Text size
On this page (7)
Why this topic matters
Information Systems and Controls (ISC) expects candidates to understand how business processes flow through systems, where risks arise, which automated controls address them, and how automation technologies change the control environment. This topic links transaction cycles, process documentation, and automation such as robotic process automation (RPA).
Transaction cycles and key controls
| Cycle | Process steps | Key risks | Key controls |
|---|---|---|---|
| Revenue (order to cash) | Customer order → credit approval → shipping → billing → cash receipt | Sales to bad-credit customers, unbilled shipments, fictitious sales, cutoff errors, stolen receipts | Automated credit limit checks; matching shipping documents to invoices; sequential invoice numbering with gap reports; segregation of cash receipts from recording; lockbox; reconciliations |
| Expenditure (procure to pay) | Requisition → purchase order → receiving → vendor invoice → payment | Unauthorized purchases, fictitious vendors, duplicate payments, paying for goods not received | Three-way match (purchase order, receiving report, invoice); approved vendor master file with change controls; duplicate invoice checks; payment approval; positive pay with the bank |
| Payroll (hire to retire) | Hiring → time capture → payroll processing → payment → reporting | Ghost employees, unauthorized rate changes, incorrect hours | Human resources separate from payroll; approved rate changes; timekeeping controls; payroll register review; direct deposit account change verification |
| Inventory and production | Planning → materials → production → finished goods | Theft, obsolescence, costing errors | Physical security; perpetual records with cycle counts; standard cost variance review |
| Financial close (record to report) | Journal entries → reconciliations → consolidation → statements | Unauthorized or erroneous entries, management override | Journal entry approval and review; account reconciliations; close checklists; restricted access to post entries |
Documenting processes
- Narratives: written descriptions — easy to prepare, harder to analyze.
- Flowcharts: document flows and system flowcharts use standard symbols to show documents, processes, decisions, and data stores — good for spotting control gaps and segregation issues.
- Data flow diagrams: show how data moves between processes, stores, and external entities (without controls or timing).
- Business process model and notation: a standard notation for modeling workflows.
- Risk and control matrices: map each risk to the control addressing it, the control owner, frequency, and type.
Automated versus manual controls
| Automated controls | Manual controls | |
|---|---|---|
| Consistency | Performed the same way every time (if the program doesn't change) | Subject to human error and fatigue |
| Dependency | Rely on information technology (IT) general controls (ITGCs), especially change management and access | Rely on competent, available people |
| Testing | Test once (plus ITGCs) — benchmarking in later years | Sample across the period |
| Best for | High-volume, rules-based processing | Judgment, unusual items, reviews |
Configurable controls in enterprise systems (tolerance settings, approval workflows, required fields) are only as good as their configuration — changes to settings need change management.
Automation technologies
| Technology | What it does | Control considerations |
|---|---|---|
| Robotic process automation (RPA) | Software "bots" mimic user actions to perform repetitive, rules-based tasks (data entry, reconciliations, report preparation) | Bots need unique credentials with least privilege (not shared human accounts); bot changes go through change management; monitor for failures when source systems change; logs of bot activity |
| Workflow automation | Routes documents and approvals electronically | Approval rules and delegations must be controlled |
| Electronic data interchange (EDI) | Structured business documents exchanged system to system (purchase orders, invoices) | Authentication of trading partners, encryption, acknowledgment and control totals |
| Intelligent automation and machine learning | Classify invoices, match transactions, flag anomalies | Model governance, training data quality, human review of exceptions, explainability |
| Continuous monitoring and continuous auditing | Automated tests run on all transactions, flagging exceptions in near real time | Tuning thresholds, follow-up on exceptions |
Benefits and risks of automation
- Benefits: speed, consistency, fewer manual errors, full-population testing, better audit trails.
- Risks: errors replicate at scale; logic can be wrong from the start; dependence on source data quality; reduced human judgment; key-person risk for bot developers; bots failing silently when screens or formats change.
How it is tested
- Identify the control that addresses a risk in a transaction cycle.
- Read a flowchart and spot missing controls or segregation issues.
- Compare automated and manual controls.
- Identify control considerations for RPA and other automation.
EXAM TIP: The three-way match is the classic expenditure-cycle control: it ensures the company pays only for goods it ordered and received, at the agreed price.