SBL Notes E-business, E-marketing Pankaj Khandelwal
Chapter 17 and IT Controls CA, CFA, CIA
E-business
Meaning of E-Business & E-Commerce
• E-business: Using internet technology to improve business processes.
• E-commerce: Buying and selling goods/services through electronic networks.
E-Business
• Covers all business activities using the internet; e-commerce is one part of e-business.
• Examples:
o Online communication (email, Teams, Intranet)
o Cloud-based ERP systems
o Digital marketing and social media
o Online banking and payments
o E-procurement and digital contracts
o AI for research, customer service and HR
o Online examinations
• Benefits: Greater flexibility, efficiency, cost savings and better information sharing.
E-Commerce
• Involves online buying and selling (B2B and B2C).
• Growth drivers:
o More internet access
o Lower business costs
o COVID-19 accelerated online shopping
• E-businesses often have flatter, more innovative structures, although this is becoming less distinct.
E-Business Models
An e-business model explains how an online business creates value and earns revenue.
Model Meaning Example
Brokerage Connects buyers and sellers; earns commission eBay, Amazon
Advertising Free content supported by ads YouTube, Facebook
Infomediary Collects and sells useful market/data insights Big Data analytics firms
Merchant Sells products or digital goods online Amazon, Apple Music
Manufacturer (Direct) Sells directly to customers Dell
Affiliate Earns commission by referring customers Travel booking websites
Community Builds online communities; earns from donations or ads Wikipedia
Subscription Regular monthly/annual fee Netflix, Newspapers
Utility Pay only for actual usage Cloud services, ISPs
Alphabet (Google) – Revenue Sources (Ref: Annual Report 2022)
• Advertising (Google Search, YouTube, Google Network) – main source of income.
• Subscriptions (YouTube Premium, YouTube TV).
• Digital products (Google Play).
• Hardware (Pixel phones, Fitbit, Nest devices)
SBL Notes E-business, E-marketing Pankaj Khandelwal
Chapter 17 and IT Controls CA, CFA, CIA
Information Technology
E-Business Infrastructure
• E-business relies on internet technologies such as browsers, websites, web apps and mobile apps.
• IT infrastructure supports e-marketing, e-commerce and e-procurement.
Five-Layer Model (Dave Chaffey)
The Five-Layer Model explains the main components of an e-business IT infrastructure.
Layer Meaning
1. E-Business Services Business applications that provide services to users (e.g., online shopping, ERP).
Browsers, mobile apps, web servers, databases and networking software that run the
2. System Software
applications.
3. Network
Internet and company networks (TCP/IP) that transfer data.
(Transport)
4. Storage Data stored on company servers, hosting providers or the cloud.
5. Content/Data Website content, databases, customer and transaction data.
Tip to remember: Services → Software → Network → Storage → Data (SSNSD)
Additional Elements:
• Processing: Converts data into useful information.
• Intelligence: Uses analytics/AI to turn information into knowledge.
Intranet: A private internal network that uses internet technology within an organisation. Benefits:
• Faster communication and decision-making.
• Easy sharing of internal information.
• Supports online HR activities such as e-learning and employee induction.
E-marketing
• E-marketing uses digital technologies to identify, attract and satisfy customer needs.
• Traditional marketing = Push: Businesses send advertisements to customers (TV, newspapers, direct mail).
• E-marketing = Pull: Customers search for and visit business websites, then businesses may follow up with
emails or promotions.
Marketing Mix in E-Marketing (4Ps)
P E-Marketing Focus
Product Adapt products for online customers (e.g. Kindle e-books).
Price Online price comparison increases competition; discounts and cashback are common.
Place Use websites, SEO and paid search to make products easy to find.
Promotion Digital advertising through email, websites and social media allows targeted marketing.
