Data, Systems and Risks

Suggested Answer
Certificate in Accounting and Finance Examination – Model paper

SECTION A (Ranging from 45 to 55 marks)

A.1 (i) (d) Veracity

(ii) (c) A social media post with text and images
(iii) (b) Diagnostic Analytics
(iv) (b) Seeking user consent again and confirming anonymization
(v) (a) Time-Variant and Non-Volatile
(vi) (b) Hardware
(vii) (c) Middleware
(viii) (c) Handling a company's financial transactions, including the general ledger,
accounts payable, and financial reporting
(ix) (d) Offering real-time insights and predictions
(x) (c) A shift from record-keeping to strategic advisory
(xi) (c) Cost-Benefit Analysis
(xii) (c) Edge storage
(xiii) (c) RegTech
(xiv) (c) It makes troubleshooting and upgrades easier
(xv) (d) Atomicity

A.2 (a) In the given situation, the following Vs of big data are demonstrated:
▪ Volume: Demonstrated by "massive amounts of data daily" and "millions of
customer reviews."
▪ Velocity: Demonstrated by "thousands of transactions per hour" and the need for
"immediate analysis."
▪ Variety: Demonstrated by the combination of "customer purchase records
(structured)," "customer reviews and social media comments (unstructured)," and
"real-time clickstream data (semi-structured)."

Implications for SwiftCart

▪ Implication of Volume: The "massive amounts of data" generated daily by
SwiftCart put a significant "strain on their existing data infrastructure". This
means they need specialized infrastructure for storage and processing to handle
the enormous and continuously growing amount of data.

▪ Implication of Velocity: The need to process "thousands of transactions per hour"

and rely on "immediate analysis" means SwiftCart requires systems capable of
real-time or near-real-time data processing to enable dynamic operations and
timely marketing campaign adjustments.

▪ Implication of Variety: The collection of data in "structured," "unstructured," and

"semi-structured" formats leads to challenges in data integration and
standardization. This diverse nature can contribute to the "inconsistencies in
customer profiles" and make comprehensive analysis difficult, impacting their
reporting capabilities.

Page 1 of 11
 Data, Systems and Risks
Suggested Answer
Certificate in Accounting and Finance Examination – Model paper

(b) Identification of specific challenges:

▪ Data Quality and Data Integration: The inconsistency in customer profiles stems
from integrating diverse data sources with different structures and formats.
Ensuring accuracy and completeness across this varied data landscape is a major
challenge.
▪ Storage and Processing Capacity: Delayed reporting is caused by high data
volume exceeding the capacity of the current infrastructure to process data
efficiently.

Suggestion of one relevant emerging trend or technology and justification

▪ Challenge: Data Quality and Data Integration

Trend/Technology: Artificial Intelligence (AI) and Machine Learning (ML)

Justification: AI-driven tools, particularly those leveraging ML, can "automate

data quality checks, detect anomalies," and process diverse data formats. They
help standardize and integrate structured, semi-structured, and unstructured data.
For SwiftCart, this would directly assist in resolving "inconsistencies in customer
profiles" by standardizing varied data types, thereby contributing to "reliable
insights" and improving the accuracy of their reporting.

▪ Challenge: Storage and Processing

Trend/Technology: Edge Computing

Justification: Edge computing brings data processing closer to the source (e.g., at
the customer device or local node), reducing load on central servers and
minimizing latency. By processing high-volume, real-time data (like clickstreams)
at the edge, SwiftCart can improve response times and reporting speed, especially
during peak seasons.

A.3 (a) Relational Database Object-Oriented Database

Management Systems Management Systems
(RDBMS) (OODBMS)
Core In the Relational Model, data is OODBMS stores data as
Characteristics: organized into tables, also objects, similar to object-
known as relations, consisting oriented programming. Each
of rows (tuples) and columns object encapsulates both data
(attributes). Each row (attributes) and methods
represents a unique record, and (functions) that operate on that
each column represents an data. This model supports
attribute of that record. concepts such as class, object,
Relationships between different and inheritance, where objects
tables are established using can inherit properties and
primary keys (unique identifiers methods from other objects.
for each record) and foreign
keys (fields in one table
referencing a primary key in
another). Structured Query
Language (SQL) is the standard
language for interacting with
relational databases.
Page 2 of 11
 Data, Systems and Risks
Suggested Answer
Certificate in Accounting and Finance Examination – Model paper

