material Research Group ofNorthern India Regional Council (NIRC) of the Institute of Chartered Accountants of India forthe year 2009-10, and a member of Professional Development Advisory Group of NIRC of ICAIfor the year 2011-12.

    He was also awarded Certificate of Appreciation by the NIRC of ICAI in December 2011, forservices rendered as a Faculty member of Revisionary classes of CA final course organized bythe NIRC.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    4/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    4

    Contents

    Chapter Chapter Name

    1 Information Systems Concepts

    2 Acquisition, Development and Implementation of InformationSystems

    3 Protection of Information Systems

    4 Business Continuity Planning and Disaster Recovery Planning

    5 Auditing of Information Systems

    6 Concept of Government and Management of Information Systems

    7 Information Technology Regulatory Issues

    8 Emerging Technologies

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    5/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    5

    INFORMATION

    SYSTEMS

    CONCEPTS

    Chapter 1

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    6/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    6

    Chapter 1 -Information System Concepts

    Topic 1.1 Systems, Information, Information Systems and CBISTopic 1.2 Different Types of Information systemsTopic 1.3 Information as a Key Business Asset

    Topic 1.4 Application of Information Systems in Enterprise Processes

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    7/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    7

    Topic 1.1 Systems, Information and Information Systems

    (A) Definitions

    What is a system?

    The term system may be defined as a group of interconnected elements working towards the accomplishmentof a common goal by accepting inputs and producing outputs in an ordered transformation process

    For instance, a manufacturing company is a system where economic resources such as people, money,material, machines, etc are transformed by various organizational processes (such as production, marketing,finance etc.) into goods.

    What is information?

    Information is data that have been put into a meaningful and usefulcontext, and is of real or perceived value in current or progressive decision.

    For example, data regarding sales by various salesmen can be merged toprovide information regarding total sales through sales personnel. Thisinformation is of vital importance to a marketing manager who is trying to

    plan for future sales. The terms Data and Information are used interchangeably. However, the

    relation of data to information is that of raw materials to finished product.

    What is information system? Information Systems is a set of interrelated elements that operate collectively to accomplish the common

    purpose or goal of providing information.

    It is a collection of people, hardware, software, data procedure that interact to provide timely information toauthorized people who need it.

    What is Computer Based information system? A Computer Based Information System (CBIS) is a combination of people, IT and

    business processes that helps management in taking in taking important decisionsto carry out the business successfully.

    (B) General model of a information system/ Functions of a Information System

    A general model of a information system consists of inputs, process, outputs,storage and feedback.

    Input is the data flowing into thesystem from outside.

    Processing is the action ofmanipulating the input into a moreuseful from.

    Output is the information flowing outof a system.

    Storage is the means of holdinginformation for use at a later date.

    Feedback occurs when the outcome has an influence on the input.

    Storage

    Feedback

    ProcessingInput Output

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    8/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    8

    {This is the first case of a question based on the Input - Processing - Output concept}

    (C) Steps followed in an information system

    Input step - Data is collected from within the organization or from external environment and converted into a

    suitable format required for processing. Processing step - Then the conversion of these inputs happens which transforms the input data into a more

    meaningful form i.e. information.

    Output step - In this step, the output generated is either communicated to the user or stored for future use.

    {This is the second case of a question based on the Input - Processing - Output concept}

    (D) Classification (Nature and types) of systems

    We can distinguish systems on the basis of following parameters:

    1. According to elements Abstract system vs. Physical system)

    (Element means a fundamental and essential constituent of an entity) Open System Abstract system (or conceptual system or model system or Intangible system) - is an orderly

    arrangement of interdependent ideas. An abstract system or a model is a representation of a real or a plannedsystem. The use of models makes it easier for the analyst to visualize relationships in the system under study.

    An example of Procurement System

    A physical system is a set of elements which operate together to accomplish an objective. Physical systems aretangible entities. Examples of physical systems are (a) Transportation systems and (b) Computer Systems.Thus physical systems are more than just the conceptual abstract, and, they display activity or behavior.{Abstract Systems are also referred as Business Models, SOPs or Flowcharts}

    Nature and Types ofsystems

    ElementsInteractiveBehavior

    Abstract

    Physical

    Open

    Closed

    HumanIntervention

    Manual

    Automated

    Working/Output

    Deterministic

    Probabilistic

    Purchase Indentreceived

    by PurchaseManager

    from ProductionPlanning and

    Control Department

    3 copies of POs aregenerated byPurchasing

    Official for placingorder with the

    supplier

    PO verified byPurchase Manager

    1 copy of PO toSupplier

    1 copy to Accounts1 copy filed

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    9/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    9

    2. According to Interactive Behaviour - Open system and Closed system Open System - A system that interacts freely with its environment by taking input

    and returning output is termed as an open system. With change of environment,

    an open system also changes to match itself with the environment. Information systems are a type of Open systems, as they interact freely

    with the environment by accepting inputs from the environment and sending outputs to theenvironment.

    Closed system - A system that does not interact with the environment nor changes withthe change in environment is termed as a closed system.

    For example, consider a 'throw-away' type sealed digital watch. This watch is aclosed system as it is completely isolated from its environment for its operation.Such closed systems will finally run down or become disorganized.

    Why are organizations considered to be relatively open systems?

    Organizations are considered to relatively open systems, as they continuously interact with the externa

    environment, by processes or transformation of inputs into useful output. Organizations are open systems, because they are input-output systems. The input consists of finance

    physical & mental labour and raw material. Organizations perform several operations on these inputand process out products or services. The process of exchange generates some surplus, in the form oprofit, goodwill experience and so on, which can be retained in the organization and can be used fofurther input output process.

    Organizations are dependent upon their external environment for the inputs required by them and fodisposing of their outputs in a mutually beneficial manner.

    3. According to degree of Human Intervention - Manual vs. Computer based Manual system - where data collection, manipulation, maintenance and final reporting are

    carried out absolutely by human efforts. Automated systems - where computers or microprocessors are used to

    carry out all the tasks mentioned above. However it will be wrong tosay that a business system is 100% automated; rather, to some extent,it depends on manual intervention, may be in a negligible way.

    4. According to working/ output - Deterministic and Probabilistic system

    A deterministic system operates in a predictable manner. The interaction among the parts is known withcertainty. If one has a description of the state of the system at a given point in time plus a description of itsoperation, the next state of the system may be given exactly, without error. An example is a correct computerprogram, which performs exactly according to a set of instructions.

    The probabilistic system can be described in terms of probable behaviour, but a certain degree of error is

    always attached to the prediction of what the system will do. An inventory system is an example of aprobabilistic system. The average demand, average time for replenishment, etc, may be defined, but the exactvalue at any given time is not known.

    QQuueessttiioonn11:: IIddeennttiiffyy aanndd jjuussttiiffyy tthhee ffoolllloowwiinngg ssyysstteemmss oonn hhooww tthheeyyppeerrffoorrmmwwiitthhiinnaann eennvviirroonnmmeenntt aanndd cceerrttaaiinnttyy::MMaarrkkeettiinngg,, CCoommmmuunniiccaattiioonn,, MMaannuuffaaccttuurriinngg,, PPrriicciinngg,, aanndd HHaarrddwwaarree--ssooffttwwaarree.. [[IICCAAII QQuueessttiioonn -- NNoovv22000099--55mmaarrkkss]]

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    10/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    10

    (E) Components/ Elements of Information Systems

    Such a system consists of the following elements:

    1. Hardware

    The term hardware refers to machinery including the computer itself, which is often referred as Central

    Processing Unit (CPU) and all of its support equipment. Among the support equipment are input andoutput devices, storage devices, and communications devices.

    2. Software

    The term software refers to the computer programs. Computer programs are machine-readable instructionsthat direct the circuitry within the hardware parts of the Computer Based Information Systems to function inways that produce useful information from data.

    3. Data

    Data are facts that are used by programs to produce useful information. Like programs, data are generallystored in machine-readable form on disk or tape until the computer needs them.