Difference between traditional and new marketing media in the context of "6Is"
SBL Notes E-business, E-marketing Pankaj Khandelwal
Chapter 17 and IT Controls CA, CFA, CIA
Concept (6Is) Meaning Key Points / Examples
• Customers interact through websites, social media, reviews and
Two-way communication
Interactivity live chat.• Businesses collect feedback to improve products and
with customers
services.
Collect and analyse • Uses web analytics and social media data.• Tracks visits, clicks,
Intelligence
customer data purchases, likes and comments to improve marketing decisions.
• Ads and offers are tailored to customer interests and
Individualisation Personalised marketing behaviour.• E-commerce sites recommend products based on
previous purchases.
• Integrates email, social media, websites and offline channels.•
Combine all marketing
Integration Creates a seamless customer experience (e.g. order online, collect
channels
in-store).
Industry Digital technology • Businesses can sell directly to customers (disintermediation).•
Restructuring changes industries New business models emerge (e.g. airlines, Spotify, Netflix).
Independence of Business without • Customers can buy from anywhere, anytime.• Websites and
Location geographical limits mobile apps enable global reach and 24/7 sales.
E-Branding
• Brand: A name, logo or symbol that helps customers identify a business.
• E-branding: Building and managing a company's brand through online channels.
Importance of E-Branding
Benefit Explanation
Builds Trust Customers are more likely to buy from trusted online brands.
Increases Loyalty Strong brands encourage repeat purchases.
Creates Differentiation Helps a business stand out from competitors.
Improves Image Attracts customers who relate to the brand's values and reputation.
Managing an Online Brand
• The online brand should match the offline brand to avoid confusing customers.
• Customer reviews and social media can quickly improve or damage a company's reputation.
• Businesses should actively monitor and respond to online feedback.
Online vs Traditional Branding
Traditional Branding Online Branding
Built slowly over many years. Can grow rapidly through the internet.
Uses TV, newspapers and print
Uses websites, SEO, blogs, social media and email marketing.
advertising.
Two-way interaction with customers through reviews and social
Mostly one-way communication.
media.
SBL Notes E-business, E-marketing Pankaj Khandelwal
Chapter 17 and IT Controls CA, CFA, CIA
Managing Suppliers and Customers
Supply Chain Management (SCM)
• SCM: Managing the flow of goods, services and information from supplier to customer.
• Covers product development, sourcing, production and logistics.
• Internet & e-procurement improve coordination and information sharing.
E-Procurement
• Buying goods/services electronically using Internet, EDI and ERP.
• Automates purchasing, ordering and supplier management.
Definitions
• EDI (Electronic Data Interchange): Electronic transfer of business data between computer systems
without human intervention.
• ERP (Enterprise Resource Planning): Integrated software that manages core business operations and
supports better decision-making
Types of E-Procurement
Type Meaning
Web-based ERP Online purchasing & inventory management
E-sourcing Find new suppliers
E-tendering Request and compare supplier quotes
E-reverse auction Suppliers compete by offering lowest price
E-informing Share purchasing information electronically
Advantages
• Right time, quantity, quality, price & supplier.
• Faster ordering and delivery.
• Better supplier monitoring.
• Real-time inventory replenishment.
• Lower procurement costs.
Risks
• Supplier may gain bargaining power (by knowing more about the customer).
• EDI/software errors.
• Security and data privacy issues.
• Suppliers may not support e-transactions.
• Faster sourcing can disrupt supply chains.
Customer Relationships
• Websites help communicate: and build relationships with customers.
• Answering common queries: Use FAQs, feedback forms and customer registration.
• Quick responses improve customer satisfaction.
• Asking visitors to register: helps collect customer data for marketing.
SBL Notes E-business, E-marketing Pankaj Khandelwal
Chapter 17 and IT Controls CA, CFA, CIA
Customer Relationship Management (CRM)
• CRM: Collects and analyses customer data to improve sales, marketing and service.
• Uses purchase history and customer profiles for personalised service.
