Table of Contents

June 2019 ............................................... 1 - 14

December 2019 ...................................... 15 - 27
December 2020 ...................................... 28 - 40
Management Information and Control System June 2021 ............................................... 41 - 51
December 2021 ...................................... 52 - 64
Suggested Answers
June 2022 ............................................... 65 - 77
December 2022 ...................................... 78 - 91
June 2023 ............................................... 92 - 100
December 2023 ...................................... 101 - 112
June 2024 ............................................... 113 - 125
CAP III Paper 5: Management Information and Control System CAP III Paper 5: Management Information and Control System
June 2019 June 2019

objects. Behaviors may be inherited from super-classes, and novel

Marks behaviors may be added without effecting existing systems functions.
Attempt all questions.  High Code Reusability: When a new object is created, it will automatically
Use separate answer book for each question. inherit the data attributes and characteristics of the class from which it was
spawned. The new object will also inherit the data and behaviour from all
1. Assume that you are working as a software project manager in a software super classes in which it participates. When a user creates a new type of a
development company. Your company assigned you a project to develop an widget, the new object behaves "wigitty", while having new behaviour
information system for a bank and you chose object-oriented methodology which are defined to the system.
to develop the system. Based on this scenario, answer the following
questions. Second part: Structured methodologies have been used to document, analyze,
a) What are the reasons for choosing object-oriented development approach and design information systems since the 1970s. Structured refers to the fact
for this project? How is object-oriented development different from that the techniques are step by step, with each step building on the previous one.
structured development approach? (4+6=10) These methodologies are top-down, progressing from the highest, most abstract
b) Why do you incorporate controls into the design and implementation of level to the lowest level of detail from the general to the specific. These methods
information systems? Explain general controls and application controls are process-oriented, focusing primarily on modeling the processes, or actions
that are used to control information system. What is the role of auditing that capture, store, manipulate, and distribute data as the data flow through a
in the control process? (3+4+3=10) system. These methods separate data from processes whereas object oriented
development combine both data and process in a single object. Object oriented
Answer: development uses modeling tools (class diagram, object diagram, sequence
a) First part: Object-oriented development uses the object as the basic unit of diagram etc.) that are different from structured development.
systems analysis and design. An object combines data and the specific processes The primary modeling tool in structured development for representing a
that operate on those data. Data encapsulated in an object can be accessed and system’s component processes and the flow of data between them is the data
modified only by the operations, or methods, associated with that object. Instead flow diagram (DFD). DFD offers a logical graphic model of information flow,
of passing data to procedures, programs send a message for an object to perform partitioning a system into modules that show manageable levels of detail. DFD
an operation that is already embedded in it. The system is modeled as a rigorously specifies the processes or transformations that occur within each
collection of objects and the relationships among them. Because processing module and the interfaces that exist between them. DFDs can be used to depict
logic resides within objects rather than in separate software programs, objects higher-level processes as well as lower- level details. Through leveled data flow
must collaborate with each other to make the system work. diagrams, a complex process can be broken down into successive levels of
detail. Using DFD, an entire system can be divided into subsystems with a high
Object-oriented developments make the promise of reduced maintenance, code
level data flow diagram. Each subsystem, in turn, can be divided into additional
reusability, real world modelling, and improved reliability and flexibility. Since
subsystems with second-level data flow diagrams, and the lower-level
my company is a software development company, the software objects
subsystems can be broken down again until the lowest level of detail has been
developed for one project can be easily ported to another project. Moreover, in
reached.
object oriented approach, each distinct function or feature can be developed by a
Another tool for structured analysis is a data dictionary, which contains
separate developer or team and integrated into the main project later. These are
information about individual pieces of data and data groupings within a system.
the principal motivators for me to choose this approach. Here are some of the
The data dictionary defines the contents of data flows and data stores so that
major benefits of the object-oriented approach:
systems builders understand exactly what pieces of data they contain. Another
 Reduced Maintenance: The primary goal of object-oriented development is tool is process specification that describes the transformation occurring within
the assurance that the system will enjoy a longer life while having far the lowest level of the data flow diagrams. Process specifications express the
smaller maintenance costs. Because most of the processes within the system logic for each process. Another tool is structure chart where software design is
are encapsulated, the behaviour may be reused and incorporated into new modeled using hierarchical structure charts. It is a top-down chart, showing each
behaviour. level of design, its relationship to other levels, and its place in the overall design
 Real-World Modelling: Object-oriented systems tend to model the real structure; The design first considers the main function of a program or system,
world in a more complete fashion than do traditional methods. Objects are then breaks this function into sub-functions, and decomposes each sub-function
organized into classes of objects, and objects are associated with until the lowest level of detail has been reached; The chart may document one
behaviour. The model is based on objects, rather than on data and program, one system (a set of programs), or part of one program
processing.
b) First Part: To minimize errors, disasters, interruptions of service, computer
 Improved Reliability and Flexibility: Object-oriented system promise to
be far more reliable than traditional systems, primarily because new crimes, and breaches of security, controls must be incorporated into the design
behaviors can be "built" from existing objects. Because objects can be and implementation of information systems. The combination of manual and
dynamically called and accessed, new objects may be created at any time. automated measures that safeguard information systems and ensure that they
The new objects may inherit data attributes from one, or many other perform according to management standards is termed controls. Controls consist
of all the methods, policies, and procedures that ensure protection of the

© The Institute of Chartered Accountants of Nepal 2 1 © The Institute of Chartered Accountants of Nepal 3 2
CAP III Paper 5: Management Information and Control System CAP III Paper 5: Management Information and Control System
June 2019 June 2019

organization’s assets, the accuracy and reliability of its records, and operational For this audit, the auditor usually interviews key individuals who use and
adherence to management standards. operate a specific information system concerning their activities and procedures.
In the past, the control of information system was addressed only toward the Application controls, overall integrity controls, and control disciplines are
examined. The auditor should trace the flow of sample transactions through the
end of implementation, just before the system was installed. Today,
system and perform tests, using, if appropriate, automated audit software.
Organizations must identify vulnerability and control issues as early as possible.
The control of an information system must be an integral part of its design.
Users and builders must pay close attention to controls throughout the system’s 2. Commercial Bank is going to implement e-Banking system with 24×7
life span. service. The bank needs to develop and implement information technology
infrastructure mainly focusing on data center and disaster recovery center. It
Second Part: Computer systems are controlled by a combination of general is also planning to implement ERP system. You are hired as the ICT expert
controls and application controls. General controls establish the framework for for this project. Based on the above scenario, answer the following
controlling design, security, and use of computer programs and the security of questions.
data files in general throughout an organization. Application controls, on the a) Discuss the recovery plan for new information system of this Bank. 7
other hand, are specific controls unique to each computerized application. b) How to implement an ERP in this Bank? What are the characteristics of
 General Controls and Data Security: General controls include software ERP? (4+3=7)
controls, physical hardware controls, computer operations controls, data
security controls, controls over the systems implementation process, and c) What are the key points to be taken into account while conducting a
administrative controls. Although most of these controls are designed and disaster recovery testing policy for disaster recovery center of this Bank? 6
maintained by information systems specialists, data security controls and Answers:
administrative controls require input and oversight from end users and a) Disaster Recovery Plan (DRP) is to restore the operability of systems that
business managers. support mission-critical and critical business processes. The objective is for the
Software controls monitor the use of software and prevent unauthorized organization to return to normal operations as soon as possible. Since many
access of software programs, system software, and computer programs. mission-critical and critical business processes depend on a technology
Hardware controls ensure that computer hardware is physically secure, and infrastructure consisting of applications, data, and IT hardware, the DRP should
check for equipment malfunction. Computer operations controls oversee the be an IT focused plan. Every organization should develop a Disaster Recovery
work of the computer department to ensure that programmed procedures are Plan for all applications. Restoration of systems does not necessarily imply
consistently and correctly applied to the storage and processing of data. Data technology redundancy. The DRP may call for some procedures to be
security controls ensure that valuable business data file on either disk or tape completed manually. The decision to revert to manual procedures, rather than to
are not subject to unauthorized access, change, or destruction while they are build and maintain an IT infrastructure is a cost-driven decision made by the
in use or in storage. Implementation controls audit the systems development organization. Having a DRP in place reduces the risk that the duration of
process at various points to ensure that the process is properly controlled and disruption in a business process does not go beyond what has been determined
managed. Administrative controls formalize standards, rules, procedures, to be acceptable by management in the organization. During the recovery phase,
and control disciplines to ensure that the organization’s general and the focus is on establishing controls over occurring events to limit the risk of
application controls are properly executed and enforced. any additional losses.
This DRP is common to all systems and utilizes the following six steps:
 Application Controls: Application controls include both automated and
manual procedures that ensure that only authorized data are completely and  Develop the Business Contingency Planning Policy and Business Process
accurately processed by an application. These are unique to each  Conduct a Risk Assessment
computerized application. Application controls include input controls,  Conduct the Business Impact Analysis (BIA)
processing controls, and output controls.  Develop Business Continuity and Recovery Strategies
Input controls check data for accuracy and completeness when they enter the  Conduct awareness, testing, and training of the DRP
system. These are specific input controls for input authorization, data  Conduct Disaster Recovery Plan maintenance and exercise
conversion, data editing, and error handling. Processing controls establish
that data are complete and accurate during processing. Output controls b) An ERP solution provides the core information system functions for the entire
ensure that the results of computer processing are accurate, complete, and business. But usually an organization must redesign its business processes to
properly distributed. fully exploit and use an ERP solution. Most organizations must still supplement
the ERP solution with custom software applications to fulfill business
Third Part: To know that information systems controls are effective, requirements that are unique to the industry or business. For most organizations,
organizations must conduct comprehensive and systematic audits. An MIS audit an ERP implementation and integration represents the single largest information
identifies all the controls that govern individual information systems and assess system project ever undertaken by the organization. It can cost tens of millions
their effectiveness. To accomplish this, the auditor must acquire a thorough of dollars and require a small army of managers, users, analysts, technical
understanding of operations, physical facilities, telecommunications, control specialists, programmers, and consultants.
systems, data security objectives, organizational structure, personnel, manual ERP applications are significant to systems analysts for several reasons. First,
procedures, and individual applications. systems analysts may be involved in the decision to select and purchase an ERP

© The Institute of Chartered Accountants of Nepal 4 3 © The Institute of Chartered Accountants of Nepal 5 4
CAP III Paper 5: Management Information and Control System CAP III Paper 5: Management Information and Control System
June 2019 June 2019

solution. Second, and more common, systems analysts are frequently involved organizing and controlling the operations of the business.
in the customization of the ERP solution, as well as the redesign of business (ii) Qualified System and Management Staff: MIS should be manned by
processes to use the ERP solution. Third, if custom-built applications are to be qualified officers. These officers who are experts in the field should
developed within an organization that uses an ERP core solution, the ERP understand clearly the views of their fellow officers. The organizational
system’s architecture significantly impacts the analysis and design of the management base should comprise of two categories of officers (i) System
custom application that must coexist and interoperate with the ERP system and Computer experts and (ii) Management experts. Management experts
ERP systems have following characteristics: should clearly understand the concepts and operations of a computer. Their
 ERP systems integrate the various processes in the organization. whole hearted support and cooperation will help in making MIS an effective
 ERP systems use an enterprise-wide database which stores each data only one.
once (iii)Support of Top Management: An MIS becomes effective only if it receives
 ERP systems allow access to the data in real time the full support of top management. To gain the support of top management,
 ERP systems support multiple currencies and languages. the officer should place before them all the supporting facts and state clearly
 ERP system are flexible to accommodate the changing needs of an the benefits which will accrue from it to the concerned. This step will
enterprise certainly enlighten the management and will change their attitude towards
 ERP has many features like security, authorization, referencing, MIS.
responsibility and implementation of the business rules. (iv) Control and Maintenance of MIS: Control of the MIS means the operation
of the system as it was designed to operate. Sometimes users develop their
 ERP usage can be controlled at all levels such as the data, transaction,
information and analysis level. own procedures or shortcut methods to use the system, which reduces its
effectiveness. To check such habits of users, the management at each level
 In ERP systems, information is often recorded in a form that cannot be read
in the organization should devise checks for the information system control.
without the use of computer.
Maintenance is closely related to control. There are times when the need for
 It is difficult to make changes after an ERP system has been implemented.
improvements to the system will be discovered. Formal methods for
c) The key points of disaster recovery testing policy are as follows: changing and documenting changes must be provided.
(v) Evaluation of MIS: An effective MIS should be capable of meeting the
 Secure management approval and funding for the test. information requirements of its executives in future as well. The capability
 Provide detailed information about the test. can be maintained by evaluating the MIS and taking appropriate timely
 Make sure the entire test team is available on the planned test date. action. The evaluation of MIS should take into account the following points:
 Ensure the test does not conflict with other scheduled tests or activities.  Examining the flexibility to cope with future requirements;
 Confirm test scripts are correct.  Ascertaining the view of the users and designers about the capabilities
 Verify that the test environment is ready. and deficiencies of the system ; and
 Schedule a dry run of the test.  Guiding the appropriate authority about the steps to be taken to maintain
 Be ready to halt the test if needed. effectiveness of MIS.
 Have a scribe take notes. Constraints in operating MIS:
 Complete an after-action report about what worked and what failed. Major constraints which come in the way of operating an information system are:
 Use the results from the test to update the DR plan.  Non-availability of experts, who can diagnose the objectives of the
3. organization and provide a desired direction for installing a system.
a) Describe the main pre-requisites of a Management Information System,  Experts usually face the problem of selecting the sub-system of MIS to be
which make it an effective tool. Explain the major constraints in installed and operated upon.
operating it. (5+3=8)  Due to varied objectives of business concerns, the approach adopted by
b) Explain Executive Information System (EIS). What purpose does it experts for designing and implementing MIS is a non-standardized one.
serve and what are the characteristics of Executive Information System? (3+2+2=7)  Non-availability of cooperation from staff in fact is a crucial problem. It
Answer: should be handled tactfully. Educating the staff by organizing lectures,
a) Pre-requisites of an MIS: The following are pre-requisites of an showing films, training on system and utility of the system may solve this
effective MIS: problem.
 There is high turnover of experts in MIS. Turnover in fact arises due to
(i) Database: It is a super file which consolidates data records formerly stored several factors like pay, promotion chances, future prospects, behavior of
in many data files. The data in database is organized in such a way that top ranking managers etc.
access to the data is improved and redundancy is reduced. Normally, the
database is subdivided into major information sub-sets needed to run. The  Difficulty in quantifying the benefits of MIS, so that it is easily comparable
database should be user-oriented, capable of being used as a common data with cost.
source, available to authorized persons only and should be controlled by a
separate authority such as DBMS. Such a database is capable of meeting
information requirements of its executives, which is necessary for planning,