Relational Database Object-Oriented Database

Management Systems Management Systems
(RDBMS) (OODBMS)
Strengths & Use RDBMS offers simplicity due OODBMS is well-suited for
Cases: to its table-based structure, applications that require the
which is easy to understand and management of complex data
work with. It provides data types, including multimedia,
independence and flexible graphics, and other real-world
querying capabilities through objects. The encapsulation of
SQL, making it easy to retrieve data and operations into a single
and manipulate data. RDBMS entity simplifies the modelling
is optimally used for of real-world systems.
transactional systems and data
analysis where structured data
is prevalent, such as customer
records and financial
transactions.

Contrast Large-scale relational Object-oriented databases are

(Disadvantages): databases may encounter generally more complex to
performance issues with design and manage compared to
complex queries, requiring relational databases. They often
optimization techniques like lack a standard query language
indexing. They are also not as like SQL, which can make
scalable as some newer models implementation and
for handling massive datasets or maintenance more challenging.
unstructured data. The cost and effort involved in
developing and maintaining
OODBMS, and the reluctance
of organizations to transition
from existing relational systems,
are also significant drawbacks

(b) ▪ Primary Characteristics:

NoSQL databases are specifically designed to handle unstructured and semi-
structured data. They are characterized by their ability to manage massive
volumes of data generated at high velocity from diverse sources.

NoSQL databases are highly scalable, particularly with complex data. Examples
include MongoDB and Cassandra.

▪ Typical Applications:
Given their design for unstructured and semi-structured data, NoSQL databases
are often leveraged in Big Data environments.

They are suitable for real-time analytics and machine learning applications. This
makes them ideal for scenarios involving social media data, IoT device data, and
web transactions, where data variety and volume are significant.

Page 3 of 11
 Data, Systems and Risks
Suggested Answer
Certificate in Accounting and Finance Examination – Model paper

(c) The Network Model organizes data as nodes (entities) connected by links
(relationships), allowing a child node to have more than one parent node. This 'graph-
like structure' provides greater flexibility than the hierarchical model, which is limited
to one-to-many relationships, making the Network Model highly suitable for
managing complex data relationships that involve many-to-many connections. Its
design inherently supports these intricate interconnections, enabling more direct and
efficient navigation of linked data.

Example (any one)

▪ Consider a student’s table and a course’s table. A student can enrol in multiple
courses, and each course can have multiple students enrolled. This forms a many-
to-many relationship between "Students" and "Courses". This scenario perfectly
illustrates the kind of complex, interconnected data that the Network Model is
designed to manage, where multiple instances from one entity type are associated
with multiple instances from another.

▪ Consider a scenario involving "Products" and "Suppliers." A single product can

be supplied by multiple different suppliers, and conversely, a single supplier can
provide many different products. This represents a classic many-to-many
relationship. In a Network Model, "Product" and "Supplier" could be nodes, and
a "Supplies" link could connect them, allowing any product to be linked to
multiple suppliers and any supplier to be linked to multiple products, directly
representing these complex relationships.

SECTION B (Ranging from 45 to 55 marks)

A.4 (a) Possible Inadequacies and Explanations (Any three):

▪ Data Silos and Fragmentation:

Sales data is scattered across Excel files from various marketplaces and a separate
SQL database. This lack of integration creates data silos, making it difficult to
reconcile sales figures with marketing and maintain a consistent view of
performance. It violates principles of data integration and data consistency,
limiting enterprise-wide reporting.
▪ Manual Processing and Error-Prone Data:
The company relies on manual processes to compile data, which are slow,
inconsistent, and prone to human error. This undermines data quality dimensions
such as accuracy, timeliness, and completeness, impairing reliable decision-
making.
▪ Weak Authentication and Access Controls:
Generic login IDs for customer support allow unauthorized or untraceable access
to sensitive customer data. This leads to lack of accountability, high risk of costly
data breaches, business disruptions and reputational damages.
▪ Unmonitored Systems and Poor Security Practices:
Due to lack of monitoring and poor security practices, a marketing database
breach occurred. This points to insufficient IT controls, such as continuous
monitoring, logging, and threat detection, which are core to any information
security framework.