• E-CRM: Uses the internet to provide personalised offers, support and complaint handling.
Customer Acquisition
• Digital marketing replaces traditional cold calling.
• Businesses use customer data to generate better sales leads.
Method Purpose
Search Engine Marketing (SEM) Increase website visibility on search engines
Social Media Marketing Engage customers and build brand awareness
E-mail Marketing Send personalised promotions and manage customer communication
Retaining Customers
• Retaining customers is cheaper and more profitable than acquiring new ones.
• Customer loyalty depends on customer satisfaction.
• Businesses improve loyalty through personalised websites and online loyalty programs.
Online Service Quality (5 Dimensions)
Dimension Meaning
Tangibles Attractive, easy-to-use website
Reliability Website works consistently and is available
Responsiveness Quick replies to customer queries
Assurance Build trust through good support and privacy
Empathy Personalised, caring communication
Systems Security Controls
Need for Effective Controls
• Effective controls ensure systems remain secure, accurate and reliable, reducing business disruption.
• Weak controls can lead to incorrect data, data loss, cyberattacks, fraud, unauthorised changes and
disasters.
General Controls
• General controls are policies and procedures that ensure IT systems are secure, reliable and operate
effectively.
• They support application controls and protect hardware, software, networks, data and system access.
• Cover IT infrastructure, software, hardware, system changes and security.
SBL Notes E-business, E-marketing Pankaj Khandelwal
Chapter 17 and IT Controls CA, CFA, CIA
NIST Cybersecurity Framework (5 Functions)
The National Institute of Standards and Technology (NIST) cybersecurity framework is a widely used approach for
IT and systems security controls.
Function Meaning
Identify Understand IT assets and cybersecurity risks
Protect Safeguard systems, data and access
Detect Identify security threats quickly
Respond Take action to contain cyber incidents
Recover Restore systems and normal operations
Control Framework in organisations
• Provides policies and controls to keep IT systems secure and reliable.
Control Area Details
Organisation & Management IT policies, procedures and staff training
Segregation of Duties Separate development, operation and maintenance roles
System Development Standard procedures, testing and documentation
Computer Operations Authorised equipment and trained staff
System Software Approved software with audit trails
Data entry & Programming User permissions, backups and recovery
Physical Security controls Protect IT equipment and facilities
Application Controls
Purpose and Nature
• They provide an additional layer of control beyond general controls and can be manual or automated
controls used in business processes.
• They ensure transactions are authorised, complete, accurate and timely.
Application controls are grouped into:
• Input controls
• Processing controls
• Output controls
• Standing (Master) data controls
Objective (CAVe):
• Completeness
• Accuracy
• Validity of transactions
SBL Notes E-business, E-marketing Pankaj Khandelwal
Chapter 17 and IT Controls CA, CFA, CIA
Types of Application Controls
Control Meaning
Input Controls Ensure only valid, complete and authorised data is entered.
Processing Controls Ensure data is processed correctly (e.g. sequence & format checks).
Output Controls Ensure reports are accurate, complete and sent to the right users.
Standing (Master) Data Controls Protect master data through authorised changes and segregation of duties.
Security of Technology Assets
A systematic approach to IT security requires documented policies, procedures and organisation-wide
implementation. This requires:
Element Meaning
Top Management Support Management commits resources and supports IT security.
Security Culture Staff understand security risks and follow policies.
Risk Management Regularly identify, assess and manage IT risks.
Vigilance Stay alert to internal and external security threats.
Risk Assessment
• Risk assessment identifies IT risks and their potential financial impact.
• Risks may arise from downtime, fraud, theft and legal/regulatory breaches.
• Risk = (Threat × Vulnerability × Impact) ÷ Countermeasures.
Element Meaning
Threat Source of danger
Vulnerability Weakness that can be exploited
Impact Damage caused if the risk occurs
Countermeasures Controls to reduce or prevent the risk
Systems Failure Controls
• Reduce the risk of system downtime and data loss through good system design, quality equipment,
backup systems, maintenance, trained staff and contingency plans.