© The Institute of Chartered Accountants of Nepal 6 5 © The Institute of Chartered Accountants of Nepal 7 6
CAP III Paper 5: Management Information and Control System CAP III Paper 5: Management Information and Control System
June 2019 June 2019

b) An Executive Information System (EIS) – sometimes referred to as an potential customers. A CRM system helps companies stay connected to
Executive Support System (ESS) is a DSS that is designed to meet the special customers, streamline processes, and improve profitability.
needs of top-level managers. Some people use the terms “EIS” and “ESS” inter Customer relationship management focuses on managing all of the ways that a
changeably, but others do not. Any distinction between the two usually is
firm deals with its existing and potential customers. It uses information systems
because Executive Support Systems are likely to incorporate additional
that integrate all of the business processes that interact with customers in sales,
capabilities such as electronic mail. An Executive Information System (EIS) is a
marketing, and service. The ideal CRM system provides end-to-end customer
tool that provides direct on-line access to relevant information in a useful and
care from receipt of an order through product delivery.
navigable format. The relevant information is timely, accurate, and actionable
CRM software records customer contact information such as email, telephone,
information about aspects of a business that are of particular interest to the
website social media profile, and more. It can also automatically pull in other
senior manager. An EIS is easy to navigate so that managers can identify broad
information, such as recent news about the company's activity, and it can store
strategic issues, and then explore the information to find the root causes of those
details such as a client's personal preferences on communications. The CRM
issues.
system organizes this information to give a complete record of individuals and
EIS serves the following major purposes: companies. CRM software improves customer relationship management by
 The primary purpose of an Executive Information System is to support creating a 360° view of the customer, capturing their interactions with the
managerial learning about an organization, its work processes, and its business, and by surfacing the information needed to have better conversations
interaction with the external environment. with customers. The benefits of customer relationship management system
include:
 A secondary purpose is to allow timely access to information so that based
 Better client relationships – Good and accurate information about client
on the answers to questions, strategic decisions could be taken by a manger enables the service provider to better serve the clients. This makes the
in time. clients feel that the organization cares for them, thereby enhancing loyalty.
 It directs the attention of the management to specific areas of the  Improved ability to cross-sell – Better knowledge about customer needs
organization or specific business problems. It makes managers and enables the organization to provide a better solution to their next problem.
subordinates to work together to determine the root causes of issues  Increased team collaboration – A good CRM gives better information to
highlighted by EIS. better align teams and their activities to enhance customer experience.
 Improved efficiency in serving clients – If related team is using the CRM to
Major characteristics of an Executive Information System (EIS) are given as record their customer interactions, EVERY client interaction, then they are
follows: able to serve the client with the knowledge of what has been previously
 EIS is a computer-based-information system that serves the information discussed with the client.
need of top executives.  Greater staff satisfaction – The more knowledge the employees have the
more empowered and engaged they are. Having an accurate and up-to-date
 EIS enables users to extract summary data and model complex problems
CRM that everyone uses and accesses helps employees solve client
without the need to learn query languages, statistical formulae or high problems. Doing so makes employees and clients happy.
computing skills.  Increased revenue and profitability – Once everyone learns, and uses, the
 EIS provides rapid access for timely information and direct access to the CRM productivity increases, sales cycles decrease, the organization has the
management reports. ability to provide additional products and services to clients and client
 EIS is capable of accessing both internal and external data. satisfaction increases.
 Cost savings – While the implementation of CRM software is expensive and
 EIS provides extensive online analysis tools like trend analysis, market
time-consuming, over time the benefits far outweigh the costs. Members of
conditions etc. the sales team are able to better schedule meetings with prospects in the
 EIS can easily be given a DSS support for decision making. same geographic area. Client-service reps are better able to resolve a client's
concern. There is a central client and prospect database that everyone can
4. access rather than everyone keeping a separate spread sheet or contact
a) Explain Customer Relationship Management system in detail along with database on their computer.
benefits. What is sales force automation? (6+2=8)  Less client attrition – When a client is engaged with only one member of a
professional services firm, the risk of attrition is 40%. When five or more
b)
Assume an IT consultant company is working on a MIS for a commercial bank.
partners are involved in a client relationship, the risk of attrition falls to less
Explain why it is important for the two organizations to enter into a non-
than 5%.
disclosure agreement. Explain the importance of copyright protection in the
software industry. (3.5+3.5=7)
Second Part: Abbreviated SFA, sales force automation is a technique of
Answer: using software to automate the business tasks of sales, including order
a) First part: Customer Relationship Management (CRM) is a strategy for processing, contact management, information sharing, inventory monitoring and
managing an organization’s relationships and interactions with customers and control, order tracking, customer management, sales forecast analysis and
employee performance evaluation. SFA is often used interchangeably

© The Institute of Chartered Accountants of Nepal 8 7 © The Institute of Chartered Accountants of Nepal 9 8
CAP III Paper 5: Management Information and Control System CAP III Paper 5: Management Information and Control System
June 2019 June 2019

with CRM; however, CRM does not necessarily imply automation of sales Answer:
tasks. a) The three Types of Cloud Computing Service Models are:
Software as a Service (SaaS)
b) A commercial bank is a business entity in a highly competitive sector. Similarly The capability provided to the consumer is to use the provider’s applications
IT consultancy and software development are also very competitive sectors. running on a cloud infrastructure. The applications are accessible from various
Because of the tough competition and need to do well to survive, the companies client devices through either a thin client interface, such as a web browser
do their utmost to make sure their business secrets, strategies, software source (e.g., web-based email), or a program interface. The consumer does not
codes, system access privileges etc are protected and do not get leaked to the manage or control the underlying cloud infrastructure including network,
people who should not have them. In the modern digital age, the data and servers, operating systems, storage, or even individual application capabilities,
information are the biggest asset. A single page of information can divulge with the possible exception of limited user-specific application configuration
critical business strategy or an important system design. Such breach of settings.
confidentiality can be extremely harmful to the organization and its business Platform as a Service (PaaS)
prospects. Though there are many ways such information can be released, it is The capability provided to the consumer is to deploy onto the cloud
normally assumed that the internal staff members do not release them. At least infrastructure consumer-created or acquired applications created using
they may have sworn to protect that. However, the scenario is tricky when two programming languages, libraries, services, and tools supported by the
separate entities work on a common project such as MIS deployment. This provider. The consumer does not manage or control the underlying cloud
involves close collaboration and sharing of the important assets such as system infrastructure including network, servers, operating systems, or storage, but
access, design topologies, personnel and privilege information etc. To make has control over the deployed applications and possibly configuration settings
sure that these critical information of one entity are not compromised by the for the application-hosting environment.
other, it is customary to sign a non-disclosure agreement (NDA) between the Infrastructure as a Service (IaaS)
two. This creates a legal obligation for each entity to safeguard the information
The capability provided to the consumer is to provision processing, storage,
and data of the other. In case of any breach, the NDA also gives a strong legal
networks, and other fundamental computing resources where the consumer is
case for the entity whose data is breached.
able to deploy and run arbitrary software, which can include operating systems
Copyright protection scheme is designed to promote innovation and reward & and applications. The consumer does not manage or control the underlying
acknowledge the innovators. The new products, services, tools etc developed or cloud infrastructure but has control over operating systems, storage, and
created by an innovator finds good use among a lot of people but at the same time, deployed applications; and possibly limited control of select networking
the innovation can be copied by some rogue person and promoted by his or her own. components (e.g., host firewalls).
The key features of PaaS are as follows:
In such a case, the original creator of the product does not get due credit, both
 Multi-tenant architecture
material and immaterial. This makes true innovators discouraged to further work on
 Customizable /Programmable User Interface
such creative projects. As a result, the pace of innovation, creation and ideation
 Unlimited Database Customization
slows down leading to the disadvantage for all. To make sure this does not happen,
 Robust Workflow engine/capabilities
the innovators, creators, artists, designers etc need to get both financial and non-  Granular control over security/sharing (permissions model)
financial credit for their creation. This is ensured by the copyright regime which  Flexible “services-enabled” integration model
protects the original creator against unlawful copying, distribution and monetization
of the products or services without the consent of the original creator. Such b) 1)Role of IS Auditor in Physical Access Controls: Auditing Physical Access
copyright protects the innovators, ensures benefits (if applicable) for them in terms requires the auditor to review the physical access risk and controls to form an
of direct sales or shares, and above all, makes sure that the name of the creator is opinion on the effectiveness of the physical access controls. This involves the
associated with the creation. This protects the intellectual property, discourages following:
Risk Assessment: The auditor must satisfy himself that the risk assessment
illegal copying and encourages innovation. Hence, copyright protection regime is of
procedure adequately covers periodic and timely assessment of all assets,
great importance in all modern industry including IT industry. It is even more physical access threats, vulnerabilities of safeguards and exposures therefrom.
relevant in computer and IT industry because in this field there are many means and Controls Assessment: The auditor based on the risk profile evaluates whether
mechanisms by which the intellectual property can be stolen and breached. the physical access controls are in place and adequate to protect the IS assets
against the risks.
5. Planning for review of physical access controls: It requires examination of
a) Explain the three types of cloud computing service models . What relevant documentation such as the security policy and procedures, premises
are key features of PaaS (Platform as a Service)? (6+2=8) plans, building plans, inventory list and cabling diagrams.
b) Describe the role of IS auditor with respect to: (2 3.5=7) Testing of Controls: The auditor should review physical access controls to
i) Physical access controls satisfy for their effectiveness. This involves:
ii) Environmental controls.  Tour of organizational facilities including outsourced and offsite facilities.

© The Institute of Chartered Accountants of Nepal 10 9 © The Institute of Chartered Accountants of Nepal 11 10
CAP III Paper 5: Management Information and Control System CAP III Paper 5: Management Information and Control System
June 2019 June 2019

 Physical inventory of computing equipment and supporting infrastructure. 6. Write short notes on: (5 3=15)
 Interviewing personnel can also provide information on the awareness and a) Business and IT alignment
knowledge of procedures. b) Secure electronic payments
 Observation of safeguards and physical access procedures. This would also c) Artificial intelligence
include inspection of: d) Information system audit strategy
i) Core computing facilities. e) Importance of business continuity planning
ii) Computer storage rooms. Answer:
iii) Communication closets. a) Business and IT alignment
iv) Backup and off site facilities.
v) Printer rooms.
vi) Disposal yards and bins.
vii) Inventory of supplies and consumables. MEDIATING FACTORS:
Review of physical access procedures including user registration and Environment
Culture
authorization, authorization for special access, logging, review, supervision etc.
Structure
Employee termination procedures should provide withdrawal of rights such as Standard Procedures INFORMATION
ORGANIZATIONS
retrieval of physical devices like smart cards, access tokens, deactivation of Politics TECHNOLOGY
access rights and its appropriate communication to relevant constituents in the Management Decisions
organization. Chance
Examination of physical access logs and reports. This includes examination of
incident reporting logs and problem resolution reports.
2) Role of Auditor in Environment Controls:
The attack on the World Trade Centre in 2001 has created a worldwide alert
bringing focus on business continuity planning and environmental controls. There exists two-way relationship between information systems and
Audit of environment controls should form a critical part of every IS audit plan. organizations. Information systems must be aligned with the organization to
The IS auditor should satisfy not only the effectiveness of various technical provide useful information to important groups within the organization.
controls but that the overall controls help in safeguarding the business against Similarly, organizations must be aware of and be open to the influences of
environmental risks. Some of the critical audit considerations that an IS auditor information systems in order to take benefit from new information technologies.
should take into account while conducting his audit are given below: This two-way relationship is very complex and is influenced by many mediating
Audit Planning and Assessment: As part of risk assessment: factors, including the organization’s structure, standard operating procedures,
 The risk profile should include the different kinds of environmental risks politics, culture, surrounding environment, and management decisions.
that the organization is exposed to. These should comprise both natural and b) When an online purchase is made, the credit card information is vulnerable to
man-made threats. The profile should be periodically reviewed to ensure interception by network sniffers, software that easily recognize credit card
updating with newer risk that may arise. number formats. Several basic security measures are being used to solve this
security problem: (1) encrypt (code and scramble) the data passing between the
 The controls assessment must ascertain that controls safeguard the
customer and merchant, (2) encrypt the data passing between the customer and
organization against all acceptable risks including probable ones and are in
the company authorizing the credit card transaction. For example, many
place.
companies use the Secure Socket Layer (SSL) that automatically encrypts data
 The security policy of the organization should be reviewed to access policies
passing between your web browser and a merchant's server. However, sensitive
and procedures that safeguard the organization against environmental risks.
information is still vulnerable to misuse once it's decrypted (decoded and
 Building plans and wiring plans need to be reviewed to determine the unscrambled) and stored on a merchant's server, so a digital wallet payment
appropriateness of location of IPF, review of surroundings, power and cable system was developed. In this method, security software add-on modules are
wiring etc. added to web browser. That enables the browser to encrypt credit card data in
 The IS Auditor should interview relevant personnel to satisfy himself about such a way that only the bank that authorizes credit card transactions for the
employees’ awareness of environmental threats and controls, role of the merchant gets to see it. All the merchant is told is whether the credit card
interviewee in environmental control procedures such as prohibited transaction is approved or not. The Secure Electronic Transaction (SET)
activities in IPF, incident handling, and evacuation procedures to determine standard for electronic payment security extends this digital wallet approach. In
if adequate incident reporting procedures exist. this method, software encrypts a digital envelope of digital certificates
 Administrative procedures such as preventive maintenance plans and their specifying the payment details for each transaction.
implementation, incident reporting and handling procedures, inspection and
c) Artificial intelligence (AI) based technologies are being used in a variety of
testing plan and procedures need to be reviewed.
ways to improve the decision support provided to managers and business
professionals in many companies. Al-enabled applications are at work in
information distribution and retrieval, database mining, product design,