Page 4 of 11
 Data, Systems and Risks
Suggested Answer
Certificate in Accounting and Finance Examination – Model paper

▪ Lack of Formal Data Governance Structure:

With no clear data ownership or standards and limited IT staffing, TrendyBuys
lacks a structured data governance framework. This leads to inconsistent practices
in data handling and poor data stewardship, undermining both compliance and
strategic analytics.

(b) Possible Solutions (Any three corresponding to the inadequacies explained in

part (a):

▪ Implement a Centralized Data Warehouse (CDW) with Extract, Transform,

Load (ETL) Processes:
Implement a CDW, powered by ETL processes.
A single source of truth for data improves consistency across departments
(marketing, sales, customer support), fostering better collaboration and reducing
time spent reconciling conflicting figures.

ETL processes automate data consolidation, freeing up staff from manual data
entry and reconciliation, leading to increased efficiency and productivity.
▪ Automated Data Validation and Cleansing Tools:
Implement automated tools that validate and cleanse data as it enters the system.
It reduces manual errors and ensures only high-quality, consistent data enters
reporting systems. This improves trust in analytics, reduces rework, and speeds up
decision-making cycles.
▪ Implement Role-Based Access Control (RBAC) with Unique Login IDs:
Deploy RBAC to ensure employees only access data relevant to their role,
eliminating generic logins. Also, deploy Privileged Access Management (PAM)
for sensitive systems like the SQL database.
It protects sensitive customer and operational data by restricting access to only
authorized users. It minimizes internal risks, increases accountability, and
supports compliance which is critical for customer trust and legal protection.
▪ Enhance IT Security Measures and Monitoring:
Deploy Security Information and Event Management (SIEM) systems for real-
time monitoring of all databases and networks to detect suspicious activity and
prevent unauthorized access.
It enables proactive identification and mitigation of threats through real-time
monitoring and alerts. This reduces downtime, prevents breaches, and protects
company data assets, preserving continuity and customer confidence.
Robust ITGCs and security measures (access controls, monitoring, IRP) minimize
the risk of costly data breaches and operational disruptions, ensuring business
continuity and protecting reputation.
▪ Establish a Data Governance Framework:
Introduce formal policies, procedures, standards, and roles (e.g., data ownership
and stewardship) for data collection, storage, access, and use across the
organization.
It establishes consistent policies and accountability for data handling across
departments. It improves data quality, promotes efficient collaboration, and
ensures that strategic initiatives (like predictive analytics) are based on trustworthy
data.

Page 5 of 11
 Data, Systems and Risks
Suggested Answer
Certificate in Accounting and Finance Examination – Model paper

A.5 (a) Cloud computing services are delivered through three primary models, each offering
different levels of control, flexibility, and management:

▪ Infrastructure as a Service (IaaS):

Core Offering:
IaaS offers virtualized computing resources via the internet, including virtual
machines, storage, and networking. Users retain control over the operating
systems and applications, while the cloud provider oversees the underlying
physical infrastructure, such as servers and data centers.
Example:
A large retail company might use Amazon Web Services (AWS) to run its e-
commerce website, dynamically scaling server capacity during high-traffic periods
like Eid sales days. They can add or remove virtual machines as traffic fluctuates,
minimizing costs.

▪ Platform as a Service (PaaS):

Core Offering:
PaaS delivers a platform that enables developers to build, deploy, and manage
applications without needing to worry about the underlying infrastructure. This
platform includes development tools, databases, middleware, and operating
systems, allowing developers to focus primarily on coding and application logic.
Example:
A software development company could use Google App Engine to develop and
deploy a cloud-based project management tool. The platform manages all the
underlying infrastructure, allowing developers to focus solely on writing the
application code and scaling it as needed.