    4. Procedures

    Procedures are the policies that govern the operation of a computer system. For instance, the steps that mustbe taken to enter a password and log onto computer terminal are a procedure. The actions needed to restorethe computer system to its operational state after a major failure is another example of a procedureProcedures often specify the actions that people should take in a step-by-step manner.

    5. People

    Every Computer Based Information System needs people if it is to be made useful. People are probablythe components that influence the success or failure of information systems the most. Users, programmerssystem analysts, and database administrators are just some of the people associated with the computer-based information systems.

    (F) Characteristics of CBIS

    All systems work for predetermined objectives and the system is designed and developed accordingly.

    In general a system has a number of interrelated and interdependent subsystems or components. Nosubsystem can function in isolation; it depends on other subsystems for its inputs.

    If one subsystem or component of a system fails, in most cases the whole system does not work. However, itdepends on how the subsystems are interrelated.

    The way a subsystem works with another subsystem is called interaction. The different subsystems interactwith each other to achieve the goal of the system.

    The work done by individual subsystems is integrated to achieve the central goal of the system. The goal ofindividual subsystem is of lower priority than the goal of the entire system.

    QQuueessttiioonn22:: CChhaarraacctteerriissttiiccssooffaaCCoommppuutteerrBBaasseeddIInnffoorrmmaattiioonnSSyysstteemm..[[IICCAAIIQQuueessttiioonn--MMaayy22001111--44mmaarrkkss]]

    {This question maybe asked as Characteristics of a Business System also.}

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    11/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    11

    (G) Major areas of CBIS

    Major areas of CBIS have been listed below:

    Inventory Management(Stores Management)

    Production (Manufacturing)

    Marketing and Sales Finance and Accounting

    Human Resources Management

    1. Inventory Management(Stores Management)

    The inventory management system isdesigned with a view to keeping track ofmaterials in the stores.

    It is used to regulate the following aspects of inventory:

    Maximum and minimum level of stocks

    Raising alarm at danger level stock of any material

    Give timely alerts for re-ordering of materials with optimal re-order quantity

    It also facilitates certain queries about inventory such as

    Total inventory value at any time

    Identification of important items in terms stock value (ABC analysis)

    Identification of most frequently moving items (XYZ analysis) etc.

    Similarly well-designed inventory management system for finished goods and semi-finished goods providesimportant information for production schedule and marketing/sales strategy.

    2. Production (Manufacturing)

    The objective of this subsystem is to optimally deploy men, machines and materials to maximize production

    or service. The system generates production schedules and schedules of material requirements

    It monitors the product quality and also helps in overhead cost control and waste control.

    It monitors plans for replacement or overhauling the machinery.

    3. Marketing and Sales

    The objective of this subsystem isto maximize sales and ensurecustomer satisfaction.

    The marketing system increasesthe chances of orderprocurement by facilitating the

    marketing of products of thecompany, and facilitatingcreating of new customers andadvertising of products.

    The sales department may use the system to keep status and track of orders and generate bills for the ordersexecuted and delivered to the customer.

    It may facilitate the rendering of services during warranty period and beyond.

    It may also analyze the sales data by category such as by region, product, salesman or sales value.

    Major Areasof CBIS

    InventoryManagement

    Marketingand Sales

    Finance andAccounting

    Production

    Human

    Resources

    Marketing of productsCreating customersAdvertising products

    Compute commissionsfor dealers or salesmen

    Keep track of ordersGenerate billsRendering of warrantyservices

    Analyze sales data

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    12/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    12

    The system may also be used to compute commissions for dealers or salesmen and thus helps thecorporate managers to take decisions in many crucial areas.

    4. Finance and Accounting

    The main goal of this system is to ensure financial viability of the organization, enforce financial discipline

    and plan and monitor the financial budget. It helps forecasting revenues, determining the best resources and uses of funds and managing other financial

    resources.

    Typical sub-application areas in finance and accounting are:

    Financial accounting and Balance Sheet

    Accounts receivable/payable

    Asset accounting

    Investment management

    Cash management

    Treasury management

    5. Human Resources Management

    Human resource is the most valuable asset for an organization. Utilization of this resource in most effectiveand efficient way is an important function for any enterprise. Human resource management system aims toachieve the goal of less disputes and right utilization of manpower. Following sub-modules of HRM systemhelp in achieving the said objectives:

    Skill database with details of qualifications, training, experience, interests etc helps management foallocating manpower to right activity at the time of need or starting a new project. This system alskeeps track of employees output or efficiency.

    Administrative functions like keeping track of leave records or handling other related functions are alsincluded HRM system.

    An HRM system may also have other modules such as Personnel administration; Recruitmenmanagement; Travel management; Benefit administration; Salary administration; Promotio

    management etc.

    {It may be noted that these systems are also known as Departments, Divisions, Business Functions, Functional Areas,Operational Areas, and Business Processes}

    QQuueessttiioonn33:: YYoouu aarree aappppooiinntteedd aass FFiinnaannccee CCoonnttrroolllleerr ooff aa ccoommppaannyy.. AAss ppaarrtt ooff yyoouurr iinniittiiaattiivveess ttoo ssttrreennggtthheenn tthheeIInnffoorrmmaattiioonnpprroocceessssiinnggccaappaacciittyyooffyyoouurrccoommppaannyy,,yyoouuddeecciiddeettooiimmpplleemmeennttCCoommppuutteerrBBaasseeddIInnffoorrmmaattiioonnSSyysstteemmss iinn ddiiffffeerreenntt ddoommaaiinnss.. WWhhaatt aarree tthhee ddiiffffeerreenntt aarreeaass iinn wwhhiicchh tthhee CCBBIISS ccaann bbee iimmpplleemmeenntteedd??EEllaabboorraatteeoonntthheessyysstteemmwwhhiicchhddeeaallsswwiitthhtthheeHHuummaannRReessoouurrcceeaassppeeccttoofftthheeccoommppaannyy..

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    13/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    13

    Topic 1.2 Different Types of Information systems

    Different types of Information systems have been drawn below:

    Operation Support Systems

    Operation Support Systems: These are Information Systems designed to improve the operational efficiency ofthe enterprise. These systems primarily are concerned with the operations, and use internal data primarily formanagers at the lower levels.

    IS Type I. Transaction Processing System (TPS)

    (A) Basic Concepts

    TPS is an information system at the lowest level of management that manipulates data from businesstransactions.

    A transaction is an agreement, communication, or movement carried out between separate entities or objects,

    often involving the exchange of items of value, such as information, goods, services, and money. Forinstance, a financial transaction between two companies.

    Any business activity such as sales, purchase, production, delivery, payments or receipts involves transactionand these transactions are to be organized and manipulated to generate further information. For example,selling of a product to a customer will give rise to the need of further information like customer billing,updating inventory status and increasing in account receivable balance. Transaction processing system willthus record and manipulate transaction data into usable information.

    Information systems

    OperationsSupport Systems

    ManagementSupport Systems

    OfficeAutomation

    Systems

    TransactionProcessing Systems

    Process ControlSystems

    EnterpriseCollaboration

    Systems

    ManagementInformation Systems

    Executive InformationSystems

    Decision SupportSystems

    Text ProcessingSystems

    Electronic MessageCommunication

    Systems

    Electronic DocumentManagement Systems

    Teleconferencing andVideo-conferencing

    Systems

    Expert Systems

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    14/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    14

    A transaction processing system may follow periodic data preparation and batch processing (as in payrollapplication) or on-line processing (as in inventory control application).

    It is to be noted that the people who participate in Transaction processing system usually are not in a positionto take any management decision.

    (B)

    An illustration of Sales Transaction Processing System

    (C) Activities undertaken in a TPS

    Typically, a TPS involves the following activities:1. Capturing data to organize in files or databases.2. Processing of files / databases using application software.3. Generating information in the form of reports.

    4.

    Processing of queries from various quarters of the organization

    (D) Components of TPS (Similar to Components of System studied above)

    Inputs: Source documents, such as Purchase orders, Customer orders or sales slips, Invoices, and Employeetime cards are the physical evidence of inputs into the Transaction Processing System. They not only servicethe main purpose of capturing data, but also serve other purposes like standardizing operations by indicatingwhich data is required to be recorded and also provide a permanent file for future reference.