© The Institute of Chartered Accountants of Nepal 12 11 © The Institute of Chartered Accountants of Nepal 13 12
CAP III Paper 5: Management Information and Control System CAP III Paper 5: Management Information and Control System
June 2019 June 2019

manufacturing, inspection, training, user support, surgical planning, resource Specific Comments on the performance of the students
scheduling, and resource management. Indeed, for anyone who schedules, Batch: -June 2019
plans, allocates resources, designs new products, uses the Internet, develops Level: - CAP-III
software as well as for anyone responsible for product quality, an investment Paper V: Management Information and Control System
professional, heads IT team or uses of IT, or operates in any of a score of other
capacities and arenas, Al technologies already may be in place and providing Question No. 1
competitive advantage. (a) Answer should have focused on: OOD support code reusability, ease to
d) The audit strategy is a key driver determining the type, scope, and frequency of maintain low coupling, high cohesion can be achieved with considering good
IT audits an organization conducts and defining the criteria organizations use to design patterns.
prioritize the items in the audit universe. Organizations follow procedures in
(b) Answer should focus on: Controls are required to conduct processes, tasks
the audit strategy to assign audit priorities and use those determinations to
allocate internal auditing resources. correctly. Different types of control exist with different objectives. There must
be someone has taken the responsibility of checks process, tasks performed by
An audit strategy sets the direction, timing, and scope of an audit. The
strategy is then used as a guideline when developing an audit plan. The subordinates, that someone must have knowledge about controls and
strategy document usually includes a statement of the key decisions needed consequences of not abiding processes tasks with specified controls, rules &
to properly plan the audit. The audit strategy is based on the following regulations.
considerations:
 The characteristics of the engagement Question No. 2
 Reporting objectives Students have not answered in specific way. Some students have written answers
 Timing of the audit in general and purely in management point of view.
 Nature of communications
 Significant factors in directing engagement team efforts
Question No. 3
 The results of preliminary engagement activities
 The knowledge gained on other engagements Most of the students have not answered question no.3 (a) properly. Answer to
 The nature, timing, and extent of resources available for the engagement question no. (3b) have written well.
The audit strategy could be relatively short for the audit of a smaller entity,
perhaps in the form of a brief memo. If there are unexpected chan ges in Question No. 4
conditions or the outcome of audit procedures, it may be necessary to alter (a) Students are required to focus on specific area on the CRM features and
the audit strategy. If there is an alteration, the reasons for the alteration modules. Further, use of cases and examples in the answer would have been
should be stated in the accompanying documentation.
better.
The audit plan is much more detailed than the strategy document, since the
plan states the nature, timing, and extent of the specific audit procedures to (b) NDA and its implication on both sides of bank and consultants can be covered.
be conducted by the audit team. Copy right, IDR and software are to be included in the answer.
e) Business Continuity Planning (BCP) relates to the detailed plan prepared to
make sure the business processes and systems continue operating in the event of Question No. 5
a disaster. This creates a detailed plan along with recovery procedures, roles, Q 5(a) The answer of this question was not given in proper way. Most of the students have
responsibilities and stepwise plan of action to restore the systems and services written introduction of cloud computing only. They were lacking knowledge on cloud
in the event of a natural or man-made disaster affecting normal system service model.
operation. Q 5(b). Answers given by the students were satisfactory.
A well-crafted BCP is important because it can act as a guiding document for
the management and IT team of the organization to restore the services, recover Question No. 6
data and in the event of that taking longer time, to follow an alternate course of (a) Most of the students were lacking clear concept of the subject.
action so that business processes continue to function. This tells how to recover (b) Students have explained electronic payment but they have not explained
services, restore data and whom to involve or resort to in case of an emergency. about secure electronic payments technique.
Not having this plan can lead to chaos, data loss, mismanagement and loss of (c) , (d), (e) –Most of the students have answered well.
credibility in the face of a major outage caused by a disaster or any other
circumstance.

© The Institute of Chartered Accountants of Nepal 14 13 © The Institute of Chartered Accountants of Nepal 15 14
 December 2019 December 2019
Suggested Answer Paper Group II Suggested Answer Paper Group II

Paper 5: Management Information and Control System system analyst should also review all online and offline files which are maintained in the
organization as these will reveal information about data that are not contained in any
Attempt all questions. output. The related cost of retrieving and processing data is another important factor that
1. ABC Hotel, situated at the prime location of the capital city, is offering hospitality services should be considered by the system analyst.
to its guests since last 8 years. It relies heavily on its existing information system to provide Review methods, procedures and data communications: Methods and procedures
up to date information. The company wishes to enhance its existing system by upgrading
transform input data into useful output. A method is defined as a way of doing something;
or developing entirely new system.
a procedure is a series of logical steps by which a job is accomplished. A procedure's review
a) You being an IT consultant, suggest how the audit of the present information system is an intensive survey of the methods by which each job is accomplished, the equipment
should be conducted so that it can be further improved upon. utilized and the actual location of the operations. Its basic objective is to eliminate
(10 marks) unnecessary tasks or to perceive improvement opportunities in the present information
system. A system analyst also needs to review and understand the present data
b) As an IT consultant you have to explain to the management the prototyping approaches
to systems development. Now, write a short note on prototyping approaches to systems communications used by the organization. He must review the types of data
development. Describe its advantages and disadvantages also. (5+5=10 marks) communication equipment including data interface, data links, modems, dialup and leased
lines and multiplexers. The system analyst must understand how the data communications
Answer network is used in the present system so as to identify the need to revamp the network
(a) Detailed investigation of the present system involves collecting, organizing and evaluating when the new system is installed.
facts about the system and the environment in which it operates. Enough information
Analyse outputs: The outputs or reports should be scrutinized carefully by the system
should be assembled so that a qualified person can understand the present system without
visiting any of the operating departments. Review of existing methods, procedures, data analysts in order to determine how well they will meet the organization’s needs. The
flow, outputs, files, inputs and internal controls should be intensive in order to fully analysts must understand what information is needed and why, who needs it and when and
understand the present system and its related problems. where it is needed. Additional questions concerning the sequence of the data, how often
the form reporting is used, how long it is kept on file, etc. must be investigated. Often many
The following areas may be studied in depth:
reports are a carryover from earlier days and have little relevance to current operations.
Review historical aspects: A brief history of the organization is a logical starting point for Attempt should be made to eliminate all such reports in the new system.
the analysis of the present system. The historical facts should identify the major turning
Review internal controls: A detailed investigation of the present information system is
points and milestones that have influenced its growth. A review of annual reports can
not complete until internal controls are reviewed. Locating the control points helps the
provide an excellent historical perspective. A historical review of the organization chart
analyst to visualize the essential parts and framework of a system. An examination of the
can identify the growth of management levels as well as the development of various
present system of internal control may indicate weaknesses that should be removed in the
functional areas and departments. The system analyst should identify what system changes
new system. The adoption of advanced methods, procedures and equipment might allow
have occurred in the past. These should include operations that have been successful or
much greater control over the data.
unsuccessful with computer equipment and techniques.
Model the existing physical system and logical system: As the logic of inputs, methods,
Analyse inputs: A detailed analysis of present inputs is important since they are basic to
procedures, data files, data communications, reports, internal control and other important
the manipulation of data. Source documents are used to capture the originating data for any
items are reviewed and analysed in a top down manner, the process must be properly
type of system. The system analyst should be aware of the various sources from where data
documented. The logical flow of the present information system may be depicted with the
can be initially captured, keeping in view the fact that outputs for one area may serve as an
help of system flow charts. The physical flow of the existing system may be shown by
input for another area. The system analyst must understand the nature of each form, what
employing data flow diagrams. During the process of developing the data flow diagram,
is contained in it, who prepared it, from where the form is initiated, where it is completed,
work on data dictionary for the new information system should be begun. The data
the distribution of the form and other similar considerations. If the analyst investigates
elements needed in the new system will often be found in the present system. Hence, it is
these questions thoroughly, he will be able to determine how these inputs fit into the
wise to start the development of the data dictionary as early as possible.
framework of the present system.
The flow charting and diagramming of present information not only organizes the facts,
Review data files maintained: The analyst should investigate the data files maintained by
but also helps disclose gaps and duplication in the data gathered. It allows a thorough
each department, noting their number and size, where they are located, who uses them and
comprehension of the numerous details and related problems in the present operation.
the number of times per given time interval these are used. Information on common data
files and their size will be an important factor, which will influence the new information
system. This information may be contained in the systems and procedures manuals. The

© The Institute of Chartered Accountants of Nepal 2 © The Institute of Chartered Accountants of Nepal 3

15 16
 December 2019 December 2019
Suggested Answer Paper Group II Suggested Answer Paper Group II

Undertake overall analysis of present system: Based upon the aforesaid investigation of 1. Prototyping requires intensive involvement by the system users. Therefore, it typically
the present information system, the final phase of the detailed investigation includes the results in a better definition of the users’ needs and requirements than does the traditional
analysis of: system development approach.
• the present work volume 2. A very short time period (e.g., a week) is normally required to develop and start
experimenting with a prototype. This short time period allows system users to immediately
• the current personnel requirements
evaluate proposed system changes.
• the present benefits and costs
3. Since system users experiment with each version of the prototype through an interactive
Each of these must be investigated thoroughly. process, errors are hopefully detected and eliminated early in the development process. As
(b) Prototyping approaches: a result, the information system ultimately implemented should be more reliable and less
costly to develop than when the traditional systems development approach is employed.
Prototyping technique is used to develop smaller systems such as decision support systems,
management information systems and expert systems. The goal of prototyping approach is to Disadvantages of Prototyping
develop a small or pilot version called a prototype of part or all of a system. A prototype is a
1. Prototyping can only be successful if the system users are willing to devote significant
usable system or system component that is built quickly and at a lower cost, and with the
time in experimenting with the prototype and provide the system developers with change
intention of being modifying or replacing it by a full scale and fully operational system. Finally,
suggestions.
when a prototype is developed that satisfies all user requirements, either it is refined and turned
into the final system or it is scrapped. If it is scrapped, the knowledge gained from building the 2. The interactive process of prototyping causes the prototype to be experimented with quite
prototype is used to develop the real system. extensively. Because of this, the system developers are frequently tempted to minimize
the testing and documentation process of the ultimately approved information system.
Prototyping can be viewed as a series of four steps:
Inadequate testing can make the approved system error-prone, and inadequate
Step 1: Identify Information System Requirements: documentation make this system difficult to maintain.
In traditional approach, the system requirements have to be identified before the development 3. Prototyping may cause behavioural problems with system users. These problems include
process starts. However, under prototyping, the process of determining them can be less formal dissatisfaction by users if system developers are unable to meet all user demands for
and time-consuming than when performing traditional systems analysis. improvements as well as dissatisfaction and impatience by user when they have to go
through too many interactions of the prototype.
Step 2: Develop the Initial Prototype:
2. Nepal Government is going to implement online e-Services to citizen. The Government
In this step, the designers create an initial base model, for example, using fourth-generation needs to develop and implement disaster recovery plan and business continuity plan (BCP)
programming languages or CASE tools. The main goal of this stage is ‘rapid development’ and for disaster recovery center. You are hired as the ICT expert for this project. Based on the
‘low cost’. above scenario, answer the following questions:
Step 3: Test and Revise: a) Discuss the recovery plan for these e-Services. (7 marks)
After finishing the initial prototype, the designers first demonstrate the model to users for b) What steps of review & testing of existing system would you undertake before designing
experiment. At the outset, users must be told that the prototype is incomplete and requires the DR and BC plan? (7 marks)
subsequent modifications based on their feedback. Thus, the designers ask users to record their c) Discuss the best approach for business continuity plan. (6 marks)
likes and dislikes about the system and recommend changes. Using this feedback, the design Answer
team modifies the prototype as necessary and then resubmits the revised model to system user
for re-evaluation. Thus interactive process of modification and re-evaluation continues until (a) A disaster recovery plan is a method of restoring information processing operations
the users are satisfied commonly, through four to six interactions. which have been halted by disaster or accident. It includes a list of all business functions
and the hardware, software, data and people to support those functions. It includes
Step 4: Obtain User Signoff of the Approved Prototype: arrangement for alternate locations which may be either hot sites or cold sites. The plan
also includes ways for backing up and storing programs and data in another location,
At the end of Step 3, users formally approve the final version of the prototype, which commits ways of arranging necessary personnel and training for those personnel. Since many
them to the current design and establishes a contractual obligation about what the system will, mission-critical and critical business processes depend on a technology infrastructure
and will not do or provide. consisting of applications, data, and IT hardware, the DRP should be an IT focused plan.
Advantages of Prototyping Every government organization should develop a Disaster Recovery Plan for all
applications. The decision to revert to manual procedures, rather than to build and

© The Institute of Chartered Accountants of Nepal 4 © The Institute of Chartered Accountants of Nepal 5

17 18
 December 2019 December 2019
Suggested Answer Paper Group II Suggested Answer Paper Group II

maintain an IT infrastructure is a cost-driven decision made by the organization. Having A business continuity plan involves the following:
a DRP in place reduces the risk and ensures the length of time that a disruption in a
business process does not go beyond what has been determined to be acceptable by • Analysis of organizational threats
management in the organization. • A list of the primary tasks required to keep the organization operations flowing
An effective DR plan should include the following elements: • Easily located management contact information
• Emergency plan • Explanation of where personnel should go if there is a disastrous event
• Recovery plan • Information on data backups and organization site backup
• Backup plan • Collaboration among all facets of the organization
• Test plan • Buy from everyone in the organization
(b) Development of the disaster recovery (DR) and business continuity (BC) plan of an 3.
information system is essential to make sure that the services and functionalities are
(a) What is information system? Explain business perspective of information system in
available in the face of an unwanted occurrence of system outage due to man-made or
detail. (2 + 6 = 8 marks)
natural causes.
(b) Explain decision support system with example. What are the goals and applications of
Since the requirement is to create a DR and BC plan for the existing system, detailed
this system in business and industry? Compare decision support system with executive
study and testing of the system is useful in creating a good DR & BC plan. I would carry
support system. (3 + 2 + 2 = 7 marks)
out the following testing and detailed study to have an idea about the existing system in
the context of the DR & BC mechanism: Answer

1. The architecture of the system deployment in terms of hardware and network. (a) First Part: An information system can be defined as a set of interrelated components
that collect (or retrieve), process, store, and distribute information to support decision
2. Power provisioning of the system in existing location and requirement for making, coordination and control in an organization. In addition, information systems
enhancing the power redundancy. may also help managers and workers analyse problems, visualize complex subjects, and
3. Location of the system to make sure that the DR mechanism caters for issues such create new products. Information systems contain information about people, places, and
as seismic zones, disaster-prone areas and other risks such as fire, flooding, etc. things within the organization or in the environment surrounding it to help organizations
in different activities.
4. The features and functions of the system and their criticality to the functioning of
the organization and its services. More critical functions and services may need Second Part: Firms invest in information technology and systems because they provide
better activities in data backup, restoration, security hardening, etc. real economic value to the business. The return on this investment will be superior to
other investments and will be expressed as increase in productivity, revenues, and long
5. User management of the system and the awareness of the users regarding system
term strategic position. Information system is an important instrument for creating value
security. Internal users can knowingly and unknowingly cause system
disruptions. Proper knowledge of the system users and their activities helps in for the firm. Information systems enable the firm to increase its revenue or decrease its
preparing a good security and recovery plan.
6. The network layout of the system and its state of exposure to external
environment. This helps in hardening the existing deployment and creation of a
properly designed high-availability mechanism based in network redundancy and
security.
7. The detailed recovery plan of the current system and the areas in which it can be
improved and strengthened. A well-articulated and well-designed recovery plan
helps in quick restoration of system and services in case of an incidence of
disruption.
(c) A business continuity plan (BCP) is a plan to help ensure that business processes can
continue during a time of emergency or disaster. Such emergencies or disasters might
include a fire or any other case where business is not able to occur under normal
conditions. Businesses need to look at all such potential threats and devise BCPs to
ensure continued operations should the threat become a reality.