▪ Software as a Service (SaaS):

Core Offering:
SaaS provides fully functional software applications over the internet, typically on
a subscription basis. The SaaS provider manages all aspects of the service,
including the hardware, operating system, application software, and data. Users
access these applications via web browsers or APIs without needing to install or
maintain the software locally.
Example:
A small business uses Salesforce to manage its customer relationships, track sales
leads, and generate reports on sales performance. By using Salesforce, the
company avoids investing in or maintaining its own CRM system, as all updates
and maintenance are handled by the provider.

(b) Organizations can adopt different cloud deployment models based on their specific
requirements for security, control, cost, and scalability. Two distinct models are:

▪ Public Cloud:
Key Features:
Public cloud services are delivered over the public internet and are shared among
multiple organizations, often referred to as "tenants". These services are highly
scalable, cost-effective, and easy to implement, with the third-party provider
managing and maintaining the entire infrastructure.
Page 6 of 11
 Data, Systems and Risks
Suggested Answer
Certificate in Accounting and Finance Examination – Model paper

Typical Use:
Public clouds are an excellent choice for startups or small businesses due to their
low upfront costs and pay-as-you-go pricing. They are also well-suited for
applications with variable workloads, such as e-commerce websites experiencing
fluctuating demand during holiday sales, benefiting from virtually unlimited
scalability.

▪ Private Cloud:
Key Features:
A private cloud is a cloud computing infrastructure dedicated solely to a single
organization, offering enhanced control, security, and customization. It can be
hosted either on the organization's own data centers (on-premises) or by a third-
party cloud provider. Unlike public clouds, resources in a private cloud are not
shared with other organizations.
Typical Use:
Private clouds are ideal for enterprises with strict regulatory, security, or
compliance requirements, such as those in healthcare or finance, that need to meet
stringent data privacy and security standards. They are also preferred by
businesses that require extensive customization of their infrastructure, workflows,
or security settings.

▪ Hybrid Cloud:
Key Features:
A hybrid cloud combines both public and private cloud environments, allowing
organizations to leverage the benefits of both models. Applications and data can
be shared and moved seamlessly between the public and private clouds, providing
a balance between scalability and control.
Typical Use:
Hybrid clouds are suitable for organizations with fluctuating workloads, enabling
them to use the public cloud for peak loads while keeping mission-critical
workloads and sensitive data in the private cloud. They also provide a robust
solution for disaster recovery by using the public cloud as a backup for critical
systems hosted in private clouds.

(c) Organizations can gain several significant benefits from adopting cloud computing:

▪ Cost Efficiency: Cloud computing eliminates the need for large upfront capital
investments in hardware and software, converting them into operational expenses.
This pay-as-you-go model allows businesses to manage and scale expenses
according to their needs.
▪ Scalability: Cloud computing offers unparalleled scalability, allowing
organizations to dynamically adjust their resources (e.g., CPU, memory, or
additional servers) based on current demand. This ensures performance remains
unaffected even during peak usage.
▪ Flexibility: Cloud computing enables unparalleled flexibility by allowing users to
access data and applications from any location with an internet connection. This
supports remote work and multi-location collaboration.

Page 7 of 11
 Data, Systems and Risks
Suggested Answer
Certificate in Accounting and Finance Examination – Model paper

▪ Disaster Recovery: Cloud providers offer robust disaster recovery solutions with
built-in backup, redundancy, and failover options, ensuring minimal disruption to
operations. Automated backup services ensure critical data is continuously backed
up and can be easily restored.
▪ Innovation: Cloud computing accelerates innovation by providing businesses
with the infrastructure and tools needed to develop, test, and deploy new
applications and services rapidly. Developers can access powerful computing
resources and pre-built models, allowing them to experiment and bring ideas to
market faster.