    Processing: This involves the use of journals and registers to provide a permanent and chronological record ofinputs. Journals are used to record financial accounting transactions, and registers are used to record othertypes of data not directly related to accounting. Some of the more common special journals are sales journal,purchase journal, cash receipts journal etc.

    Storage: Ledgers and files provide storage of data on both manual and computerized systems.

    Output: Any document generated in the system is output. For example:

    A customer invoice is an output from the order-entry application system.

    Similarly, Trial Balance is an output from and Accounting system, which lists the balances of aaccounts.

    {This is the third case of a question based on the Input - Processing - Output concept}

    (E) Features of TPS

    Large volume of data: As TPS is transaction oriented, it generally consists large volumes of data and thusrequire greater storage capacity.

    Automation of basic operations: Any TPS aims at automating the basic operations of a business

    enterprise and plays a critical role in the day-to-day functioning of the enterprise. Any failure in the TPS for ashort period of time can play havoc with the functioning of the enterprise.

    Benefits are easily measurable: TPS reduces the workload of the people associated with the operationsand improves their efficiency by automating some of the operations. Most of these benefits of the TPSare tangible and easily measurable.

    Source of input for other systems: TPS is the basic source of internal information for other informationsystems such as Management Information Systems and Decision Support Systems.

    Scan Product Code +Update Stock File

    (Processing)

    Receiving CustomerOrder (Input)

    Issuing CustomerInvoice (Output)

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    15/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    15

    QQuueessttiioonn44::

    DDeeffiinnee TTrraannssaaccttiioonn PPrroocceessssiinngg SSyysstteemmss.. LLiisstt oouutt tthhee ssaalliieenntt ffeeaattuurreess ooff aa TTPPSS.. [[IICCAAII QQuueessttiioonn --NNoovv22001133--66mmaarrkkss]]

    IS Type II. Process Control Systems (PCS)

    In this type of system, computer is used to control ongoing physical processes. The computers are designed to make decisions automatically, which then adjusts the physical production

    process.

    For example, the systems which control assembly lines in automated factories.

    IS Type III. Enterprise Collaboration Systems (ECS)

    These technologies use a variety of technologies to help people work together.

    It supports collaboration to communicate ideas, share resources and co-ordinate co-operative work efforts.

    Its objective is to use IT to enhance the productivity and creativity of teams in enterprises.

    Management Support Systems

    Management Support Systems (MSS) are information systems which support managers in effective decisionmaking by providing relevant and required information at the right time to the right people..

    IS Type IV. Management information systems (MIS)

    (A) Definition of Management Information System (MIS)

    MIS is an integrated user-machine system designed for providing information to support operational control,management control and decision making functions in an organization.

    The information system makes use of resources such as hardware, software, personnel, procedure andsupplies as well.

    MIS is designed to provide relevant and timely information to managers at different levels and in differentfunctional areas throughout the organization for decision-making purpose.

    MIS supports the managers at different levels to take strategic (at top level) or tactical (at middle level)management decisions to fulfill the organizational goals.

    (B) Component of MIS (Management + Information + System)

    Management

    Information Management Information System

    Systems

    Management = the processes or activities that describe what managers do in the operation of their

    organization such as Determination of organizational objectives and developing plans to achieve them.

    Securing and organizing the human and physical resources so that these objectives could beaccomplished.

    Exercising adequate controls over the functions, and

    Monitoring the results to ensure that accomplishments are proceeding according to plan.

    Information = sets of facts, figures and symbols processed for the current decision-making situation.

    System = Set of interrelated elements that operate collectively to accomplish some common purpose or goal.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    16/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    16

    Management Information System = Management + Information + System, i.e. Set of interrelated elements thatoperate collectively to accomplish the common purpose or goal of providing information to the managers.

    QQuueessttiioonn55:: EExxppllaaiinntthheeccoonncceeppttooffMMIISSiinntteerrmmssooffiittsstthhrreeeeeelleemmeennttss..

    (C)

    Characteristics of an effective MIS1. Management oriented (oriented means tilting towards)

    Development of the Management Information System should start from an appraisal of management needsand overall business objectives.

    Such a system is not necessarily for top management only, it may also meet the information requirements ofmiddle level or operating levels of management as well.

    2. Management directed Management should actively direct the development efforts of the Management Information System.

    It is necessary for management to devote their sufficient time not only at the stage of designing the system butfor its review as well, to ensure that the implemented system meets the specifications of the designed system.

    3.

    Heavy planning element An MIS usually takes 3 to 5 years and sometimes even longer period to get established firmly within a

    company. Therefore, a heavy planning element must be present in MIS development.

    It means that MIS designer should keep in view future objectives and requirements of firm's information inmind. The designer must avoid the possibility of system obsolescence before the system gets into operation.

    4. Common database Database is defined as a "superfile" which consolidates and integrates data records formerly stored in many

    separate data files.

    The organization of a database allows it to be accessed by several information sub-systems and thuseliminates the necessity of duplication in data storage, updating, deletion and protection.

    5.

    Common data flows It means the use of common input, processing and output procedures and media whenever possible is

    desirable.

    Once the data has been captured by the Information System, there should be minimum data processingprocedures to process the data.

    6. Integrated Development of the Management Information System should be an integrated one.

    It means that all the functional and operational information sub-systems should be tied together into oneentity.

    7.

    Sub system concept Even though the information system is viewed as a single entity, it must be broken down into sub-systems

    which can be implemented one at a time by developing a phasing plan.

    The breaking down of MIS into meaningful sub-systems sets the stage for this phasing plan.

    8. Computerized

    It is possible to have MIS without using a computer. But use of computers increases the effectiveness of thesystem.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    17/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    17

    In fact, its use equips the system to handle a wide variety of applications by providing their informationrequirements quickly.

    Other necessary attributes of the computer to MIS are accuracy and consistency in processing data andreduction in clerical staff. These attributes make computer a prime requirement in management informationsystem.

    {To remember.Management= Oriented, Directed, Heavy Planning. Information= Common database, Common dataflows. System= Integrated, Sub-system, Computerised}

    QQuueessttiioonn66:: DDeessccrriibbeeaannyyssiixxcchhaarraacctteerriissttiiccssooffaanneeffffeeccttiivveemmaannaaggeemmeenntt iinnffoorrmmaattiioonnssyysstteemm.. [[IICCAAIIQQuueessttiioonn--NNoovv22001133--66mmaarrkkss]]

    (D) Pre-requisites of an effective MIS1. Qualified system and management staff

    MIS should be manned by qualified officers. These officers who are expert in the field should understandclearly the views of their fellow officers. For this, the organizational management base should comprise of two

    categories of officers viz. (1) Systems and Computer experts and (2) Management experts. Systems and Computer experts in addition to their expertise in their subject area should also be

    capable of understanding management concepts to facilitate the understanding of problems faced bythe concern. They should also be clear about the process of decision making and informationrequirements for planning and control functions.

    Management experts should also understand quite clearly the concepts and operations of a computerThis basic knowledge of computers will be useful to place them in a comfortable position, whileworking with systems technicians in designing or otherwise of the information system.

    2. Support of Top Management The management information system to be effective, should receive the full support of top management. The

    reasons for this are as follows:

    Subordinate managers are usually lethargic about activities, which do not receive the support of theirsuperiors (top management).

    The resources involved in computer-based information systems are large and are growing larger inview of importance gained by management information system.

    3. Database

    It is a collection of files, files being collection of records, and these records being collection of data.

    It should be arranged in such a way that access to data is removed and redundancy is reduced.

    The main characteristics of database are:

    It is user oriented

    It is capable of being used as a common date resource to various users.

    It is available to authorized persons only.

    4. Control and maintenance of MIS Control of the MIS means the operation of the system as it was designed to operate. Some time, users develop

    their own procedures or short cut methods to use the system, which reduce its effectiveness. To check suchhabits of users, the management at each level in the organization should devise checks for the informationsystem control.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    18/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    18

    5. Evaluation of MIS An effective MIS should be capable of meeting the information requirements of its executives in future as well

    This capability can be maintained by evaluating the MIS on a periodic basis and taking appropriate timelyaction.