Security Controls
Control Type Meaning
Protect IT equipment from fire, flood, theft, disasters and unauthorised physical
Physical Security Controls
access using CCTV, locks, security guards and backup facilities.
Prevent unauthorised access with user IDs, strong passwords, multi-factor
Logical Security Controls
authentication (MFA) and biometrics.
Application Security Protect software from hackers, malware, viruses, phishing, trojans, worms and
Controls other cyberattacks using security software and updates.
Secure networks with firewalls, encryption, user access controls, activity logging
Network Security Controls
and intrusion detection to prevent attacks and data theft.
SBL Notes E-business, E-marketing Pankaj Khandelwal
Chapter 17 and IT Controls CA, CFA, CIA
Data and Content Security
Protection for data and content is normally provided by:
• disk, folder and file security passwords;
• database authentication;
• data encryption;
• data audits;
• activity and change logging;
• data backups.
Contingency Planning
• Contingency planning prepares the organisation to continue operations and recover after a disaster.
• It includes backup, recovery procedures, testing and clear staff responsibilities.
• Plans should be regularly updated and tested to ensure business continuity.
Key Elements
Element Meaning
Approach Prioritise critical systems for faster recovery.
Backup Keep backup hardware, software and data.
Data Backup Regularly back up data (e.g. daily, weekly, monthly).
Software Backup Store copies of system software securely off-site.
Hardware Backup Use spare equipment, maintenance contracts or recovery sites.
Duplicate Systems Run identical systems at different locations for continuity.
Fault-Tolerant Systems Use duplicate components that automatically switch over if one fails.
Document disaster response, recovery, communication, resources and testing
Contingency Plan
procedures.
Cyber Security
Cyber Threats
• Cyber-attacks are attempts to gain unauthorised access to systems or data to cause harm.
• Common threats include data theft, financial fraud, business disruption and data destruction.
Sources of Cyber Threats
Source Reasons
Criminals Steal valuable data or money
Spies Steal commercial or political information
Hackers Break into systems for challenge or curiosity
Hacktivists Attack for political or ideological reasons
Employees Misuse authorised access to damage systems or data
Measures to Promote Cyber Security
• Organisations should implement strong policies, controls and employee awareness to protect against
cyber threats.
• Key measures focus on risk management, secure systems, controlled access, monitoring and incident
response.
SBL Notes E-business, E-marketing Pankaj Khandelwal
Chapter 17 and IT Controls CA, CFA, CIA
The UK National Cyber Security Centre provides guidance to businesses on how to protect themselves in
cyberspace. 10 steps to cyber security covers the following areas:
Measure Meaning
Risk Management Identify and manage cyber risks.
Secure Configuration Keep systems updated and remove vulnerabilities.
Network Security Use firewalls and secure network connections.
User Privileges Give users only the access they need.
User Awareness Train employees on cyber security.
Incident Management Respond quickly to cyber incidents.
Malware Prevention Use antivirus and block malicious software.
System Monitoring Continuously monitor for suspicious activity.
Removable Media Controls Restrict USB devices and external storage.
Home & Mobile Working Secure remote access and mobile devices.
Tip to remember: RSN | UUI | MMRH
• RSN → Risk – Secure – Network
• UUI → User Privileges – User Awareness – Incident
• MMRH → Malware – Monitoring – Removable Media – Home Working
Actions for the CFO
The CFO should treat cyber security as a business risk, not just an IT issue.
Action Meaning
Redefine Risk & Resilience Adopt a zero-trust approach and verify all users before granting access.
Focus on Recovery Plans Prepare and test incident response and disaster recovery plans.
Audit the Supply Chain Ensure suppliers have strong cyber security controls.
Invest in Cyber Insurance Use cyber insurance to reduce financial losses and assess cyber risks.