ISC, Information Systems and Controls
Sources for Information Systems: Architecture, the SDLC, and Controls
Last reviewed
The standards and authorities behind PocketCPA's ISC lessons on Information Systems: Architecture, the SDLC, and Controls. The topic rests on NIST SP 800-145 for the cloud service and deployment models, NIST SP 800-34 Rev. 1 for alternate sites and the MTD, RTO and RPO definitions, NIST SP 800-53 Rev. 5 for the control families and the AC, CM, CP, SA and SC control identifiers cited, with COSO, COBIT, SSAE 18, AT-C 320 and the AICPA trust services criteria named at concept level only from the verified ISC.I.A corpus because those works are copyrighted.
About this topic
The accounting records are not in a ledger anybody can pick up. They sit inside software, on hardware the entity may not own, behind a login. Everything here asks whether what is in there can be trusted.
The question this group answers. How does an organization build, run, and control the systems that produce its accounting data, and how is one layer of that told apart from another?
Key points
- The SDLC phases are planning, analysis, design, development, testing, implementation, and maintenance.
- Conversion strategies include parallel, direct cutover, phased, and pilot; each trades risk against cost and speed.
- ITGCs (access security, change management, operations) support the reliable functioning of application controls.
- Preventive controls stop errors before they occur; detective controls identify errors after the fact.
What the lessons cover
- Types of information systems
- Business cycles and transaction flows
- Batch versus real-time processing
- The systems development life cycle (SDLC)
- Change management and program development
- IT infrastructure: on-premises, cloud, and virtualization
- Networks and connectivity
- Application controls: input, processing, and output
- IT general controls and segregation of duties
- System availability and resilience
- Automation and emerging technologies
- SOC reporting on a service organization's controls
- Where these concepts sit in public standards
- Capstone: one purchase, every control layer
Authoritative references
Public standards:
- NIST SP 800-145, The NIST Definition of Cloud Computing, the source of the service models (infrastructure, platform, and software as a service) and the deployment models (private, community, public, and hybrid).
- NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems, the source of the definitions of maximum tolerable downtime, recovery time objective, and recovery point objective, and of the alternate site types.
- NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, the control catalog used for the identifiers cited:
- AC-5 and AC-6, separation of duties and least privilege.
- AU-2, event logging.
- CM-3, CM-4, CM-4(1) and CM-5, configuration change control, impact analyses, testing in a separate environment, and access restrictions for change.
- CP-6, CP-7, CP-9, CP-9(1) and CP-10, the alternate storage site, the alternate processing site, system backup and its testing for reliability and integrity, and system recovery and reconstitution.
- SA-3, the system development life cycle, and SC-7, boundary protection.
Frameworks named at concept level:
- COSO, COBIT, SSAE No. 18, AT-C 320, and the AICPA Trust Services Criteria are named at concept level only, because those works are copyrighted; the lesson relies on the verified corpus for their content and does not reproduce their text.
How PocketCPA uses these sources
Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.