    The evaluation of MIS should take into account the following points. Examining whether enough flexibility exists in the system, to cope with any expected or

    unexpected information requirement in future.

    Ascertaining the views of users and the designers about the capabilities and deficiencies of thesystem.

    Guiding the appropriate authority about the steps to be taken to maintain effectiveness of MIS.

    (E) Misconceptions or Myths about MIS

    MIS is about use of computers

    MIS is a bunch of technologies

    More data in reports means more information for managers

    Accuracy in reporting is of vital importance

    Any computer based information system is MIS

    Any reporting system is MIS

    (F) Constraints in operating a MISMajor constraints which come in the way of operating an information system are the following:

    Non-availability of experts, who can diagnose the objectives of the organization and provide a desireddirection for installing and operating system. This problem may be overcome by grooming internal staff. Thegrooming of staff should be preceded by proper selection and training.

    Problem of selecting the sub-system of MIS to be installed and operated upon. The criteria, which shouldguide the experts here, may be the need and importance of a function for which MIS can be installed first.

    Non-standardized approach for designing and implementing MIS. Though in this regard nothing can be done

    at the initial stage but by and by standardization may be arrived at, for the organization in the same industry. Non-availability of cooperation from staff in fact is a crucial problem. It should be handled tactfully

    Educating the staff may solve this problem. This task should be carried out by organizing lecturers, showingfilms and also explaining to them the utility of the system. Besides this, some persons should also be involvedin the development and implementation of the system.

    (G) Limitations of MIS

    The quality of the outputs of MIS is basically governed by the quality of input and processes.

    MIS is not a substitute for effective management. It means that it cannot replace managerial judgement inmaking decisions in different functional areas. It is merely an important tool in the hands of executives fordecision making and problem solving.

    MIS may not have requisite flexibility to quickly update itself with the changing needs of time, especially in

    fast changing and complex environment. MIS cannot provide tailor-made information packages suitable for the purpose of every type of decision made

    by executives.

    MIS takes into account mainly quantitative factors, thus it ignores the non-quantitative factors like morale andattitude of members of the organization, which have an important bearing on the decision making process ofexecutives.

    MIS is less useful for making non-programmed decisions. Such type of decisions are not of the routine typeand thus require information, which may not be available from existing MIS to executives.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    19/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    19

    The effectiveness of MIS is reduced in organizations, where the culture of hoarding information and notsharing with other holds.

    MIS effectiveness decreases due to frequent changes in top management, organizational structure andoperational team.

    QQuueessttiioonn77::

    LLiimmiittaattiioonnssooffMMIISS[[IICCAAIIQQuueessttiioonn--NNoovv22001122--44mmaarrkkss]]

    QQuueessttiioonn88:: AAccoommppaannyy,,eennggaaggeeddiinntthheemmaannuuffaaccttuurriinnggoofftteexxttiilleepprroodduuccttss,,ddeecciiddeeddttooddeevveellooppaarroobbuussttMMaannaaggeemmeennttIInnffoorrmmaattiioonnSSyysstteemm,,ttoossuuppppoorrtttthheeddeecciissiioonnmmaakkiinnggccaappaabbiilliittiieessooffiittssmmaannaaggeerrss..DDuurriinnggiimmpplleemmeennttaattiioonn,,iittrreeaalliizzeeddtthhaatttthheerreeaarreesseevveerraallhhuurrddlleessoonntthheewwaayyttooiimmpplleemmeennttaattiioonnooffaassttrroonnggMMIISS..WWiitthhaaddeeqquuaatteemmaannaaggeemmeennttssuuppppoorrtt,, iittwwaassaabbllee ttoo ffiinnaallllyy iimmpplleemmeennttMMIISS..HHoowweevveerr,,ddooyyoouutthhiinnkk tthhaattoonncceetthheeMMIISShhaass bbeeeenn iimmpplleemmeenntteedd,, wwiillll iitt bbee aabbllee ttoo ssaattiissffyy aallll rreeqquuiirreemmeennttss oorr ddooeess iitt hhaavvee iittss oowwnn lliimmiittaattiioonnss??CCoommmmeennttoonntthheessaammee..

    IS Type V. Decision Support Systems (DSS).

    (A) Definition of DSS

    Decision Support Systems (DSS) are a specific class of computerized information systems that supportbusiness and organizational decision-making activities.

    A decision support system (DSS) can be defined as a system that provides tools to managers to assist them insolving semi structured and unstructured problems in their own, somewhat personalized, way.

    Typical information that a decision support application might gather and present would be projected revenuefigures based on new product sales assumptions.

    A DSS is not intended to make decisions for managers, but rather to provide managers with a set ofcapabilities that enables them to generate the information required by them in making decisions. In otherwords, a DSS supports the human decision-making process, rather than providing a means to replace it.

    (B) An illustration (of Excel working as a DSS)

    If a manager needs to know what would be the impact of changing sales on his profitability, he may use MSExcel which allows him to work on various scenarios in decision making.

    (C) Characteristics of DSS

    DSS should support decision making for different levels of management.

    They should be flexible enough to respond to the changing needs of decision makers, i.e. it should be able tofit itself in the style of a particular manager and ready to change according to changes in requirement.

    They should be easy to use. A user may not have expert knowledge of computer programming to generatereports that help in decision making.

    DSS should be extensible and evolve overtime.

    DSS should focus on decision rather than data and information.

    Particulars Scenario I Scenario II Scenario III

    Sales 100,000 110,000 120,000

    Variable Costs

    (= 65% of Revenue)65,000 71,500 78,000

    Fixed Costs 20,000 20,000 20,000

    Profit 15,000 18,500 22,000

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    20/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    20

    QQuueessttiioonn99::

    WWhhaattiissaaDDeecciissiioonnSSuuppppoorrttSSyysstteemm??BBrriieeffllyyeexxppllaaiinntthhrreeeecchhaarraacctteerriissttiiccssooffaaDDeecciissiioonnSSuuppppoorrttSSyysstteemm..[[IICCAAIIQQuueessttiioonn--NNoovv22000088--55mmaarrkkss]]

    (D) Components of a DSS

    A decision support system has four basic components

    1.

    The user2. One or more databases3. Planning language, and4. The model base

    1. The users

    Managers

    The most common user of a decision support system is a manager with an unstructured or semstructured problem to solve.

    The manager may be at any level of authority in the organization (e.g., either top management ooperating management).

    Staff Specialists (Analysts) These are the people who are more details oriented and willing to use complex systems in their day to

    day work.

    2. Databases

    Decision support systems include one or more databases.

    These databases contain both routine and non-routine data from both internal and external sources.

    An organization often generates data from internal sources. For example, data from the financial andmanagerial accounting systems such as account, transaction, and planning data.

    The data from external sources include data about the operating environment surrounding anorganization - for example, data about economic conditions, market demand for the organizations

    goods or services, and industry competition.

    Implementation of database

    Physical level: It involves the storage of data in the hard disk.

    Logical Level: It deals with the nature of data stored and the scheme of the data. Storage is logicallydivided into various tables having rows and columns.

    3. Planning languages

    Two types of planning languages that are commonly used in decision support systems are: (1) general -purpose planning languages and (2) special-purpose planning languages.

    General-purpose planning languages allow users to perform many routine tasks - for example,retrieving various data from a database or performing statistical analyses. The languages in most

    electronic spreadsheets are good examples of general-purpose planning languages. These languagesenable user to tackle a broad range of budgeting, forecasting, and other worksheet-oriented problems.

    Special-purpose planning languages are more limited in what they can do, but they usually do certainjobs better than the general-purpose planning languages. Some statistical languages such as SAS andSPSS are examples of special purpose planning languages.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    21/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    21

    4. Model base

    The model base is the "brain" of the decision support system because it performs data manipulations andcomputations with the data provided to it by the user and the database.