© The Institute of Chartered Accountants of Nepal 6 © The Institute of Chartered Accountants of Nepal 7

19 20
 December 2019 December 2019
Suggested Answer Paper Group II Suggested Answer Paper Group II

costs by providing information that helps managers make better decisions or that can also be used for sales optimization, sales projection, and financial projections
improves the execution of business processes. Information systems are also required to necessary for determining expenditures and revenues.
cope with governmental regulations or other environmental demands, and in some cases, Third Part:
they are required to stay in business. Every business has an information value chain,
Decision support system (DSS) allows senior managers to take non-routine decisions
in which raw information is systematically acquired and then transformed through
while the executive support system (ESS) allows senior managers to take decisions to
various stages that add value to that information. From a business perspective,
meet the strategic goals of the organization. DSS is designed to help managers come up
information systems are part of a series of value-adding activities for acquiring, with solutions to problems on the basis of a database or knowledge base whereas ESS is
transforming, and distributing information that managers can use to improve decision executive support system that presents summarized information that is used by
making, enhance organizational performance, and, ultimately, increase firm's executives to come up with best possible solution to problems with the help of their
profitability. education, experience and business environment that they face.
(b) First Part: DSS uses mathematical models and statistical techniques to support decision making.
ESS is easier for upper-level executives to use and take decisions. It helps to monitor the
Decision Support Systems (DSS) are the information systems that support non-routine
company performance and examine the critical success factors. It also allows analysing
decision making for middle level management in organizations. They focus on problems
trends and determines the competitiveness in the market. Moreover, it improves
that are unique and rapidly changing, for which the procedure for arriving at a solution
flexibility, strategic control, improves communication and provides time management.
may not be fully predefined in advance. These systems use internal information from
ESS also provides excellent reporting facilities.
transaction processing system (TPS) and management information system (MIS), and
often information from external sources, such as current stock prices or product prices 4.
of competitors. These systems use a variety of models to analyse data, or they condense a) Explain the functions, duties and power of the controller mention in the Electronic
large amounts of data into a form in which decision makers can analyse them. DSS are Transaction Act. (8 marks)
also called business intelligence systems because they focus on helping users make
better business decisions. b) Discuss the opportunity and challenges of implementing Enterprise Resource Planning.
(7 marks)
For example, a national level online book seller wants to begin selling its products
internationally but first needs to determine if that will be a wise business decision. The Answer
vendor can use a DSS to gather information from its own resources (using a tool such
a) The functions, duties and powers of the Controller shall be as follows:
as online analytical processing (OLAP)) to determine if the company has the ability or
potential ability to expand its business and also from external resources, such as industry • To monitor, cause to be monitored the functions performed by the Certifying
data, to determine if there is indeed a demand to meet. The DSS will collect and analyse Authority;
the data and then present it in a way that can be interpreted by humans.
• To carry out necessary supervision in relation to the matter as to whether or not the
Second Part: Certifying Authority has performed the duties as referred to in the license , and, if
The primary goal of using a DSS is to present information to the customer in an easy- it is not found to have been performed, cause it to be done accordingly;
to-understand way. A DSS system is beneficial because it can be programmed to • To specify the quality standard of service to be rendered by the Certifying
generate many types of reports, all based on user specifications. For example, the DSS Authority;
can generate information and output its information graphically, as in a bar chart that
represents projected revenue or as a written report. The flexibility of the DSS is • To specify the terms required to be specified at the time of issuance of a license to
extremely beneficial for users who travel frequently. This gives them the opportunity to the Certifying Authority
be well-informed at all times, providing the ability to make the best decisions for their • To appoint an auditor as per necessity;
company and customers on the go or even on the spot.
• To monitor the functions and activities to be performed by the Auditor;
DSS has lots of applications in business and industry and is getting a lot of attention as
a way to promote better projections, management and analysis within a company. DSS • To perform such other functions as may be specified by Government of Nepal
is extensively used in business and management. Executive dashboard and other from time to time;
business performance software allow faster decision making, identification of negative • To perform such other functions as may be required to implement the objectives of
trends, and better allocation of business resources. Due to DSS all the information from the Act and these Rules.
any organization is represented in the form of charts, graphs, i.e., in a summarized way,
b) An enterprise resource planning is a fully integrated business management system
which helps the management to take strategic decisions.
covering functional areas of an enterprise like logistics, production, finance, accounting
DSS can be used to manage inventory, where decision support system applications can and human resources, etc.
provide guidance on establishing supply chain movement that works for a business. It
The benefits of using ERP are:

© The Institute of Chartered Accountants of Nepal 8 © The Institute of Chartered Accountants of Nepal 9

21 22
 December 2019 December 2019
Suggested Answer Paper Group II Suggested Answer Paper Group II

• It provides the control of invoicing and payments process to the account payable c. You can shop anywhere in the World
personnel.
d. Easy access 24 hours a day
• It reduces the paper documents by providing online formats for quickly entering
and retrieving information. e. Wide selection to cater for all consumers
• Improves timeliness of information by permitting posting daily instead of monthly f. No hassle of transport/ leave from work place to do shopping
• Greater accuracy of information with detailed content, better presentation, g. You feel that you are in a one-stop shop for every thing
satisfactory for the auditors.
(ii) Disadvantages
• Improved cost control.
a. Unable to examine products personally
• Faster response and follow-up on customers.
b. Not every one is connected to the internet
• More efficient cash collection.
• Better monitoring and quicker resolution of queries. c. There is a probability of credit card frauds

• Enables quick response to change in business operations and market conditions. d. On average only 1/9th of stock is available on the stock
• Helps to achieve competitive advantage by improving its business processes. e. Return/Exchange of goods (not in correct size, etc.) will be very difficult and
• Provides a unified customer database usable by all applications. costly.

The challenges of implementing ERP can be listed as: f. Cannot negotiate the price.

• Not properly understanding the complexity of planning, development and training (b) First Part:
that needed to properly implement ERP package. Business-IT alignment is a process in which a business organization uses information
• Human reluctance to use new system technology (IT) to achieve business objectives - typically improved financial
performance or marketplace competitiveness. Alignment is the capacity to demonstrate
• Cost factors associated with the system reengineering and data conversions. a positive relationship between information technologies and the accepted
• High dependency on the Information Technology by completely giving up the financial measures of performance.
existing system. This alignment is to what is often experienced in organizations: IT and business
5. professionals are unable to bridge the gap between themselves because of differences in
objectives, culture, and incentives and a mutual ignorance for the other group's body of
a) What is Business-to-Consumer e-Commerce (B2C)? List and explain briefly the knowledge. This rift generally results in expensive IT systems that do not provide
advantages and disadvantages to customers (buyers) in using the e-Commerce. adequate return on investment. For this reason, the search for business-IT alignment is
(2+5=7 marks) closely associated with attempts to improve the business value of IT investments.
b) How do you align your business with information technology? What are the risks and Business-IT alignment integrates the information technology to the strategy, mission,
opportunities of using information technology in organizations? (4 + 4 = 8 marks) and goals of the organization. Key characteristics in order to achieve this alignment are:
Answer
• The organization must view information technology as an instrument to transform
(a) Business-to-Consumer (B2C) e-Commerce involves retailing products and services to the business. This includes exploring other revenue streams and integrating other
individual consumers. Using the Internet, the user orders products or services through facets of their business into each other.
the website or mobile app. Payments made through valid Credit Cards or Debit Cards • An organization must hold customer service, both externally and internally, at the
or mobile banking or internet banking or other popular e-payment apps such as eSewa, utmost importance. Communication between the organization and their customers
iPay, etc. Nowadays, payment on delivery option is also available. must not be lost.
Following are the advantages and disadvantages to customers (buyers) in using the • An organization must rotate both IT and business professionals across different
above e-Commerce. departments and job functions. They must have the knowledge and experience of
(i) Advantages both sides of the business so that understanding and communication is achieved.
• An organization must provide clear and specific goals to both the IT and business
a. No checkout queues
employees. This will create the integration of both entities to achieve a common
b. Reduced prices goal.

© The Institute of Chartered Accountants of Nepal 10 © The Institute of Chartered Accountants of Nepal 11

23 24
 December 2019 December 2019
Suggested Answer Paper Group II Suggested Answer Paper Group II

• Ensure that IT and business employees understand how the company makes or loses communication and relationships between different countries, languages and
money. This is important so that money is not carelessly poured into the IT cultures becomes much easier.
department and there is no return on that investment.
• Availability
• Organizations must create a vibrant and inclusive company culture. There must not Information systems have made it possible for businesses to be open 24×7 all over
only be informational unity, but a company as whole. the globe. This means that a business can be open anytime anywhere, making
Second Part: purchases from different countries easier and more convenient. It also means that
you can have your goods delivered right to your doorstep without having to move
Information technology (IT) plays a critical role in many businesses. If you own or a single muscle.
manage a business that makes use of IT, it is important to identify risks to your IT
systems and data, to reduce or manage those risks, and to develop a response plan in • Creation of new types of jobs
the event of an IT crisis. Some of the common risks of using IT are: One of the best advantages of information systems is the creation of new and
interesting jobs. Computer programmers, Systems analysers, Hardware and
• Unemployment and lack of job security Software developers and Web designers are just some of the many new employment
Implementing information technology can save a great deal of time during the opportunities created with the help of IT.
completion of tasks and some labour mechanic works. Most paperwork can be • Cost effectiveness and productivity
processed immediately and financial transactions are automatically calculated. As
technology improves, tasks that were formerly performed by human employees are IT applications promote more efficient operation of the company and also improve
now carried out by computer systems. Industry experts believe that the internet has the supply of information to decision makers. These systems also help companies
made job security a big issue as since technology keeps on changing with each day. to gain a competitive advantage. It has a positive impact on productivity
This means that one has to be in a constant learning mode, if he or she wishes for 6. Write short notes on: (5 3=15 marks)
their job to be secure.
(a) Fuzzy logic
• Dominant culture
(b) COBIT
While information technology may have made the world a global village, it has also
contributed to one culture dominating another weaker one. (c) Virtualization
(d) Information system vulnerabilities
• Security issues
(e) Sales force automation
Thieves and hackers get access to identities and corporate saboteurs target sensitive
company data. Such data can include vendor information, bank records, intellectual Answer
property and personal data on company management. The hackers distribute the
information over the Internet, sell it to rival companies or use it to damage the (a) Fuzzy Logic resembles the human decision-making methodology. It deals with vague
company’s image. and imprecise information, i.e., it describes the degree of truth or falsehood instead of
absolute truth or falsehood. This is over-simplification of the real-world problems and
• Implementation expenses based on degrees of truth rather than usual true/false or 1/0 like Boolean logic. In fuzzy
To integrate the information system it require pretty good amount of money in systems, the values are indicated by a number in the range from 0 to 1.
software, hardware and people. Software, hardware and some other services should Some of the applications of Fuzzy logic in business can be listed as below:
be rented, bought and supported. Employees need to be trained with unfamiliar
information technology and software. • Complex decision making where the input parameters are not blurry
Information technology contributes to the efficient running of organizations. • Stock market analysis and prediction
Information systems are showing the exponential growth in each decade. Some of the • Process optimization in manufacturing industry
common opportunities are:
• Performance appraisal of staff members
• Communication
• Insurance industry for the risk management.
With help of information technologies the instant messaging, emails, voice and
video calls becomes quicker, cheaper and much efficient. • Customer segmentation in banks
(b) COBIT stands for Control Objectives for Information and Related Technology. It is a
• Globalization and cultural gap
framework created by the ISACA (Information Systems Audit and Control
By implementing information systems we can bring down the linguistic, Association) for IT governance and management. It was designed to be a supportive
geographical and some cultural boundaries. Sharing the information, knowledge,

© The Institute of Chartered Accountants of Nepal 12 © The Institute of Chartered Accountants of Nepal 13

25 26
 December 2019 December 2020
Suggested Answer Paper Group II
Paper-5: Management Information and Control System

tool for managers and allows bridging the crucial gap between technical issues, Attempt all questions.
business risks, and control requirements. COBIT is a thoroughly recognized guideline Use separate answer book for each question.
that can be applied to any organization in any industry. Overall, COBIT ensures quality,
control, and reliability of information systems in an organization, which is also the most 1. Assume that you are working as a project manager to develop an information system for a
important aspect of every modern business. company and you chose Joint Application Development (JAD) approach to determine
requirements for the system from users and managers of the company. Based on this
The COBIT business orientation includes linking business goals with its IT scenario, answer the following questions.
infrastructure by providing various maturity models and metrics that measure the
achievement while identifying associated business responsibilities of IT processes. a) Explain JAD session along with its participants. What are the benefits of using JAD?
(7+3=10 marks)
Today, COBIT is used globally by all IT business process managers to equip them with
a model to deliver value to the organization, and practice better risk management b) What is information system audit? Explain phases you use to audit the information
practices associated with the IT processes. The COBIT control model guarantees the system used in the company. (2+8=10 marks)
integrity of the information system. Answer
(c) Virtualization refers to the creation of a virtual resource such as a server, desktop, a) First Part: Joint Application Development (JAD) started in the late 1970s at IBM, and
operating system, file, storage or network. The main goal of virtualization is to manage since then the practice of JAD has spread throughout many companies and industries.
workloads by radically transforming traditional computing to make it more scalable. The main idea behind JAD is to bring together the key users, managers, and systems
Virtualization has been a part of the IT landscape for decades now, and today it can be analysts involved in the analysis of a current system. The primary purpose of using JAD
applied to a wide range of system layers, including operating system-level is to collect systems requirements simultaneously from the key people involved with the
virtualization, hardware-level virtualization and server virtualization. system. As with a group interview, having all the key people together in one place at one
time allows analysts to see where there are areas of agreement and where there are
Virtualization can be categorized into different layers: desktop, server, file, storage and conflicts. Meeting with all of these important people for over a week of intense sessions
network. Each layer of virtualization has its own set of advantages and complexities. allows you the opportunity to resolve conflicts, or at least to understand why a conflict
The technology offers many benefits, including low or no-cost deployment, full may not be simple to resolve.
resource utilization, operational cost savings and power savings. However, deploying
virtualization technology requires careful planning and skilled technical experts. Since JAD sessions are usually conducted at a location other than the place where the people
the virtual machines use the same resources to run, it may lead to slow performance. involved normally work. The idea behind such a practice is to keep participants away
from as many distractions as possible so that they can concentrate on systems analysis. A
(d) In the context of computerized information system, a vulnerability is a weakness that JAD may last anywhere from four hours to an entire week and may consist of several
can be exploited by an attacker, intruder or abuser of the system to gain an unauthorized sessions. A JAD employs large amount of corporate resources, the most expensive of
access and compromise the system security. To carry out such attack or compromise, which is the time of the people involved. Other expenses include the costs associated
the attacker must have a prior knowledge of the vulnerability. Such knowledge can be with flying people to a remote site and putting them up in hotels and feeding them for
obtained by the published sources or by using different tools that can test the various several days. The typical participants in a JAD are listed below:
potential weak spots of the system and find out the exploitable one. Once the weakness
is known the system attacker should also have the tools or means to exploit the  JAD session leader – The JAD session leader organizes and runs the JAD. The JAD
vulnerability. It is analogous to a house intruder first finding out the weak spot or the leader sets the agenda and sees that it is met; he or she remains neutral on issues and
unguarded state of the house before using the suitable tool to break into it. Tools can does not contribute ideas or opinions, but rather concentrates on keeping the group on
be different based on the nature of the vulnerability. System hardening is a regular the agenda, resolving conflicts and disagreements, and soliciting all ideas.
process of finding such vulnerabilities and patching them up.  Users – The key users of the system under consideration are vital participants in a
(e) Sales force automation (abbreviated SFA) is a technique of using software to automate JAD. They are the only ones who have a clear understanding of what it means to use
the business tasks of sales, including order processing, contact management, the system on a daily basis.
information sharing, inventory monitoring and control, order tracking, customer
 Managers – Managers of the work groups who use the system in question provide
management, sales forecast analysis and employee performance evaluation. SFA is
insight into new organizational directions, motivations for and organizational impacts
often used interchangeably with customer relationship management (CRM); however,
of systems, and support for requirements determined during the JAD.
CRM does not necessarily imply automation of sales tasks.
 Sponsor – JAD must be sponsored by someone at a relatively high level in the
SFA also refers to software apps for sales management. SFA provides automated
company. If the sponsor attends any sessions, it is usually only at the very beginning
workflows that create a streamlined sales process to manage business leads, sales
or the end.
forecasts and team performance.
 Systems analysts – Members of the systems analysis team attend the JAD, although
their actual participation may be limited. Analysts are there to learn from users and
managers, not to run or dominate the process.