A.6 (a) Based on the scenario, SecureInvest is facing several cybersecurity and information
security risks:
▪ Malware/Ransomware Attack (Digital Risk): This risk occurs when "One
employee, after clicking a link in such an email, inadvertently downloaded
malicious software that encrypted several local files on their laptop, rendering
them inaccessible". Malware is malicious software designed to infiltrate systems,
steal data, or disrupt operations, and ransomware specifically encrypts data,
demanding payment for decryption.
▪ Cloud Misconfiguration (Cloud Computing Risk / Digital Risk): This risk is
evident when "a critical client data storage bucket in the new public cloud
environment was inadvertently left publicly accessible for several days due to a
misconfiguration during migration". Misconfigurations of cloud settings, such as
publicly exposed storage buckets or improper access controls, are common risks
in cloud environments that can lead to data leaks or unauthorized access.
▪ Third-Party Risk (Operational Risk): This risk is highlighted by the "major
service outage" experienced by "the third-party vendor providing automated
financial reports, leading to significant delays in daily reporting for SecureInvest".
Third-party risks arise from external entities like vendors with access to an
organization’s IT ecosystem, where their outages or failures can disrupt dependent
services.

(b) For each identified risk, here's its impact on the core objectives of information security
(Confidentiality, Integrity, Availability):
▪ Malware/Ransomware Attack:
Confidentiality:
Malware can allow attackers to steal sensitive data before encrypting it. This
exposes confidential information such as personal records, financial data, or
proprietary files to unauthorized parties.
Integrity:
Malware can also alter or corrupt data, affecting its integrity.

Availability:
The encryption of local files by ransomware directly impacts availability, as the
data becomes inaccessible to the legitimate user and the organization.
Example:
The WannaCry Ransomware Attack (2017) is a relevant example, where
ransomware encrypted data on hundreds of thousands of machines, including
critical institutions like the UK’s National Health Service, leading to significant
operational disruption and data inaccessibility.
Page 8 of 11
 Data, Systems and Risks
Suggested Answer
Certificate in Accounting and Finance Examination – Model paper

▪ Cloud Misconfiguration:
Confidentiality:
A publicly accessible client data storage bucket directly compromises
confidentiality, as sensitive client data could be viewed by unauthorized
individuals.
Integrity:
While not explicitly stated in the scenario, public access also opens the door to
unauthorized modification or deletion, which would impact data integrity.
Availability:
If unauthorized users manage to access the data due to misconfiguration, they can
also impact availability by deleting critical files or overwriting them, making them
inaccessible to legitimate users.
Example:
The Equifax Data Breach (2017), though primarily due to an unpatched
vulnerability, highlights the consequences of insufficient internal detection and
inadequate security configurations leading to the exfiltration of sensitive personal
data. Similarly, the source mentions that "In 2019, a misconfigured cloud database
exposed 540 million Facebook user records," directly illustrating a cloud
misconfiguration risk impacting confidentiality.

▪ Third-Party Service Outage:

Confidentiality:
If a third-party vendor suffers a breach, sensitive data shared with them can be
exposed to unauthorized parties.
Integrity:
Delays in reporting and data synchronization concerns can also lead to issues with
data integrity, as the reports may not reflect the most current and accurate state of
financial data.
Availability:
A major service outage from a third-party vendor directly impacts the availability
of automated financial reports and potentially the synchronization of data for
SecureInvest.
Example:
The 2021 AWS outage affected multiple online services, including streaming
platforms and e-commerce sites, which demonstrates how a third-party service
interruption can cause widespread availability issues for dependent services.

(c) Mitigation Strategies (Any three corresponding to the risks explained in part a)
▪ dPeriodically conduct Robust Security Awareness Training Program
▪ Implement Multi-Factor Authentication
▪ Conduct Regular Cloud Configuration Audits
▪ Enforce Cloud Security Best Practices
▪ Strengthen Third-Party Risk Management (TPRM) and Redundancy for Critical
Services

Page 9 of 11
 Data, Systems and Risks
Suggested Answer
Certificate in Accounting and Finance Examination – Model paper

A.7 (a) Here are two distinct categories of IT risks:

▪ Physical Infrastructure Risks (Physical Computing Technologies):
These risks target the tangible components of IT infrastructure, such as servers,
data centers, networking hardware, and physical facilities. While rooted in the
physical world, they can have cascading effects on digital operations, leading to
downtime, data loss, or operational disruptions. Physical security controls are
essential for preventing unauthorized physical access, equipment damage, or theft.
Example Risk:
Power Outages: Unexpected power disruptions, whether due to grid failures,
storms, or internal electrical issues, can halt IT operations. A significant power
outage, such as the 2019 blackout in Venezuela, can disrupt IT operations across
multiple sectors, including banking and healthcare services.