    There are many types of model bases, but most of them are custom-developed models that do some types ofmathematical functions-for example, cross tabulation, regression analysis, time series analysis, linear

    programming and financial computations.

    (E) Examples of decision support systems in accounting1. Cost Accounting system

    Cost accounting system is a DSS which helps organizations to calculate product costs for individualprocedures or services in totality or per unit. These allow managers to measure the effectiveness of specificoperating processes.

    These are used extensively in health care industry, as managing costs in health care industry requirecontrolling costs of supplies, expensive machinery, technology and a variety of personnel.

    2. Capital Budgeting System

    Companies require new tools to evaluate high-technology investment decisions. One of these tools is the

    Decision support system, which provides support to managers by supplementing analytical techniques, suchas net present value and internal rate of return, with several decision support tools.

    Using the decision support system, accountants, managers, and engineers can evaluate several investmentalternatives at once.

    An example of a DSS designed for evaluating investments in automated manufacturing entities is AutoManwhich allows decision makers to consider financial, non financial, quantitative and qualitative factors in theirdecision making process.

    3. Budget Variance Analysis System

    Financial institutions rely heavily on their budgeting systems for controlling costs and evaluating managerialperformance. They use computerized decision support system to generate periodic (monthly, quarterlyyearly) variance reports.

    The system allows them to graph, view, analyze, and annotate budget variances.

    This system also helps to create additional one and several years budget projections using the forecastingtools provided in the system.

    4. General Decision Support System

    Unlike the above three Decision Support System which accomplish specific tasks, some planning languagesused in decision support systems are general purpose and therefore have the ability to analyze many differenttypes of problems.

    (F) Difference between DSS and MIS

    Dimensions of Difference Decision Support System Management Information SystemPhilosophy Providing integrated tools and

    models to end usersProviding structured information toend users

    Orientation External Information Internal Information

    Flexibility Highly flexible Relatively inflexible

    Analytical capability More analytical capability Less analytical capability

    Systems analysis Emphasis is more on Tools to beused in decision process

    Emphasis is more on InformationRequirement

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    22/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    22

    Dimensions of Difference Decision Support System Management Information System

    Systems design Interactive process Based on static informationrequirement

    IS Type VI. Executive Information Systems (EIS)

    An executive information system (EIS) is a DSS that is designed to meet the special needs of top-levelmanagers.

    It is a tool that provides direct on-line access to relevant information in a useful and navigable format.

    {It is impertinent to note here that the term EIS was coined in the early eighties when computers were not operated byhigh level executives themselves, and they relied on the subordinates for supply of information. To overcome this,development of Executive Information Systems was done to enable executives use computers on their own for extractinginformation. Since the term was first introduced, the trend of executives having direct access to computers hassignificantly grown.}

    (A) Characteristics of EIS

    EIS is a Computer-based-information system that serves the information need of top executives. EIS enables users to extract summary data and model complex, problems without the need to learn query

    languages statistical formulas or high computing skills.

    EIS provides rapid access to timely information and direct access to management reports.

    EIS is capable of accessing both internal and external data.

    EIS provides extensive online analysis tool like trend analysis, market conditions etc.

    QQuueessttiioonn1100:: WWhhaattiissmmeeaannttbbyyEEIISS??WWhhaattaarreeiittsscchhaarraacctteerriissttiiccss??[[IICCAAIIQQuueessttiioonn--MMaayy22001111--44mmaarrkkss,,NNoovv22001122--66mmaarrkkss]]

    (B) Execution Decision Making Environment/ Characteristics of the types of information used in executivdecision making

    In the Executive Decision Making Environment, the executives have to take several broad decisions. For thisthey require information. These information generally possesses several characteristics. These have beendetailed below:

    1. Lack of structure: Many of the decisions made by executives are relatively unstructured. Forinstance, what general direction should the company take? So, it is not always obvious whichinformation is required or how to weigh available data when reaching a decision

    2. Future orientation: Strategic-planning decisions are made in order to shape future events. Asconditions change, organisations must change also. Consequently, the information mayberequired for future trends etc. For example, questions like How will the future technologies affectthe companys growth?, What products will customers demand five years from now? etc requiresuch information which is future oriented.

    3.

    Informal source: Information required by executives, more than other types of managers, reliesheavily on informal sources. For example, lunch with colleague in another firm might reveal someimportant competitor strategies. Other sources of information are meetings, brainstorming with acolleague, social events, media etc.

    4. Low level of detail: Most important executive decisions are made by observing broad trends. Thisrequires the information to be focusing on large overview than the tiny items.

    5. High degree of uncertainty: Executives work in a decision space where results are not scientificallypredictable from actions. For instance, information about pricing may not necessarily ensure theresult that product demand will increase.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    23/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    23

    QQuueessttiioonn1111:: DDiissccuussssaannyytthhrreeeeoofftthheecchhaarraacctteerriissttiiccssoofftthheettyyppeessooffiinnffoorrmmaattiioonnuusseeddiinnEExxeeccuuttiivveeDDeecciissiioonnMMaakkiinngg..[[IICCAAIIQQuueessttiioonn--MMaayy22001100--66mmaarrkkss]]

    (C) Contents of EIS (Principles to guide the design on EIS)

    A general answer to the question of what data is appropriate for inclusion in an Executive Information Systemis whatever is interesting to executives". A practical set of principles to guide the design of measures andindicators to be included in an EIS is presented below :

    Data required for EIS should be collected naturally as part of the process of work. An EIS should notadd substantially to the workload of managers or staff.

    Data in EIS should reflect the objectives of the organization in the areas of productivity, resourcemanagement, quality and customer service.

    Performance indicators in an EIS should be as independent as possible from variables outsidethe control of managers.

    EIS information must be available to higher executives in the organization. The objective is to providethese executives with useful information about the organization's performance. Informationthat must remain confidential should not be part of the EIS or the management system of the

    organization. EIS measures must evolve to meet the changing needs of the organization.

    (D) Difference between Executive Information Systems and Traditional Information systems

    Dimensions of Difference Executive Information System Traditional Information SystemLevel of management For top or near top executives For lower staff

    Nature of information access Specific issues/ problems andaggregate reports

    Status reporting

    Nature of information provided Online tools and analysis Offline status reporting

    Information sources More external, less internal Internal

    Drill down facility to go to details Available Not availableInformation format Text with graphics Tabular

    Nature of interface User friendly Computer operator generated

    QQuueessttiioonn1122::

    HHooeessddooeessEExxeeccuuttiivveeIInnffoorrmmaattiioonnSSyysstteemmddiiffffeerr ffrroommTTrraaddiittiioonnaall IInnffoorrmmaattiioonnSSyysstteemm[[IICCAAIIQQuueessttiioonn--MMaayy22001133--44mmaarrkkss]]

    IS Type VII. Expert Systems

    (A) Definition

    An Expert System is highly developed DSS that utilizes knowledge generallypossessed by an expert to share a problem.

    Expert System are software systems that imitate the reasoning processes of humanexperts and provide decision makers with the type of advice they would normallyreceive from experts.

    For instance, an expert system in the area of investment portfolio managementmight ask its user a number of specific questions relating to investments for aparticular client such as

    What is his monthly income?

    How much of the income is required for routine expenses and how much is disposable?

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    24/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    24

    How much can be invested?

    Does the client have any preferences regarding specific types of securities? And so on.Based on these questions, the expert system may advice a investment pattern to the client.

    (B) Examples of some Business Expert Systems

    Accounting and Finance: It provides tax advice and assistance, helping with credit-authorization decisionsselecting forecasting models, providing investment advice.

    Marketing: It provides establishing sales quotas, responding to customer inquiries, referring problems totelemarketing centers, assisting with marketing timing decisions, determining discount policies.

    Manufacturing: It helps in determining whether a process is running correctly, analyzing quality andproviding corrective measures, maintaining facilities, scheduling job-shop tasks, selecting transportationroutes, assisting with product design and faculty layouts.

    Personnel: It is useful in assessing applicant qualifications, giving employees assisting at filling out forms

    General Business: It helps in assisting with project proposals, recommending acquisition strategieseducating trainees, evaluating performance.