© The Institute of Chartered Accountants of Nepal 14

27 28
 December 2020 December 2020

 Scribe – The scribe takes notes during the JAD sessions usually using laptop, word 3. Accountability: The Audit Charter should clearly define reporting lines,
processor. Notes and diagrams may be entered directly into a CASE tool. appraisals, assessment of compliance and agreed actions.
 IS staff – Besides systems analysts, other information systems (IS) staff may attend to The Audit Charter should be approved and agreed upon by an appropriate level within the
learn from the discussion and possibly contribute their ideas on the technical Client’s Organization.
feasibility of proposed ideas or the technical limitations of current systems. In addition to the Audit Charter, we should be able to obtain a written representation
JAD sessions are usually held in special-purpose rooms where participants sit around (“Letter of Representation”) from the Client’s Management acknowledging:
tables. These rooms are typically equipped with whiteboards. Other audiovisual tools 1. Their responsibility for the design and implementation of the Internal Control
may be used, flip charts, and computer-generated displays. Computers may be used to Systems affecting the IT Systems and processes
create and display form or report designs, diagram existing or replacement systems, or
create prototypes. 2. Their willingness to disclose to the Information Systems Auditor their knowledge
of irregularities and/or illegal acts affecting their organization pertaining to
When a JAD is completed, the end result is a set of documents that detail the workings of management and employees with significant roles within the internal audit
the current system related to the study of a replacement system. department.
Second Part: The benefits of using JAD are as follows: 3. Their willingness to disclose to the IS Auditor the results of any risk assessment
 Offers a great communication among all the users of the system that a material misstatement may have occurred
 JAD allows you to resolve difficulties more simply and produce better, error-free  Risk Assessment and Business Process Analysis: Risk is the possibility of an act or
software event occurring that would have an adverse effect on the organization and its
information systems. Risk can also be the potential that a given threat will exploit
 The joint collaboration between the company and the clients lowers all risks vulnerabilities of an asset or group of assets to cause loss of, or damage to, the assets.
 JAD reduces costs and time needed for project development It is ordinarily measured by a combination of effect and likelihood of occurrence.
 Well-defined requirements improve system quality More and more organizations are moving to a risk-based audit approach that can be
adapted to develop and improve the continuous audit process. This approach is used
 Due to the close communication, progress is faster to assess risk and to assist an IS auditor’s decision to do either compliance testing or
 JAD encourages the team to push each other to work faster and deliver on time substantive testing. In a risk based audit approach, IS auditors are not just relying on
risk. They are also relying on internal and operational controls as well as knowledge
b) First Part: The effectiveness of an information system’s controls is evaluated through an of the organization. This type of risk assessment decision can help relate the
information systems audit. An audit aims to establish whether information systems are cost/benefit analysis of the control to the known risk, allowing practical choices.
safeguarding corporate assets, maintaining the integrity of stored and communicated data,
supporting corporate objectives effectively, and operating efficiently. These reviews may The process of quantifying risk is called Risk Assessment. Risk Assessment is useful
be performed in conjunction with a financial statement audit, internal audit, or other form in making decisions such as:
of attestation engagement. These audits are also known as "automated data processing 1. The area/business function to be audited
(ADP) audits" and "computer audits". They were formerly called "electronic data
processing (EDP) audits". The purposes of an IT audit are to evaluate the system's 2. The nature, extent and timing of audit procedures
internal control design and effectiveness. 3. The amount of resources to be allocated to an audit
Second Part: There are four phases in information systems audit: audit planning, risk  Performance of Audit Work: In the performance of Audit Work the Information
assessment and business process analysis, performance of audit work, and reporting. Systems Audit Standards require us to provide supervision, gather audit evidence and
 Audit Planning: In this phase we plan the information system coverage to comply document our audit work. We achieve this objective through:
with the audit objectives specified by the Client and ensure compliance to all Laws 1. Establishing an Internal Review Process where the work of one person is
and Professional Standards. The first thing is to obtain an Audit Charter from the reviewed by another, preferably a more senior person.
Client detailing the purpose of the audit, the management responsibility, authority and
2. We obtain sufficient, reliable and relevant evidence to be obtained through
accountability of the Information Systems Audit function as follows:
Inspection, Observation, Inquiry, Confirmation and recomputation of calculations
1. Responsibility: The Audit Charter should define the mission, aims, goals and
3. We document our work by describing audit work done and audit evidence
objectives of the Information System Audit. At this stage we also define the Key
gathered to support the auditors’ findings.
Performance Indicators and an Audit Evaluation process;
Based on our risk assessment and upon the identification of the risky areas, we move
2. Authority: The Audit Charter should clearly specify the Authority assigned to the
ahead to develop an Audit Plan and Audit Program. The Audit Plan will detail the
Information Systems Auditors with relation to the Risk Assessment work that will
nature, objectives, timing and the extent of the resources required in the audit.
be carried out, right to access the Client’s information, the scope and/or
limitations to the scope, the Client’s functions to be audited and the auditee
expectations; and

29 30
 December 2020 December 2020

Based on the compliance testing carried out in the prior phase, we develop an audit  The system needs to be upgraded to eradicate the errors and bugs and vulnerability in
program detailing the nature, timing and extent of the audit procedures. In the Audit the existing system.
Plan various Control Tests and Reviews can be done. They are sub-divided into:
 Recommendation from the ICT System Audit: Bank might have been carrying
1. General/ Pervasive Controls periodical ICT system Audit. There must be recommendation from the audit
2. Specific Controls regarding the upgradation or amendment of the system.

 Reporting: Upon the performance of the audit test, the Information Systems Auditor  Compatibility with the new devices: When current system was developed on 2005,
is required to produce and appropriate report communicating the results of the IS the mobile banking was limited to the text-based services. However now the banking
Audit. An IS Audit report should: is fully on mobile Apps. So, for the compatibility with the mobile system it also needs
to be upgraded.
1. Identify an organization, intended recipients and any restrictions on circulation
 Interconnection with others: The banking system now cannot operate in isolation. It
2. State the scope, objectives, period of coverage, nature, timing and the extend of has to be interconnected with other banks, mobile Apps, payment gateway service
the audit work providers and client’s system as well. But with the continuation of the older system
3. State findings, conclusions, recommendations and any reservations, qualifications there might be difficulties in the interconnection.
and limitations b) The upgradation of the existing system to new system which might be completely
4. Provide audit evidence different, or integration of new modules to the existing system will surely have certain
challenges. These challenges might be technical and financial, and some might be related
2. The core banking system of NPB Bank was developed in 2005 by an IT company. Same
with the human behaviors. The possible hurdles in the context of NPB Bank can be listed
system has been in operation since last 15 years. Now two departments of the Bank:
as:
operation and IT want to upgrade the Core Banking System. In this situation, answer the
following question: Technical Issues and Infrastructure:
a) What are the parameters/criteria that have to be analyzed while recommending the Here the technical issues and infrastructure is relating with the hardware, software and
upgradation of the system to Board? 7 marks networking all. The proposed hardware and networking equipment are available in the
market or not, the cost associated with them, replacement of the existing system or
b) What are the possible hurdles for the upgradation 7 marks
parallel operation are some of the concerns associated. How the integration of software
c) What will be the plan to ensure the business continuity? 6 marks will be handled and how the changeover will be managed are few concerns associated
with it.
Answer
Economical and financial:
a) Yes, it is very true that no system is forever, same also applies with the above-mentioned
case of NPB Bank. Either it has to be upgraded or modified or changed during the course There should be clear evaluation of the financial benefit of the new system. The outcome
of implementation based upon various conditions. Before making the decision of the of the proposed system should surpass the short-term investment. This will be a
change or upgrade or modification of the system, following points challenging issue to convince the top-level management to persuade for the upgradation.
(parameters/conditions) have to be analyzed properly by the Operation and IT Change Management Leadership:
Department together:
If the Change Management is under the good leadership, the process will be easier
 The operational outcome of the system: As the bank has been using same system otherwise it will be a herculean task. The good leader can drive the process by bringing
since last 15 years there is many congestions and insufficiency in the system from all people together with proper communication of strategic objective. However, this
today's prospects. Some of them can be listed as: the number of simultaneous client cannot be expected from the hand of poor leaders. The good leadership guides every
request handling, volume and speed of data processing and need of incorporation of process effectively. These processes might be communication among all the staffs and
new types of services and new types of features. top-level management, determination of the strategic direction of upgradation, breaking
 Technology saturation or need of new technology: The programing language, of the human resistance and cultural barrier.
frameworks and architecture of the development of the system might be outdated so Human Resistance and Cultural Barrier:
there needs the upgradation of the new system. Sometimes the system should be
upgraded due to changing need of hardware as well. As the programing concept is By nature, the human workforce prefers status quo. They feel comfortable with the
older, chances of technical support are decreasing. existing system and when new system is suggested they feel overwhelmed. So, the
human resistance and cultural barrier of the Bank will also be the big challenge. The
 The technical support from the vendor: Sometimes, the system would be so old that onboarding of the staffs from the beginning of the upgradation process, training and
the vendor would be unable to provide the technical support to keep it running. So, in orientation and continuous carrier upgrading plan can reduce these hurdles.
this case there arises the need of upgrading the existing system.
c) Business continuity is all about ensuring of the normal operation of the system in a set of
 The existing capacity of the database may become insufficient to hold the growing predefined time even in case of huge disaster thereby minimizing the losses to the
needs of the data. So, in order to hold the increased demand of the capacity of the organization. The continuity of the business of NPB can be ensured with the following
database sometimes the upgrading of the system is recommended. process:

31 32
 December 2020 December 2020

 Backup Plan IT system should be designed to support different organizational business processes and
management decision making. IT systems can also be used to communicate with
 Emergency Plan
suppliers, business partners, distributors, retailers, and even customers. To design and use
 Proper Recovery Plan IT system that support efficiently and effectively, we should have knowledge of each and
every activity within the organization including its structure, management style, business
Backup Plan:
processes etc. The IT system designed without having detail knowledge of the
The backup plan will outline the way to restore the same data on different locations of the organization may not support the activities of the organization properly. Furthermore, the
Bank. Backup plan describe the process and timing of replicating the same data in system may not fulfill the needs of different stakeholders that are affected by the IT
different media in redundant location. The redundancy of location is done to ensure the system. The IT system designed without having detail knowledge of business may not
recovery of data even in the failure of some location. Backup plan describe following
points:  achieve the business goals articulated by the user department
 operate at an acceptable cost, commensurate with the value produced for the firm
 Making copy of data regularly
 meet carefully defined performance standards (such as response time and system
 Automation of data backup process
availability)
 Saving of backed-up data on different medium
 produce accurate, reliable output
 Saving of backed-up data on different location
 be easy to learn and use
Emergency Plan:
 be flexible
Emergency plan is all about the immediate action to be taken in case of catastrophe. This
part of the disaster recovery plan outlines the actions to be undertaken immediately after Second Part: Information technology governance (IT governance) is the collective tools,
a disaster occurs. Following points clarify the emergency plan: processes and methodologies that enable an organization to align business strategy and
goals with IT services, infrastructure or the environment.
 Personnel to be notified in case of disaster
IT governance uses, manages and optimizes IT in such a way that it supports,
 Equipment to be operated or shutdown complements or enables an organization to achieve its goals and objectives.
 Procedures to be followed IT governance is a broad concept that is centered on the IT department or environment
Proper Recovery Plan: delivering business value to the enterprise. It is a set of rules, regulations and policies that
define and ensure the effective, controlled and valuable operation of an IT department. It
Recovery plan mainly focuses on how the full capabilities of the system will be restored also provides methods to identify and evaluate the performance of IT and how it relates
and service will be resumed. Following points clarify the recovery plans: to business growth. Moreover, by following and implementing an IT governance
 Formation of recovery committee framework such as CoBIT, an organization can comply with regulatory requirements and
reduce IT costs while attaining measurable business benefits.
 Prioritizing the applications and systems to be recovered
b) The finance function is responsible for managing the firm’s financial assets, such as cash,
 Replacement of hardware and network stocks, bonds, and other investments in order to maximize the return on these financial
assets. It also manages the capitalization of the firm like finding new financial assets in
3. stocks, bonds, or other forms of debt. The finance function must also obtain a
considerable amount of information from sources external to the firm in order to
a) Why do we need knowledge of business for developing and using IT system? What is IT determine whether the firm is getting the best return on investments. The account
governance? (5+3=8 marks) function is responsible for maintaining and managing the firm’s financial records such as
b) Explain finance and accounting information system, and human resources information receipts, disbursement, depreciation, payroll to account for the flow of funds in the firm.
system that support organization and management. (3.5+3.5=7 marks) Finance and accounting information systems support finance and accounting activities.
Answer These information systems are also arranged by organizational level. At the strategic
level, these systems establish long-term investment goals for the firm and provide long-
a) First Part: We cannot successfully design and use IT system without having knowledge range forecasts of the firm’s financial performance. At the management level, these
of the business. An IT System can have a major impact on corporate strategy and systems help managers oversee and control the firm’s financial resources. At the
organizational success. The involvement of managers and decision makers in all aspects knowledge level, these systems support finance and accounting by providing analytical
of information systems is a major factor for organizational success, including higher tools and workstations for designing the right mix of investments to maximize returns for
profits and lower costs. Some of the benefits business organization seek to achieve the firm. At the operational level, these systems track the flow of funds in the firm
through information systems include: better safety, competitive advantage, fewer errors, through transactions.
greater accuracy, higher quality products, improved communications, increased
efficiency and productivity, more efficient administration, superior financial and The human resource function is responsible for attracting, developing, and maintaining
managerial decision making. the firm’s work force. This function support activities such as identifying potential