▪ Digital Risks (Digital Computing Technologies):

These risks exploit vulnerabilities in software, networks, databases, and other
intangible components of IT systems. They are primarily associated with
cyberattacks and technical vulnerabilities, posing significant threats to data
confidentiality, integrity, and availability.
Example Risk:
Ransomware Attack: This is a type of malicious software (malware) designed to
encrypt data and demand payment for decryption. The WannaCry ransomware
attack in 2017, for instance, encrypted data on hundreds of thousands of machines
across over 150 countries, including the UK's National Health Service (NHS),
which faced cancelled operations.

(b) ▪ General Mitigation Strategies for Physical Infrastructure Risks (e.g., Power
Outages):
Power Resilience Measures:
Deploying Uninterruptible Power Supply (UPS) systems and backup generators
helps maintain operations during power outages. Utilizing redundant power
sources and ensuring environmental controls like temperature regulation in data
centers can also protect IT equipment from damage during power fluctuations.

Disaster Recovery and Business Continuity Planning (DRP & BCP):

Developing and regularly testing DRPs and BCPs is crucial. DRPs outline
procedures for restoring IT operations after disruptions, while BCPs ensure critical
business functions continue. This includes maintaining off-site backups in
geographically diverse locations to ensure data availability and rapid recovery.

▪ General Mitigation Strategies for Digital Risks (e.g., Ransomware attacks):

Robust Cybersecurity Defenses:
Implementing a multi-layered defense strategy, including firewalls, intrusion
detection and prevention systems (IDPS), and up-to-date antivirus/anti-malware
software, is essential. Regularly applying security patches and updates to software
and systems helps fix known vulnerabilities that attackers might exploit. Multi-
Factor Authentication (MFA) also adds an extra layer of protection against
unauthorized access from stolen credentials.

Page 10 of 11
 Data, Systems and Risks
Suggested Answer
Certificate in Accounting and Finance Examination – Model paper

Employee Security Awareness Training and Incident Response Planning:

Human error is a leading cause of cybersecurity incidents. Regular training can
educate employees on recognizing and reporting phishing attempts and other
social engineering tactics that are common entry points for ransomware.
Additionally, a comprehensive incident response plan ensures that, if an attack
occurs, it is quickly detected, contained, investigated, and recovered from to
minimize damage and downtime.

(c) Strategic Importance of Effective IT Risk Management:

Effective IT risk management is no longer merely a technical necessity but a strategic
imperative that significantly influences an organization's overall success and resilience.
It plays a vital role in enabling digital transformation, fostering resilience, and driving
competitive advantage. Proactive risk management helps organizations adapt to
market shifts, technological advancements, and unexpected disruptions, ensuring
agility and the ability to recover quickly from incidents. By aligning IT practices with
data protection laws and industry standards, organizations build trust with customers
and stakeholders, enhance market credibility, and avoid legal risks and penalties.

Furthermore, organizations with superior IT risk management can differentiate

themselves, attracting clients who prioritize data protection and operational stability.

Key Challenges in Implementing and Maintaining IT General Controls (ITGCs):

IT General Controls (ITGCs) are foundational processes, policies, and procedures
designed to ensure the integrity, reliability, and security of an organization's IT
systems. However, their implementation and maintenance present several challenges:

▪ Complexity of IT Environments:
Modern IT environments are highly complex, involving multiple platforms,
diverse applications, and a wide array of devices, including cloud-based systems,
on-premise infrastructure, mobile devices, and IoT networks. Ensuring consistent
controls across this diverse landscape is difficult, especially when integrating
legacy systems that may lack modern security features with newer technologies
that introduce different security requirements.

▪ Balancing Flexibility and Security:

Organizations often struggle to balance the need for stringent security with the
demand for flexibility and user convenience. Implementing robust ITGCs, such
as multi-factor authentication or strict access permissions, can sometimes create
bottlenecks in business processes, slow down system performance, or
inconvenience users, leading to resistance from employees and stakeholders. This
resistance can result in workarounds or non-compliance, weakening the
effectiveness of the controls.

(THE END)

Page 11 of 11