    QQuueessttiioonn1133::

    WWrriittee sshhoorrtt oonn BBuussiinneessss aapppplliiccaattiioonnss ooff EExxppeerrtt SSyysstteemmss ffoorr MMaannaaggeemmeenntt SSuuppppoorrtt SSyysstteemmss.. [[IICCAAII

    QQuueessttiioonn--MMaayy22001111--44mmaarrkkss]]

    (C) Need for Expert Systems

    Expert labor is expensive and scarce. Knowledge workers employee who routinely work with data andinformation to carry out their day to day duties are not easy to find and keep and companies are often facedwith a shortage of talent in key positions.

    Moreover, no matter how bright or knowledgeable certain people are, they often can handle only a few factorsat a time.

    (D) Benefits of Expert Systems

    Expert Systems preserve knowledge that might be lost through retirement resignation or death of an

    acknowledged company expert. Expert Systems put information into an active-form so it can be summoned almost as a real-life expert might

    be summoned.

    Expert Systems assist novices in thinking the way experienced professional do.

    Expert Systems are not subject to such human fallings as fatigue, being too busy, or being emotional.

    Expert Systems can be effectively used as a strategic tool is the areas of marketing products, cutting costs andimproving products.

    QQuueessttiioonn1144::

    BBeenneeffiittssooffEExxppeerrttSSyysstteemmss[[IICCAAIIQQuueessttiioonn--NNoovv22001100--44mmaarrkkss]]

    (E) Properties that Expert systems should posses

    Domain: The domain, or subject area, of the problem is relatively small and limited to a relatively well-defined

    problem area. Expertise: Solutions to the problem require the efforts of experts, and their expertise i.e. knowledge and

    techniques should be available.

    Complexity: Solution of the problems for which the Expert Systems will be used is a complex task tharequires logical inference processing, which would not be easily handled by conventional informationprocessing.

    Structure: The solution process must be able to cope with ill-structured, uncertain, missing, and conflictingdata, and a dynamic problem-solving situation.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    25/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    25

    QQuueessttiioonn1155:: WWhhaattiissaanneexxppeerrttssyysstteemm??LLiisstttthheepprrooppeerrttiieesswwhhiicchhaannaapppplliiccaattiioonnsshhoouullddppoosssseessssttooqquuaalliiffyyffoorrEExxppeerrttSSyysstteemmddeevveellooppmmeenntt[[IICCAAIIQQuueessttiioonn--MMaayy22001133]]

    {This question maybe asked as Characteristics/ Features etc also.}

    Office Automation Systems

    Office Automation Systems (OAS) refers to the application of computers to handle the office activities. Thefocus of these systems is on automating the office systems.

    Different office activities can be broadly grouped into the following types of operations:

    Document Capture: Documents originating from outside sources like incoming postal mails, noteshandouts, charts, graphs etc. need to be preserved.

    Document Creation: This consists of preparation of documents, dictation, editing of texts etc. andtakes up major part of the office time.

    Receipts and Distribution: This basically includes distribution of correspondence to designatedrecipients.

    Filling, Search, Retrieval and Follow up: This is related to filling, indexing, searching of documentswhich takes up significant time.

    Calculations: These include the usual calculator functions like routine arithmetic, operations for bilpassing, interest calculations, working out the percentages and the like.

    Benefits of Office Automation Systems

    OAS improve communication within an organization and between organizations.

    OAS reduce the cycle time between preparation of messages and receipt of messages at the recipientsend.

    OAS reduce the costs of office communication both in terms of time spent by executives and cost ofcommunication links.

    OAS ensure accuracy of communication flows.

    IS Type VIII. Text Processing Systems

    Text processing systems are the most commonly used components of the OAS. This is so because a largeproportion of the office communication takes place in writing usingwords of a natural language.

    Text processing systems automate the process of development ofdocuments such as letters, reports, memos etc. They permit use ofstandard stored information to produce personalized documents.Such automation reduces keying effort and minimizes the chances oferrors in the document.

    The text processor may be simple word processing systems ordesktop publishing systems.

    The desktop publishing systems help in quick production of multiple copies of the document withquality printing.

    The desktop publishing systems are often supported with laser printers, inkjet printers, scanners andother such devices for producing good quality documents.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    26/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    26

    IS Type IX. Electronic Document Management Systems

    The computer based document management systems are used for capturing the information contained indocuments, storing for future reference and communicating the relevant parts to the users as and whenrequired. These systems are linked to the office automation systems such as text

    processors, electronic message communication systems etc.

    Advantages

    These systems are very useful in remote access of documents that is almostimpossible with manual document management systems. For example, acustomer may have a complaint concerning delivery of goods not being inaccordance with the delivery instructions in the order. The computer baseddocument management system would enable the executive to access the documentthrough his notebook computer connected to any telephone line and show it to the customer, his orderdocument in the office.

    In the case of internal communication, document management systems can prove to be very useful. Forexample, the loan application form filed in a branch of a bank can be accessed by the sanctioning officer for

    scrutiny at the head office or any office for scrutiny of loan proposals. With computer based document management systems, location of the executive becomes irrelevant for

    access to documents. Thus, these systems can be very useful in an office environment where travelingexecutives share work space in the office.

    IS Type X. Electronic Message Communication Systems

    Business enterprises have been using a variety of communication systems for finding and receiving messagesThese include telephone, mail and facsimile (Fax), etc. The computer based message communication systemsoffer a lot of economy not only in terms of reduced time in sending or receiving the message but also in termsof reliability of the message and cost of communication.

    Components of Message Communication Systems

    1. Electronic Mail: Various features are listed below:

    Electronic transmission: The transmission of messages with email is electronic and message delivery is veryquick, almost instantaneous. The confirmation of transmission is also quick and the reliability is very high.

    Online development and editing: The email message can be developed and edited online before transmission.The online development and editing eliminates the need for use of paper in communication.

    Broadcasting and Rerouting: Email permits sending a message to a large number of target recipients. Thus itis easy to send a circular to all branches of a bank using Email resulting in a lot of saving of paper.

    Integration with other Information systems: The E-mail has the advantage ofbeing integrated with the other information systems. Such an integration helps in

    ensuring that the message if accurate and the information required for themessage is accesses quickly.

    Portability: Email renders the physical location of the recipient and senderirrelevant. The email can be accessed fro any Personal computer equippedwith the relevant communication hardware, software and link facilities.

    Economical: The advancements in communication technologies and competitionamong the communication service providers have made Email the most economical mode for sending andreceiving messages.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    27/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    27

    QQuueessttiioonn1166:: EExxppllaaiinnaannyyffoouurrffeeaattuurreessooffEElleeccttrroonniiccmmaaiill..[[IICCAAIIQQuueessttiioonn--NNoovv22001122--44mmaarrkkss]]

    2. Facsimile (Fax)

    Facsimile (Fax) is electronic communication of images of documents over telephone

    lines. The computer based fax technology automates fax communication and permitssharing of fax facilities.

    It uses special software and fax servers to send and receive fax messages usingcommon communication resources. These servers have the ability to receive faxmessages and automatically reroute them to the intended recipient after viewingit at the central computer, similarly, the managers in an enterprise can leave the fax messages to the serverwhich will send it to the intended recipient automatically.

    With the advent of Emails, the use of Fax seems to be fading away.

    3. Voice Mail

    Voice mail is a variation of the email in which messages are transmitted as digitizedvoice.

    The recipient of the voice mail has to dial a voice mail service or access the e-mail boxusing the specified equipment and he can hear the spoken message in the voice of thesender.

    The secured type of voice mail service may require the recipient to enter identificationcode before the access is granted to the stored information.

    IS Type XI. Teleconferencing and Video-conferencing Systems

    Teleconferencing is conducted a business meeting involving more than two personslocated at two or more different places. The teleconferencing helps in reducing thetime and cost of meeting as the participants do not have to travel to attend themeeting. Teleconferencing may be audio or video conferencing with or without useof computer systems.