33 34
 December 2020 December 2020

employees, maintaining complete record on existing employees, and creating programs to transaction or message, as well as acknowledging informed consent by the signer. In
develop employees’ talent and skills. Human resources information systems support many countries, digital signatures have the same legal significance as the more traditional
these activities. These information systems are also arranged by organizational level. At forms of signed documents.
the strategic level, these systems identify the manpower requirements like skills,
Second Part: The term authentication refers to an electronic process that allows for the
educational level, types of position, number of positions, and cost for meeting the firm’s
electronic identification of a natural or legal person. Additionally, authentication may
long-term business plans. At the management level, these systems help managers monitor
also confirm the origin and integrity of data in electronic form. The terms digital
and analyze the recruitment, allocation, and compensation of employees. At the
authentication or electronic authentication (e-authentication) synonymously refer to the
knowledge level, these systems support analysis activities related to job design, training, process where the confidence in user identities is established and presented electronically
and the modeling of employee career paths and reporting relationships. At the operational to an information system.
level, these systems track the recruitment and placement of the firm’s employees.
When authenticating an online user, there are three factor categories that may be used to
4.
assure that the user is who he or she makes a claim to be. These factor categories are:
a) How is manufacturing industry benefitted with the use of Supply Chain Management
 Knowledge factors – these would include a user’s password, passphrase, personal
System? 8 marks
identification number (pin) or a challenge response where the user would be required
b) What is digital signature? How do you authenticate digitized information? (2+5=7 marks) to answer a pre-selected security question.
Answer  Ownership factors – these would include something that the user has possession of,
a) Manufacturing industry nowadays is all about the production of the quality goods with such as a bank card, a hardware or software one time password (OTP) token or a cell
the efficient utilization of all its resources like material, machine and man and time and phone.
cost. Because of the cost of the warehouse, nowadays manufacturing is more concerned  Inherence factors – these factors relate to something that a user is or does and
towards the just in time production and delivery. The computer-based information system includes biometric identifiers such as facial, fingerprint or retinal pattern recognition
helps manufacturing industry to achieve this just-in-time production and delivery with the along with other personal trait identifiers.
increment of efficiency of production system.
The most frequently used types of online user authentication sorted based on increasing
Supply Chain Management (SCM) is one system that helps the manufacturing system to levels of security are as follows:
access the relevant information of the raw materials and intermediate product at the right
time needed for the production. Beside this SCM also helps to provide the information  Single-factor authentication - only one component out of one of the 3 factor
regarding the delivery of the finished product from industry to the customer end. categories is used to authenticate a person’s identity. Experience shows that one
single factor does not provide sufficient protection against malicious intrusion and
Supply Chain Management (SCM) is a cross-functional inter-enterprises system that uses misuse. Therefore, as soon as financially or personally relevant transactions are
information technology to support and manage the links between some of a company’s involved, a higher level of security is preferable.
key business processes and those of its suppliers, customers and business partners. The
goal of SCM is to create a fast, efficient and low-cost network of business relationships  Two-factor authentication – often referred to as 2FA, the user’s identity is
or supply chain to get a company’s products from concept to market. Thus, a SCM is confirmed by using a combination of two independent components from two different
interconnected information system of business organizations that helps in easy flow and factor categories. For example, where a user has logged on to their online bank
tracking of the raw materials, intermediate products and finished goods. It minimizes the account, with their username and password, and wishes to complete an online
material warehousing cost and product delivery cost. transaction, he or she would need to enter an authentication factor in addition to the
knowledge factor (username and password) that was used to log on. The additional
SCM includes the information about the movement of raw materials, work in progress factor must also be from a different factor category than the username and password.
inventory and finish goods from the point to origin to the point of consumption. Thus, An online banking user would typically use an authentication mechanism from the
SCM is the design, planning, execution, monitoring and control of supply chain activities ownership category such as an OTP device or mobile phone to receive an OTP in a
with the objective of creating net value, building a competitive infrastructure, leveraging text message. OTPs are dynamic passwords which can only be used once and thereby
worldwide logistics and synchronizing supply with demand. Thus, manufacturing provide a strong level of protection against a range of attacks.
industry get highly benefited with the use of SCM by establishing efficient supply
networks among raw materials supplier to the end users with the just in time delivery of  Multi-factor authentication is similar to 2FA, but it can combine more than 2
raw material, intermediate product and finished product. To be specific, SCM reduces the authentication factors for enhanced security, whereas 2FA only uses two different
cost of delivery; warehouse and storage cost and reduces the production time from factors.
concept to finished product at customer end.  Strong authentication – this type is often used as synonym for multi-factor
b) First Part: A digital signature is a mathematical technique used to validate the authentication or 2FA. However, unlike multi-factor authentication and 2FA, strong
authenticity and integrity of a message, software or digital document. authentication mandatorily requires non replicable factors or the use of digital
certificates to provide a higher level of authentication for users. If those criteria are
The digital equivalent of a handwritten signature or stamped seal, but offering far more
fulfilled, multi-factor authentication and 2FA are able to provide strong
inherent security, a digital signature is intended to solve the problem of tampering and
authentication.
impersonation in digital communications. Digital signatures can provide the added
assurances of evidence to origin, identity and status of an electronic document, 5.

35 36
 December 2020 December 2020

Explain risks and opportunities related with the use of Information Technology in  Cost effectiveness and productivity – IT applications promote more efficient
businesses. (4+4=8 marks) operation of the company and also improve the supply of information to decision-
b) What are the major aspects of quality of an information system? Why is vendor participation makers. These systems also help companies to gain a competitive advantage. It has a
necessary to ensure system quality? (4+3=7 marks) positive impact on productivity.

Answer b) An information system is a combination of hardware, software and the data it manages.
Hence, the quality of the system is affected by all these components as well as the quality
a) Information technology (IT) plays a critical role in many businesses. If you own or of the deployment, connectivity, and also the operational practices of its users. However,
manage a business that makes use of IT, it is important to identify risks to your IT the major aspect of system quality are guided by the system resources and the quality of
systems and data, to reduce or manage those risks, and to develop a response plan in the the data it manages. The major aspects of quality of system resources can be enlisted as
event of an IT crisis. Some of the common risks of using IT are: follows:
 Unemployment and lack of job security – Implementing information technology i. State (age, spares, vendor support availability) of the hardware.
can save a great deal of time during the completion of tasks and some labor mechanic
ii. State (age, patches, upgrades, licenses, vendor support availability) of the software
works. Most paperwork’s can be processed immediately and financial transactions are
automatically calculated. As technology improves, tasks that were formerly iii. Deployment architecture and high availability provisions (power, air-conditioning,
performed by human employees are now carried out by computer systems. Industry network redundancy, geographical redundancy)
experts believe that the internet has made job security a big issue as technology keeps
Similarly, the major aspects of system quality in terms of data and operations are:
on changing each day. This means that one has to be in a constant learning mode, if
he or she wishes for their job to be secure. i. Accuracy of the data being input
 Dominant culture – While information technology may have made the world a ii. Mechanism to verify, audit and correct mistakes to ensure quality of data
global village, it has also contributed to one culture dominating another weaker one. iii. Operational practices of users (passwords, privileges, login-logout practices)
 Security issues – Thieves and hackers get access to identities and corporate saboteurs iv. Regular data cleaning, backup, restoration drills
target sensitive company data. Such data can include vendor information, bank
records, intellectual property and personal data on company management. The v. Protection mechanism from external threats such as viruses, hacking, data theft
hackers distribute the information over the Internet, sell it to rival companies or use it vi. Security and control mechanism enforces for websites and other resources accessible
to damage the company’s image. over network from outside.
 Implementation expenses – To integrate the information system it requires pretty vii. User training and knowhow.
good amount of money for software, hardware and people. Software, hardware and Vendor support and involvement is critical in maintaining good system quality and
some other services should be rented, bought and supported. Employees need to be health. The modern IT systems are combination of complex hardware and software
trained with unfamiliar information technology and software. components which cannot be modified, repaired or customized by the end user alone. For
Information technology contributes to the efficient running of organizations. Information such activities, vendor support is essential. Similarly, to ensure bug fixes, patches and
systems are showing the exponential growth in each decade. Some of the common upgrades also vendor engagement is necessary. This is applicable for all major
opportunities are: components such as the application, database system and other software components.
Vendor support may seem less important for hardware but that is not so. Since modern
 Communication – With help of information technologies the instant messaging,
hardware systems are also very compact, complex and non-repairable at the end-user
emails, voice and video calls becomes quicker, cheaper and much efficient.
level, vendor engagement is essential to ensure optimum performance, quick support and
 Globalization and cultural gap – By implementing information systems we can spares guarantee as and when needed. Hence, for ensuring quality operation of modern
bring down the linguistic, geographical and some cultural boundaries. Sharing the information systems, vendor support is essential.
information, knowledge, communication and relationships between different
6. Write short notes on: (5 3=15 marks)
countries, languages and cultures becomes much easier.
a) Vulnerability Assessment
 Availability – Information systems has made it possible for businesses to be open
24×7 all over the globe. This means that a business can be open anytime anywhere, b) Capability Maturity Model Integration (CMMI)
making purchases from different countries easier and more convenient. It also means c) Virtual Organization.
that you can have your goods delivered right to your doorstep without having to move
a single muscle. d) Software as a Service (SaaS)

 Creation of new types of jobs – One of the best advantages of information systems e) Neural Network
is the creation of new and interesting jobs. Computer programmers, Systems Answer
analyzers, Hardware and Software developers and Web designers are just some of the
a) A vulnerability assessment is the process of defining, identifying, classifying and
many new employment opportunities created with the help of IT.
prioritizing (or ranking) vulnerabilities in computer systems, applications and network
infrastructures and providing the organization doing the assessment with the necessary

37 38
 December 2020 December 2020

knowledge, awareness and risk background to understand the threats to its environment In a neural network, the accuracy depends upon the actual neural network design as well
and react appropriately. as the level of training it receives. The more training with wider variety of data, the
higher the accuracy may become.
A vulnerability assessment provides an organization with information on the security
weaknesses in its environment and provides direction on how to assess the
risks associated with those weaknesses and evolving threats. This process offers the
organization a better understanding of its assets, security flaws and overall risk, reducing
the likelihood that a cybercriminal will breach its systems and catch the business off
guard.
b) The Capability Maturity Model Integration (CMMI) method, is a process improvement
approach that contains 22 process areas. It is divided into appraisal, evaluation and
structure. CMMI defines the five maturity levels for processes: Initial, Managed,
Defined, Quantitatively Managed, and Optimizing. CMMI is particularly well-suited to
organizations that need help with application development, lifecycle issues and
improving the delivery of products throughout the lifecycle.
c) Virtual organization is referred to the formation of networks of independent firms or
professionals who join together often temporarily to achieve a common objective or to
produce common product or to provide a service to the customer removing the
conventional concept of an organization. Here the customer is normally unaware of the
structure of the organization. The use of computer-based software and communication
network are the backbone of the formation of such organization. They might be
geographically located at any part of the globe however they can work together for the
common mission. The legal existence of such organization sometimes is clear or some
time it is blurry too.
d) Software as a Service or SaaS is a cloud deployment model in which the cloud provider
provides an off-the-shelf application for the end user without the end user having to
purchase or arrange any platform, hardware or software. For example, if a client needs an
ERP, the cloud provider would provide the ready-to-use ERP function to the end user
without the end user having to purchase or arrange anything else other than buy the
sufficient license from the cloud service provider and, of course, a good Internet
connection. The end user can directly start using the ERP function while paying the cloud
provider for the service in terms of user licenses, application licenses or any metering
parameter set by the service provider. SaaS is the most easy and quick option for the
client as it can be deployed with minimal effort and time. However, since the whole
software, data and hardware is based on the cloud platform and operated by the cloud
provider, the end user has little control. Meanwhile, since the client can always ask for
more licenses and features, possibly at additional cost, feature enhancement and
scalability is also very easy and quick.
e) A neural network or an artificial neural network in the parlance of computer technology
is a chain of computer algorithms or process that try to mimic the way human brain
works. Since they try to emulate the biological neural network of human grain and
cognitive system, they are called neural networks.
The most important capability of the artificial neural networks is their capability to learn
and adapt to different inputs. This means, they need not be re-programmed for each type
of input scenario. They have certain capability to be trained so that they develop a
cognitive capability of their own. The basic neural networks are pattern recognition
algorithms that can recognize various input patterns based on the training they receive.
For example, an image recognition algorithm may be trained with thousands of pictures
of different human faces so that it can analyze the inherent features of a human face and
build its knowledgebase. Based on that knowledgebase, the system can subsequently be
used to recognize faces.

39 40
 June 2021 June 2021

Paper 5: Management Information and Control System costs and hardware, software, and IT support staff compared to the non-integrated legacy
systems that were replaced by their new ERP systems.
Attempt all questions.  Decision support – ERP provides vital cross-functional information on business
1. ABC Company has branches in 77 districts of Nepal. The company has around 3000 staff. Company performance quickly to managers to significantly improve their ability to make better
is using different software solutions like payroll system, inventory system, accounting software, decisions in a timely manner across the entire business enterprise.
welfare management system, HR system, finance system to support their business functions. These  Enterprise agility – ERP can be used in breaking down many former departmental and
solutions are using various heterogeneous hardware, database and operating system. Company is functional walls, which results in more flexible organizational structures, managerial
facing difficulty in maintaining different systems and getting timely and accurate integrated responsibility, and work roles. The result is a more agile and adaptive organization and
information. workforce that can more easily capitalize on new business opportunities.
a) In order to resolve such problem what solution do you suggest? Why? What will be the challenges End-user resistance can be minimized by formal technology implementation programs which end
and benefits of the proposed solution? How do you minimize the resistance and maximize the user managers and IS consultants can develop to encourage user acceptance and productive use of
acceptance of end users to use this solution? (1+2+4+3=10 marks) reengineered business processes and new information technologies. Some keys to solving
b) How do you select the product for the proposed solution? Which conversion technique do you problems of end user resistance include:
suggest and why? Why is proper documentation required for successful implementation?  Proper end user education and training
(4+4+2=10 marks)  Improved communications with IS professionals
Answer:
 End user involvement in the development and implementation of new systems.
a) In order to resolve such problem Enterprise Resource Planning solution can be used because of the  Involvement and commitment of top management and all other business stakeholders.
following reasons
 Developing innovative ways to measure, motivate, and reward performance.
 For Management – to know what is happening in the company
 Designing programs to recruit and train employees in the core competencies required in a
 One solution for better Management changing workplace.
 For cycle time reduction
 Analysing and defining all changes facing the organization, and developing programs to reduce
 To achieve cost control & low working capital the risks and costs and to maximize the benefits of change.
 To shun the geographical gaps  Involve as many people as possible in reengineering and other change programs.
 To satisfy the customers with high expectations  Make constant change part of the culture.
 To be Competitive & for survival  Tell everyone as much as possible about everything as often as possible, preferably in person.
Challenges to implement ERP solutions  Make liberal use of financial incentives and recognition.
An ERP implementation involves people as well as technology. Accordingly, it may face people-  Work within the company culture, not around it.
related challenges, such as resistance to change, as well as technical obstacles. Common ERP
implementation challenges include: Direct end user participation in systems development projects before a system is implemented is
especially important to reducing the potential for end user resistance. Allow end users members of
 Project Management e-business systems development teams or do their own developments work. This involvement
 Project Planning helps ensure that end users “assume ownership” of a system, which is designed to meet their needs.
 Data Integration b) Using following parameters we will select the product for the solution
 Data quality  Reputation of the ERP product
 Change Management  Number of installations in the geographical vicinity
 Cost overruns  % of the overall functional availability
 Continuous Improvement  Customization possibilities
Benefits of ERP solution  After sales support
 Quality and efficiency – ERP creates a framework for integrating and improving a  Investment plan & budget
company’s internal business processes that result in significant improvement in the quality  Implementation partner’s track record
and efficiency of customer service, production, and distribution etc.
 Decreased costs – many companies report significant reductions in transaction processing