    The computer based teleconferencing has the advantage of flexibility in terms of pre-recorded presentations and integration with other information systems. Thesesystems are based on Personal computers featuring a digital camera and run on a visual communicationsoftware. The communication links are still quite expensive making the desktop video conferencinguseful only for selected applications.

    QQuueessttiioonn1177::

    SSyysstteemmssaannaallyyssttssddeevveellooppvvaarriioouussccaatteeggoorriieessooff iinnffoorrmmaattiioonnssyysstteemmssttoommeeeettaavvaarriieettyyooffbbuussiinneessssnneeeeddss..DDiissccuussssaannyytthhrreeeessyysstteemmssbbrriieeffllyy..

    IS Type XII.

    Some other information systems

    (A) Knowledge Management Systems

    These are knowledge based systems that support the conception, association and propagation of businessknowledge within the enterprise.

    (B) Functional Business Information Systems

    These systems support the operational and managerial applications of the basic enterprises of an industry.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    28/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    28

    (C) Strategic Information Systems

    These systems provide industry strategic products, services and capabilities for competitive advantage.

    (D) Cross Functional Information Systems

    These systems are also known as integrated information systems that combine most of the informationsystems and are designed to produce information and support decision making for different levels ofmanagement and business functions.

    (E) Knowledge Management Systems

    These help businesses in creation and sharing of information and are typically used in a business whereemployees create new knowledge and expertise, which can then be shared by other people in the enterprise tocreate further commercial opportunities.

    For example, KMS are most effectively used in firms of lawyers, accountants and management consultants.

    One can say that these are effective in organizations which allow efficient categorization and distribution ofknowledge.

    {We have already studied about these four systems but with some other names. These seem to be repeated here}

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    29/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    29

    Topic 1.3 Information as a Key Business Asset

    Information is a strategic resource that helps enterprises in achieving long term objectives and goals.

    Information management enhances an organizations ability and capacity to deal with and achieve its missionby meeting challenges of competition, timely management and resource management.

    (A) Attributes of Information

    Following are the attributes of information, which are required to make it useful:

    Attribute Explanation Examples

    1. Timelyavailability

    Availability of information is a veryimportant property of information.

    If information is not available at the time ofneed, it is useless.

    Region wise sales of thecompanys products shouldbe available when the annualassessment is being done toincrease/ decrease marketingfocus in any particular region.

    2. Purpose/

    Objective

    Information must have some purpose/

    objective at the time it is transmitted,otherwise it becomes raw data.

    It helps in creating new concepts,identifying problems, solving problems,decision making, planning, initiating, andcontrolling

    Here, the purpose is decision

    making, i.e. whether toincrease/ decrease marketingfocus in any region.

    3. Mode andformat

    Information is usually visual, verbal or inwritten form

    All the statistical rules of compilingstatistical tables and presenting informationby means of diagram, graphs, curves, etc.,

    should be considered and appropriate onefollowed.

    Year on year sales of thevarious products in differentregions maybe depicted inform (i.e. mode and format)of graphs and bar charts.

    4. Completeness The information should be as complete aspossible.

    For example, the position of a student in aclass can be find out only after having theinformation of the marks of al students andtotal number of students in a class.

    Similarly, with the complete information, amanager is in a much better position todecide whether or not to undertake theventure.

    Sales information should becomplete, i.e. should not havemissed out the sale of anyregion/ branch.

    5.

    Reliability

    The information should be from reliablesources.

    Reliable information is a measure of failureor success of using information for decision-making.

    Sales information should beextracted from the companysERP by using a reliablereport.

    6. Quality Quality refers to the correctness ofinformation.

    Information is likely to be spoiled by

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    30/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    30

    Attribute Explanation Examples

    personal bias. To get rid of the errors,internal controls should be developed andprocedure for measurements prescribed.

    For example, an over-optimistic salesman

    may give rather too high estimates of thesales, which may hamper the reliability ofinformation. This should be controlled bymaintaining correct records of actual sales.

    7. Frequency The frequency with which information istransmitted or received affects its value.

    Frequency should be related to theoperational need, based on the level ofmanagement.

    Sales information mayberequired by the topmanagement on an annualbasis only, whereas at thelevel of Sales executive, salesinformation maybe on a dailyor weekly basis.

    8. Current/

    Updated Value of information usually decays with

    time and usage and so it should be refreshedfrom time to time.

    For example, in a highly fluctuating sharemarket a broker is always interested aboutthe latest information of a particular stock.

    Similarly, the running score sheet of acricket match should be refreshed at fixedinterval so that the current score will beavailable.

    9. Rate The rate of transmission/reception ofinformation may be represented by the time

    required to understand a particularsituation.

    A useful information is the one which istransmitted at a rate at which the recipientwants to receive.

    For example, the information available frominternet site should be should be available atthe click of a mouse, and one should notwait for an hour.

    10.Value ofinformation

    It is defined as difference between the valueof the change in decision behaviour causedby the information and the cost of the

    information. If new information causes a different

    decision to be made, the value of the newinformation is the difference in valuebetween the outcome of the old decision andthat of the new decision, less the cost ofobtaining the information.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    31/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    31

    {Examples in the third column are for understanding, and may not be quoted in examination.}

    {This question maybe asked as Characteristics/ Features etc also.}

    (B) Role of Information in Business/ Types of Information Systems at Different Management Levels

    In todays business environment, it becomes mandatory to have complete information for any enterprise. The information and information systems can be categorized on the basis of its requirement by the Top

    Middle and Lower management.

    ManagementLevel

    Who all comprise thismanagement level?

    What type of information is requiredby this level?

    InformationSystems Used

    TopManagement

    The top managementgenerally comprisesof owners/shareholders, boardof directors,chairman, managing

    director, chiefexecutive etc.

    Top Management strives forinformation that helps them in majorpolicy decisions.

    The top management requiresinformation that helps them inmaking strategy of the enterprise in

    terms of types of products andcustomers.

    For example, a Laptopmanufacturing/ distributioncompany may require informationabout the number of customers withincome exceeding Rs.1 Lacs a monthand working in IT Sector, to, decideabout the launch of a notebook withthe latest operating system.

    DecisionSupportSystems(DSS)

    ExecutiveInformation

    Systems (EIS)

    MiddleManagement

    It comprises of the

    heads of the functiondepartments e.g.purchase manager,production manager,marketing managers,financial controller,and divisionalofficers workingunder these officers.

    Middle management requires

    tactical information that helps inimplementing decisions taken by thetop management.

    For example, offers of companiesduring festive seasons in a locationrequire information about thecustomers buying capacity in thatparticular location.

    Management

    InformationSystems(MIS)

    LowerManagement

    It comprises ofsuperintendents,supervisors etc.

    Lower management requiresoperational information, which isrequired.

    The operational information mainlyconsists of information about stockin hand, information about customerorder pending, bills payable, etc.

    TransactionProcessingSystems

    (TPS)

    {The chart is not advised for the examination purposes. Instead, all the details should be provided for a particular level ofmanagement and then for the next level.}

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    32/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    32

    Topic 1.4 Application of Information Systems in Enterprise Processes

    (A) Vital roles performed by Information Systems in Enterprise Processes

    Information systems perform three vital roles in business firms:

    Support an organizations processes and operations. This includes Operations Support Systems lik

    Transaction Processing Systems and Process Control Systems. Support business decision making. This includes Management Information Systems, Decision Suppor

    Systems and Executive Information Systems.

    Support strategic competitive advantage. This includes Expert Systems.

    (B) Knowledge required by a business manager to operate a Information System efficiently and effectively

    Following information is required by a business manager for the same:

    Foundation Concepts: It includes knowledge of fundamental businesses, and management conceptse.g. what are components of a system.

    Information Technologies: It includes knowledge about various components such as hardwaresoftware, operations, data management, network and other technologies.

    Business Applications: It includes knowledge of the IT used in Business processes, operations an

    decision making. Development processes: It comprises knowledge about how end users and staff specialists develop an

    execute IT solutions to problems.

    Management challenges: It includes knowledge about how the functions and IT resources armaintained and utilized to attain top performance and build the business strategies.