Page 4 of 69 Page 5 of 69

41 42
 June 2021 June 2021

Conversion is the process in which the personnel, procedures, equipment, input/output media, and Typically, a manager uses a DSS software package at his workstation to make inquiries, get
databases of an old information system must be converted to the requirements of a new system. responses and to issue commands. This differs from the demand responses of information reporting
Four major forms of system conversion include: systems, since managers are not demanding pre-specified information. Rather, they are exploring
possible alternatives. They do not have to specify their information needs in advance. Instead they
 Parallel Conversion:
use the DSS to find the information they need to help them make a decision.
 Phased Conversion: DSS involves four basic types of analytical modelling activities:
 Pilot Conversion:  What-If Analysis: - In what-if analysis, an end user makes changes to variables, or
 Plunge/Direct Cutover: relationships among variables, and observes the resulting changes in the values of other
variables.
For the ERP implementation I suggest the combination of parallel and phase conversion because
ERP is a complex system with number of modules. If we carry out conversion of all modules at a  Sensitivity Analysis: - Is a special case of what-if analysis. Typically, the value of only one
time and problem occurs it will be difficult to manage. Only parts of a new application or only a variable is changed repeatedly, and the resulting changes on other variables are observed. So,
few departments, branch offices, or plant locations at a time are converted and after the successful sensitivity analysis is really a case of what-if analysis involving repeated changes to only one
implementation of that module we implement other modules. We also carry out parallel conversion variable at a time. Typically, sensitivity analysis is used when decision-makers are uncertain
that is run both the system old and new one for some time in-order to compare and evaluate. During about the assumptions made in estimating the value of certain key variables.
parallel run period errors can be identified and corrected, and the operating problems can be solved
 Goal-Seeking Analysis: - Reverses the direction of the analysis done in what-if and sensitivity
before the old system is abandoned.
analysis. Instead of observing how changes in a variable affect other variables, goal-seeking
Developing good user documentation is an important part of the implementation process. analysis sets a target value for a variable and then repeatedly changes other variables until the
target value is achieved.
 Documentation serves as a method of communicating among the people responsible for
developing, implementing, and maintaining a computer-based system.  Optimization Analysis: - Is a more complex extension of goal-seeking analysis. Instead of
 Documentation is extremely important in diagnosing errors and making changes. setting a specific target value for a variable, the goal is to find the optimum value for one or
more target variables, given certain constraints. Then one or more other variables are changed
Documentation involves developing: repeatedly, subject to the specified constraints, until the best values for the target variables are
1. Manuals for operating procedures discovered.

2. Sample data entry display screens b)

3. Sample forms i) Although e-Commerce business is growing rapidly around the world, it also has a few challenges
despite of a lot of opportunities. Some of the challenges associated with the e-Commerce business
4. Sample reports can be listed as:
2. Borderless competition:
a) Explain about the analytical model of the Decision Support System. 8 marks The Internet and mobile based technologies have blurred the political boundary in the business.
This has opened the doors to digital economy taking globalization into new level by expanding the
b) During the time of this COVID-19 crisis, one of the growing sectors is the e-Commerce. In this
online retailers around the globe. But at the same time the retailer is facing the challenges of
context answer the following question:
extensive competition with local and international retailers as the retailer from America can do the
i) What are the challenges associated with the business through e-Commerce? 6 marks business in Nepal and vice versa. The retailers should also comply with the rules and regulation of
ii) How do you carry out the e-Commerce System operational level testing? 6 marks each state.

Answer Building trust and brand as the key differentiator:

a) A decision support system is a computer-based information system which helps to make right Brand loyalty and consumer trust are the essential factors for every business to grow. The
decision to a middle level or high-level management in the case of unstructured or semi structured traditional brand building exercise and methodologies are irrelevant in the e-Commerce sector. The
problems with the use of huge amount of data. Decision Support Systems (DSS) rely on model chances of losing the customer for the next big thing is equally likely. Failure to deliver any one
bases as well as databases as vital system resources to generate the analysis for the decision-making aspect of the customers’ demand would lead to failure of retaining them.
process. A DSS model base is a software component that consists of models used in computational Dependency on Various System:
and analytical routines that mathematically express relationships among variables. Examples
The success of e-Commerce depends upon various types of system such as: Point of sale, Enterprise
include:
Resource Planning, Customer Relationship Management. Each of these systems are developed
 Spreadsheet models independently and have different architecture. Function (or non-function) of one system affect
another. In case of Nepal, the payment process is also another constraint as the electronic payment
 Linear programming models
is just growing. Still large number of people are hesitant or don’t have trust on electronic payment
 Multiple regression forecasting models process.
 Capital budgeting present value models Personalization:
Page 6 of 69 Page 7 of 69

43 44
 June 2021 June 2021

Modern e-Commerce thrives on delivering the best personalized experience to their consumers. b) Are Transaction Processing System (TPS) and Management Information System (MIS) related?
Managing a repository of customer data is a challenge, added to that e-Commerce companies have Explain with a simple example. (3+4 =7 marks)
to understand how to use those data.
Answer
Return:
a) The practical influencing factors which affect the successful implementation of Information
As the return of the product is easy and free most of the customers order multiple products of same Technology are summarized as:
type leading to high number of returns. Because of this problem, some e-Commerce companies are
changing their return policy. Flexibility of changes in business and technology:
There should be sufficient room in any business and its involved technology for the improvement.
Regulatory issues:
This can lead to the use of information technology in broader sense. If business and the involved
Because of the lack of contemporary laws and regulatory guidelines, there is constraint in the technology are confined within a small boundary new ideas and concept cannot be groomed.
expansion of the e-commerce. Most of the government bodies are not changing the laws and
Budget:
regulation to make them compatible with the internet business. The case of Tootle and Pathao are
the clear examples of such laws and regulations. On another hand, government is yet to change Budget is major influencing factor of any process or system. The size of the budget determines the
their tax laws to levy tax on such businesses. level of integration, reliability and efficiency of technology to the business. Budget also determines
the quality of Information Technology related work.
Furthermore, during this time of Covid-19, the delivery of the product is also another hurdle as
government is deploying restrictions in various things. Speed to the market:
ii) Operational level system testing is all about the evaluation of the compliance of e-Commerce How fast system is brought to the market determines the life of the technology. If the technology
system along with its all requirements and functionalities. System testing helps to identify the is brought after expiration of its time value, then the success of the technology will not be as
technical bugs and insufficiency functionalities and provide space for the rectification at the same expected. Nowadays it is understood that the life of technology is limited for the specific purpose.
time testing ensure the operability and reliability of the system. For the case of e-Commerce system Moreover, the right timing is very important.
some specific points have to be considered along with other general testing of the system. Some of
Legal and Regulatory Body:
them are specified herewith:
The regulatory and legal authorities are the major entities about the deployment of any technology.
Compatibility of all types of browser
If any technology is banned by the legal authority its relevance will sink.
This test will be carried to evaluate the performance of the system in all types of browsers in use.
Other factors which influence the information technology are:
e.g., Internet explorer, Chrome, Mozilla, Safari, mobile browsers etc.
 International norms and practices about the technology
Usability testing
This test will verify how convenient the web-application is to online buyers. This will help to  Personnel self-interest and motivations towards the use of technology
improve user experience of the application as well as help to increase the business process. The  The functional business units of the organization
usability testing can be carried out in various stages of the system development such as during
prototype development, final application, mobile application and so forth. Some of the prominent  Knowledge and qualifications of the personnel
features to be tested will be: confirmation, payment, notification etc. So, while introducing any technology organization should be clear about these factors.
Stress testing b) Yes, TPS and MIS are related. TPS plays role of data provider for the MIS. MIS will process data
Stress testing is all about the evaluation of the performance of the system with the increased amount collected by the TPS and generates several summary reports that will be of value for the managers.
of simultaneous access. Stress testing will be done with automated tools emulating system load to TPS helps to collect around 90% of the data in the organization. Information cannot be produced
check stability, performance and scalability. without data. So, for MIS, TPS acts like a data feeder.

Integration testing For example, in banks the frequently occurring tasks are taking deposits, providing money for
cheques, paying interests, issuing cards, cheque books, and statements. These are part of
As the online trading application has to be interconnected with other application in the organization Transaction Processing System. TPS will help to collect deposits, cash cheques, calculate interest,
such as inventory, HR, account and payment system of the organization, the integration testing is print cheques, account statements, card information etc. Several data will be collected like customer
very important. This will evaluate how the system is interacting with other components or modules. information, deposit information, information about cashing cheques, issuing card. These collected
Functional testing data will become input for the MIS. MIS processes these data and will produce several reports like
daily withdrawal amount, deposit amount, how many deposits each day, total interest paid in each
Functional testing evaluates whether all the functional requirements of the System Requirement day, week, how many clients have paid interest, what is frequency of withdrawal by each customer
Specification are met or not. Functional testing will be done in various stages such as: designing, during the specific period time etc. These reports will be of great value for managers in making
integration and during user acceptance testing as well. decisions such as if how many deposits arrive each day is known, then the managers can know
3. whether bank is able to provide convenient service to its customers or not, do customers have to
wait long to deposit or withdraw money etc. Then based on the information managers can act or
a) Discuss about the practical factors which influence the successful implementation of Information decide to increase or decrease number of counters.
Technology. 8 marks
Page 8 of 69 Page 9 of 69

45 46
 June 2021 June 2021

4. and yet still make widespread use of the invention possible for those wishing to use the idea under
a) Explain digital signature and its benefits in detail. How do copyright and patient protect digital license from the patent’s owner. The granting of a patent is determined by the Patent Office and
content? (4+4=8 marks) relies on court rulings. The key concepts in patent law are originality, novelty, and invention. Patent
protection is that it grants a monopoly on the underlying concepts and ideas of software. The
b) Explain customer relationship management system. Why do we need sales force difficulty is passing stringent criteria for novelty and invention.
automation? (4+3=7 marks)
Answer b) First Part: Firms use Customer Relationship Management (CRM) systems to help manage their
relationships with their customers. CRM systems provide information to coordinate all of the
a) First Part: A digital signature is a mathematical technique used to validate the authenticity and business processes that deal with customers in sales, marketing, and service to optimize revenue,
integrity of a message, software or digital document. customer satisfaction, and customer retention. This information helps firms identify, attract, and
The digital equivalent of a handwritten signature or stamped seal, but offering far more inherent retain the most valuable customers; provide better service to existing customers; and increase sales.
security, a digital signature is intended to solve the problem of tampering and impersonation in
Customer Relationship Management (CRM) systems, capture and integrate customer data from all
digital communications. Digital signatures can provide the added assurances of evidence to origin,
over the organization, consolidate the data, analyse the data, and then distribute the results to
identity and status of an electronic document, transaction or message, as well as acknowledging
various systems and customer touch points across the enterprise. A touch point (also known as a
informed consent by the signer. In many countries, digital signatures have the same legal
contact point) is a method of interaction with the customer, such as telephone, email, customer
significance as the more traditional forms of signed documents.
service desk, conventional mail, Facebook, Twitter, website, wireless device, or retail store. Well-
Benefits of digital signature: designed CRM systems provide a single enterprise view of customers that is useful for improving
both sales and customer service.
 Security – Security is the main benefit of digital signatures. Security capabilities embedded in
digital signatures ensure a document is not altered and signatures are legitimate. Good CRM systems provide data and analytical tools for answering questions such as these: What
is the value of a particular customer to the firm over his or her lifetime? Who are our most loyal
 Timestamping – By providing the data and time of a digital signature, timestamping is useful
when timing is critical, such as for stock trades, lottery ticket issuance and legal proceedings. customers? Who are our most profitable customers? What do these profitable customers want to
buy? Firms use the answers to these questions to acquire new customers, provide better service and
 Globally accepted and legally compliant – The public key infrastructure (PKI) standard support to existing customers, customize their offerings more precisely to customer preferences,
ensures vendor-generated keys are made and stored securely. Because of the international and provide ongoing value to retain profitable customers.
standard, a growing number of countries are accepting digital signatures as legally binding.
Second Part: One important module in CRM system is Sales Force Automation (SFA) module.
 Time savings – Digital signatures simplify the time-consuming processes of physical
document signing, storage and exchange, enabling businesses to quickly access and sign This module help sales staff increase productivity by focusing sales efforts on the most profitable
documents. customers, those who are good candidates for sales and services. SFA modules provide sales
prospect and contact information, product information, product configuration capabilities, and sales
 Cost savings – Organizations can go paperless and save money previously spent on the quote generation capabilities. Such software can assemble information about a particular
physical resources and on the time, personnel and office space used to manage and transport customer’s past purchases to help the salesperson make personalized recommendations. SFA
them. modules enable sales, marketing, and shipping departments to share customer and prospect
 Positive environmental impact – Reducing paper use also cuts down on the physical waste information easily. SFA increases each salesperson’s efficiency by reducing the cost per sale as
generated by paper and the negative environmental impact of transporting paper documents. well as the cost of acquiring new customers and retaining old ones. SFA modules also provide
 Traceability – Digital signatures create an audit trail that makes internal record-keeping easier capabilities for sales forecasting, territory management, and team selling.
for business. With everything recorded and stored digitally, there are fewer opportunities for a 5.
manual signee or record-keeper to make a mistake or misplace something.
a) Discuss about the need of International Standards for the IT Governance. (8 marks)
Second Part: Copyright is a statutory grant that protects creators of intellectual property from
having their work copied by others for any purpose during the life of the author plus an additional b) What is a cybercrime? Outline the major computer-related crime defined by “Electronic
70 years after the author’s death. For corporate-owned works, copyright protection lasts for 95 Transaction Act 2063” and also mention the provision of punishment. (1+3+3=7 marks)
years after their initial creation. Most industrial nations have their own copyright laws, and there Answer
are several international conventions and bilateral agreements through which nations coordinate a) The international standards, may it be COBIT 5 for IT governance and control, ISACA for
and enforce their laws. Copyright protects against copying of entire software programs or their Information System Audit, ITIL for the set of best practices of IT services or ISO_IEC 17001 for
parts; However, the ideas behind a work are not protected, only their manifestation in a work; A securing the information system; provide standards procedures, practices, steps, codes and
competitor can build new software that follows the same concepts without infringing on a regulations for the best management of the Information system and its governance. Because of
copyright. these standards or procedures, the efficiency, reliability, effectiveness of operation of Information
system will be increased. Moreover, these standards help in the cost effective and secured use of
A patent grants the owner an exclusive monopoly on the ideas behind an invention for 20 years. the system and they also provide the consistent steps for the continuity of the business even in case
The intent behind patent law is to ensure that inventors receive the full financial and other rewards of any disaster. If these standards are adopted in the operation and management of the system, the
Page 10 of 69 Page 11 of 69