    (C) Prime areas where IT enabled tools are used

    Supply chain management

    Marketing

    Retailing

    Customer Relationship Management

    Decision Making Knowledge Management

    {We have studied about Different Areas of a CBIS being Inventory Management, Production, Marketing and Sales,Finance and Accounting and Human Resource Management. In the current concept also, some areas have beenmentioned, and some of the examples are common in both cases. The students should be careful in understanding therequirement of the question. }

    (D) Different IT enabled tools used by three levels of management

    Top Management mainly uses: Decision Support Systems (DSS), Internet, Intranet and Laptops.

    Middle Management mainly uses: Enterprise Resource Planning (ERP), Database Management Systems(DBMS), Laptops, Desktops, Wi-Fi etc.

    Lower Management mainly uses: Printers, Scanners etc.

    (E) IT Technologies used by businesses1. Business Website

    By having a website, enterprise becomes reachable to large amount of customers.

    In addition, it can also be used as an effective advertisement tool, which is cost effective.

    These websites can be used by using HTML, XML, ASP.NET

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    33/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    33

    2. Internet and Intranet Intranet is a system that permits the electronic exchange of data within an organization, between staff and

    managers.

    Internet is a system that permits the electronic exchange of data outside the organization.

    Intranet and internet provide platform to the business world for conducting business in a faster and easierway.

    These enable the use of Ecommerce amongst partners such as suppliers, wholesalers, retailers anddistributors.

    3. Software and Packages

    There are several softwares which are used in the business world for getting information that plays animportant role in decision making, which can then boost the business in the competitive market.

    Some of these softwares are Database Management Systems (DBMS), Data Mining Tools and KnowledgeDiscovery in database.

    For example, by capturing buying habits of the customers using Data Mining Tools and KnowledgeDiscovery, an effective marketing strategy can be used.

    Similarly, these can be used in Supply chain logistics, including planning, purchasing, replenishment, logisticsand space management.

    Business Intelligence

    Business Intelligence refers to applications and technologies that are used to collect, provide access andanalyze data and information about computer operations.

    Business Intelligence applications maybe used for various activities, such as:

    Some BI applications are used to analyze performance or internal operations, e.g. ExecutivInformation Systems

    Others are used to store and analyze data such as Data Mining systems

    Others are used to analyze or manage human resources such as customer relationship and marketintools.

    4. Computer Systems, Scanners, Laptop, Printer, Webcam, Smart Phone etc. Use of computer systems, printers, scanners increase accuracy, reduce processing time, enable decisions to be

    made more quickly, and speed up customer service.

    For example, one can charge accurate prices and eliminate the need to apply price labels to individual itemsby the use of scanning system.

    {There is some repetition in the two topics - Different IT enabled tools used by three levels of management andIT Technologies used by businesses}

    (F)

    Implications of information systems in business Information system will help managers in effective decision-making to achieve the organizational goal.

    Based on well-designed information system, an organization will gain edge in the competitive environment.

    Information systems help to take right decision at the right time.

    Innovative ideas for solving critical problems may come out from good information system.

    Knowledge gathered though information system may be utilized by managers in unusual situations.

    If information system is viewed as a process it can be integrated to formulate a strategy of action or operation.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    34/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    34

    QQuueessttiioonn1188::

    GGiivveessoommeeaaddvvaannttaaggeessooffiinnffoorrmmaattiioonnssyysstteemmssiinnbbuussiinneessss..[[IICCAAIIQQuueessttiioonn--MMaayy22001100--55mmaarrkkss]]

    (G) Accounting Information systems

    The accounting information systems comprise of the processes, procedures and systems for performing thefollowing activities:

    Capture accounting data from business processes Record the accounting data in the appropriate records.

    Process the detailed accounting data by classifying, summarizing and consolidating the data

    Report the summarized data to internal and external users.

    Key steps of a typical accounting information system are given as follows:

    Work steps within a business process intended to capture accounting data.

    Manual or computer based records to record the accounting data.

    Work steps to process, classify, summarize and consolidate the data.

    Work steps that generate both internal and external reports.

    Work steps that are internal controls.

    (H)

    Information systems in different sectors

    1. E-business

    This is also electronic business and includes purchasing, selling, production management, logistics,communication, support services and inventory management through the use of internet technologies.

    The primary component of E-business is the Infrastructure i.e. computers, routers, communication mediasoftware and programmers.

    Different business models being followed by e-business organizations are:

    Business to Business (B2B)

    Business to Customer (B2C)

    Advantages of E-business As compared to a offline business, E-business has some advantages such as:

    24 hour sale

    Lower cost of doing business

    Eliminate of middlemen

    Unlimited market place with broadened customer base

    Secure payment systems, and

    Easier business administration

    Another advantage of E-business is that it does not require land for store or shops and anyone from anywherecan do business anytime as information regarding products etc. is available on the web. The only investmentrequired is purchase of space on internet, designing and maintenance of website.

    2.

    Financial service sector The financial services sector entities such as banks and insurance companies) manage large amounts of data

    and processes enormous number of transactions every day.

    IT has changed the working style of financial services.

    With the advent of IT, these financial institutions are able to operate nationally with a wide network oregional offices.

    It also reduces the cost of these institutions in terms of office staff and office buildings.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    35/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    35

    Through the use of internet and mobile phones, financial services sector entities are in direct touch wittheir customers. For example, through emails and SMS, these entities can make the customers aware othe launch of new policies etc.

    IT also makes it easier for the customers too. Now-a-days, most of the services are offered on internet, whichcan be accessed from anywhere and anytime.

    This industry is characterized by large mainframe systems.

    IT in Banks

    In traditional banking system, the customer has to visit bank branch to deposit and withdraw money andupdate the passbook.

    With the advent of IT, a lot of activities do not require physical visits to the Banks.

    For instance, the customers can do banking transactions by using internet banking or phone bankingSimilarly, deposit or withdrawal of money can be done from any ATM or through internet or mobile banking.

    Also, the customers can check the balances in their accounts by using internet and mobile banking.

    In addition, several other products are being offered to the customers such as bill payments etc.

    3. Wholesaling and Retailing

    A visit to any large store will show that IT has become a vital part of retailing. The laser scanners used in most grocery supermarkets and superstores to read product bar codes are amongst

    the most distinctive examples of modern computer technology.

    Retail businesses use IT for several activities such as Buying products, Stock control, Selling items bycapturing sales data item wise, Customer information, Accounting and Management Reports. Also, by usinginternet or mobile phones, retailers can collect and exchange data between stores, distribution centres,suppliers and head offices.

    Wholesale businesses also use IT for Supply chain logistics management, planning, space managementpurchasing and re-ordering. Data mining applications help in the analysis of market baskets, customerprofiles and sales trends.

    4.

    Public sector Public sector enterprises include services provided by government mainly hospitals, police stations

    universities etc.

    Information Technology and Information Systems can be used to keep records and other related documents.

    For example, and information system like an ERP can be implemented in a university to keep record of itsemployees in terms of its employees in terms of their designation, leaves availed, departments andachievements that can be used further in analyzing their performance.

    Similarly, with the use of IT/ IS, it becomes easy to file FIR of a case without going to a police stationpersonally.

    Also, documents like passports can be made easily by applying online.

    5. Others

    IT is efficiently used in entertainment industry (games, picture collection etc.), agriculture industry, tourindustry and consultancy etc.

    (I) Enterprise Resource Planning PackagesDefinitions

    An ERP system is a multi module software system that integrates all business process and functions of theentire Enterprise into a single software system, using a single integrated database. Each module is intended tocollect, process and store data of a functional areaof the organization and to integrate with related processes.

  • 8/11/2019 Isca Notes by CA Vikram Kapoor

    36/36

    Information Systems Control and Audit (CA Final)

    CA Vikram Kapoor

    ERP can be defined as a system, which is a fully integrated business management system that integrates thecore business and management processes to provide an organization a structured environment in whichdecisions concerning demand, supply, operational, personnel, finance, logistics etc. are fully supported byaccurate and reliable real time information.