47 48
 June 2021 June 2021

chances of breaks are reduced tremendously and even if there are breaks it is easier to identify the Computer fraud
cause and rectification will be easier. Financial and operational transparency are other advantages
1. Compensate claim amount
of adapting the international standards in IT governance.
2. Fine up to 1 lakh and 2 years of imprisonment or both
Beside above points, the international standards help IT managers to bridge the gap between control
requirements, technical issues and business risks. And these standards emphasize regulatory Computer fraud
compliance, help organizations to increase the value attained from IT, enable alignment and  For abetment fine up to 50,000 and up to 6 months' imprisonment
simplifies implementation of the enterprises' IT governance and control framework. Thus, it can be
concluded that the standards support business management in their supervision of the IT 6. Write short notes. (5*3=15 marks)
organization and helps them ensure that IT has a positive impact on the company’s performance.
a) Executive Information System.
The standard consists of six principles:
b) Strategic E Business Planning.
1. Responsibility
2. Strategy c) Business Continuity Plan
3. Acquisition d) Software as a Service
4. Performance e) Disk mirroring
5. Conformance Answer
6. Human behaviour a) Executive level management is mainly responsible for the long-term policy formulation, strategy
development and determining of the indicators to track progress. Their work mainly effects long
b) Cybercrime is a crime committed by using cyber means/computer technology. Cybercrime is also term decisions and long-term goals of the organization. They are mainly responsible for
known as computer-related crime. All the illegal activities committed by using or with the unstructured decision-making process. In order to make such type of decision or planning they
application as computer technology come under the category of cybercrime. Examples are – need the summary as well as the detail report from all activities in the organization.
 Damage to computer and computer system. The executive information system is that which provides the summary information about the
 Acts to gain illegal access in to the system. performance of all activities or project and that system gives facility to executive’s users to drill
down the information into micro levels. For example, it provides the information about the net
 Use as weapons to commit other crimes. profit of fiscal year 2017 for an organization. Now, if executive wants to check how that profit is
 Acts against the provision of cyber law. obtained then he can have detail information. Similarly, the executive can have the analytical
Major computer-related crimes and punishments information about the profit. They can analyse the effect on profit when the price of the product is
reduced or increased, when extra incentive is given to salesperson keeping the price of the product
Pirate/ Destroy/Alter computer source code constant, increasing promotional cost making the product cost constant etc.
Unauthorized access in the computer system
Damage to computer and computer system
 Up to 3 years of imprisonment, or up to 2 lakh fine or both
Distribution of electronic materials in electronic form – Not to publish the prohibited materials
which are prohibited by prevailing laws, the materials which may create jeopardy in social
harmony, spread hate and jealousy, materials which may create harassment to women trafficking,
pornography materials
 Up to 5 years imprisonment or up to 1 lakh or both
Disclosure of Confidentiality
Deform false statement by parties at the time of the electronic transaction
 Up to 2 years imprisonment or 1 lakh fine of both
Display and submit false license for electronic means
 Only display: 1 lakh fine b) Strategic e-business planning involves an evaluation of the potential benefits and risks a company
 Display + submit and perform = 2 years imprisonment or 1 lakh fine or both faces when using e-business strategies and technologies for competitive advantage.
Strategic planning models that can be used to generate ideas for the strategic use of information
Non-submission of prescribed statements
technologies to support e-business initiatives include:
 Up to 50,000 fine
Page 12 of 69 Page 13 of 69

49 50
 June 2021 December 2021

o Competitive forces model – competitors, customers, suppliers, new entrants, and substitutes. Paper 5: Management Information and Control System
o Competitive strategies model – cost, leadership, differentiation, growth, innovation, and
alliances. Attempt all questions.

o Value chain model – chain or network of basic activities that add value the products or services 1. You are working as an IT head in an Internet service Provider Company. Your company is going
– support processes and primary business processes. to purchase the necessary hardware and software for FTTH/ IPTV billing system. In this context,
answer the following:
o Strategic opportunities matrix – evaluate the strategic potential of proposed e-business
opportunities, as measured by their risk/payoff. a) What hardware and software evaluation parameters do you use to evaluate and select the system?
(5+5=10 marks)
c) Business Continuity Plan (BCP) is the process of preventing and recovering system from potential
threats to a company. The BCP ensures that the system is protected and is able to function quickly b) After selecting the solution, what various activities would you carry out before “Go Live” of the
in the event of a disaster. BCP involves defining any and all kind of risks that can affect the system. system and why? 10 marks
It is an important component of the organization's risk management strategy. Risks may include Answer:
natural disasters like fire, flood, earthquake or man-made risks such as cyber-attacks, arson,
vandalism etc. To develop BCP it is necessary to determine how risk may arise, how those risks a) Hardware evaluation parameters
will affect operations; implement safeguards and procedures to reduce or remove the risks; perform
• Performance
rigorous testing procedures.
 Speed, capacity, throughput
d) Software as a Service (or SaaS) is a way of delivering applications over the Internet—as a service.
Instead of installing and maintaining software, you simply access it via the Internet, freeing yourself • Cost
from complex software and hardware management.
 Lease or purchase price
SaaS applications are sometimes called Web-based software, on-demand software, or hosted
 Cost of operations and maintenance
software. Whatever the name, SaaS applications run on a SaaS provider’s servers. The provider
manages access to the application, including security, availability, and performance. • Reliability

Software as a Service (SaaS) is a software distribution model in which a cloud provider hosts  Risk of malfunction & maintenance requirements
applications and makes them available to end users over the Internet. In this model, an independent  Error control and diagnostic features
software vendor (ISV) may contract a third-party cloud provider to host the application. Or, with
• Compatibility
larger companies, such as Microsoft, the cloud provider might also be the software vendor.
 With existing hardware and software?
A range of IT professionals, business users and personal users use SaaS applications. Products
 With hardware & software provided by competing suppliers?
range from personal entertainment, such as Netflix, to advanced IT tools.
• Technology
e) Disk mirroring, also known as RAID 1, is the replication of data to two or more disks. Disk
mirroring is a good choice for applications that require high performance and high availability,  Year of product life cycle
such as transactional applications, email and operating systems.  Does it use a new, untested technology?
Because both disks are operational, data can be read from them simultaneously, which makes read  Does it run the risk of obsolescence?
operations quite fast. The RAID array will operate if one disk is operational. Write operations,
however, are slower because every write operation is done twice. • Ergonomics
 “human factors engineered”?
Disk mirroring provides instantaneous failover for data required by mission-critical applications. If
primary arrays are damaged, traffic is switched to secondary or mirrored backup arrays.  User-friendly?

RAID, or redundant array of independent disks, is a method of grouping individual physical drives  safe, comfortable, easy to use?
together to form one bigger drive called a RAID set. Because the server has more spindles to read • Connectivity
from or write to when data is accessed from a drive, performance is improved.
 Easily connected to WANs and LANs that use different types of network
The various ways in which data is grouped across drives is called the RAID level. Each RAID level technologies and bandwidth alternatives?
is denoted by a number following the word RAID. The most common levels are RAID 0, RAID 1 • Scalability
and RAID 5. The RAID level depends on the application running on the server. RAID 0 is the
 Can it handle the processing demands of end users, transactions, queries, & other
fastest, RAID 1 is the most reliable and RAID 5 is considered a good combination of both.
processing requirements?
• Software

Page 14 of 69 Page 4 of 71

51 52
 December 2021 December 2021

 Is system and application software available that can best use this hardware?
• Support ii) Training:
 Is support available? Training before the system officially goes live at the company will give employees a chance to
acclimate to any new processes and work out any problems with the system before it is
Software evaluation parameters
implemented. This will also help with any resistance coming from employees who are hesitant
• Quality of change. By teaching employees from the company’s various departments on how to use the
new system the way it was meant to be used will eliminate any doubts, misunderstandings,
 Bug free?
unnecessary errors and problems.
• Efficiency When everyone involved with using the system is included in the training, they will feel more
 Well-developed system of program code that does not use much CPU time, confident about using it as they go into production and the user community will view the
memory capacity, or disk space? implementation as successful. The system may have been tested for functionality and all
customizations are working accurately, but if the end users do not know how to use it or feel
• Flexibility comfortable with it, then the launch of the new system will be viewed as unsuccessful.
 Can it handle our processes easily without major modification? Therefore, the timing of the end user training is critical and must be planned for and
implemented prior to Go Live to ensure a successful implementation.
• Security
iii) Conversion:
 Does it provide control procedures for errors, malfunctions, and improper use?
The initial operation of a new e-business system is a conversion process in which the personnel,
• Connectivity procedures, equipment, input/output media, and databases of an old information system must
 Web-enabled? be converted to the requirements of a new system. Without conversion the system is just the
function system not the operational system. For real operation conversion is must.
• Language
2. Suppose that you are hired to develop an e-commerce website for a book store to sell books online
 Is the programming language familiar to internal software developers? to its customers. Based on this scenario, answer the following:
• Documentation a) Explain different e-commerce features you consider to develop this website. 7 marks
 Well-documented? Help screens and helpful software agents? b) What is your plan for disaster recovery if the website goes down? Explain. 7 marks
• Hardware c) Which e-commerce category will you suggest? Do you have any suggestions about the design of
 Does existing hardware have the features required to best use this software? the website? (3+3=6 marks)

• Other factors Answer

 Performance, cost, reliability, availability, compatibility, modularity, technology, a) There are certain elements every ecommerce site should have to stay relevant and competitive. The
ergonomics, scalability, and support characteristics different features of e-commerce considered to develop e-commerce website are as follows:

b) Various activities that should be carried out before “Go Live “are: 1. Branded Design and Easy Navigation: To succeed in the highly competitive ecommerce
landscape, it is absolutely essential for the design of a brand’s website to encapsulate its
i) Testing: characteristics and qualities. Now more than ever, high-quality website design is a non-
Software Testing is a method to check whether the actual software product matches expected negotiable business asset in ecommerce. Businesses need an ecommerce platform that both
requirements and to ensure that software product is Defect free. includes building blocks for impeccable website design and allows flexibility for design
flourishes that showcase individual brand identities.
It involves execution of software/system components using manual or automated tools to
evaluate one or more properties of interest. Navigation is also a core tenet of strong web design. It goes almost without saying that a good
ecommerce website should be as easy to navigate as possible, and should feature advanced
The purpose of software testing is to identify errors, gaps or missing requirements in contrast search powered by artificial intelligence to help visitors find relevant products as quickly as
to actual requirements. possible. Above perhaps all else, navigability and search are key to providing streamlined
Software testing is necessary because ecommerce experiences that maximize conversions. Easy navigation, of course, must translate
to all screen sizes and all devices such as mobile phones.
✓ If there are any bugs or errors in the software, it can be identified early and can be solved
before delivery of the software product. 2. User-focused Order Functionality: Every aspect of a brand’s ecommerce presence should be
tailored toward creating high-quality, personalized experiences for each user and their
✓ Properly tested software product ensures reliability, security and high performance which individual customer journeys. A good ecommerce platform will allow a brand to use customer
further results in time saving, cost effectiveness and customer satisfaction. data to personalize shopping experiences for site visitors across multiple channels. Artificial
✓ Testing is important because software bugs could be expensive or even dangerous. intelligence can power product recommendations that automatically appear and readjust to
Software bugs can potentially cause monetary and human loss users’ preferences in real time, with every click. Wish lists within user accounts can help brands
Page 5 of 71 Page 6 of 71

53 54
 December 2021 December 2021

further personalize product recommendations and marketing, while allowing shoppers to Every employee must be made aware of the DRP and when implemented, effective communication
conveniently save items for future purchases. is essential. The DRP must include a comprehensive off-site data backup and an on/off-site
recovery plan.
In addition, checkout, order management, and returns should all be hassle-free. Lengthy
account signup forms can cause potential purchasers to abandon their carts, so every The biggest issue may be the sourcing of an alternate location with adequate equipment, but there
ecommerce checkout should feature an additional short form for speedy purchasing. A good are many places where data centre time and bandwidth can be rented so these arrangements could
ecommerce platform should also allow for order shipping transparency and painless returns, also be included in a DRP. Some companies can operate from just a single server so a backup
promoting a streamlined customer experience that extends beyond the purchase. machine can be kept at a remote location and kept up to date with a regular backup of the essential
data required to operate being made. This would suit a small organization, but where there are more
3. Integration with Physical Retail: When shopping online, customers should be able to know
computers and a data centre involved there needs to be a more extensive plan made.
whether they can find a given product in the nearest physical retail store. A good ecommerce
platform will feature functionality to add a find-in-store button linked to geolocation and brick- A DRP may require employees to relocate to a hot-site to resume work, if work cannot be conducted
and-mortar inventory. at the normal business site. This hot-site is an off-site location supplied with the computer
equipment and data necessary to continue an organization's normal work.
Brands should also be able to integrate their ecommerce platform with physical retail locations,
to empower sales associates with the ability to eliminate walked sales with access to digital It is imperative that organizations not only develop a DRP but also test it, train personnel and
inventory, seamless ordering, and speedy delivery. document it properly before a real disaster occurs. This is one reason why off-site hosting of all IT
services can be a good choice for the protection they provide; in disaster situations personnel can
4. Advanced Security Features: By definition, ecommerce deals with transactions during which
access data easily from a new location, whereas relocating a terminally damaged data centre and
there is inevitably an exchange of sensitive financial information. Most ecommerce
getting it operational again is not an easy job.
transactions and one-touch mobile payments are made with credit or debit cards, although some
may also be made directly from bank accounts linked to a payment service like PayPal. What’s Often a specialized disaster recovery planning consultant is hired to assist organizations in
more, many ecommerce platforms offer users the opportunity to link their store accounts with attending to the many details that can arise during such contingency planning.
personal social media profiles.
c) I suggest B2C (business to consumer) e-commerce. B2C (Business-to-Customer) ecommerce is the
No matter the means of payment or accounts linked, all personal and financial information exchange of goods or services over the internet between online stores and individual customers.
shared by ecommerce users must be kept secure. Businesses must invest in a reputable and Consumer preference for the convenience of online shopping - coupled with the ease of starting an
secure ecommerce platform equipped with advanced, modern security features, including online store - has made ecommerce among the fastest growing sectors of the economy.
layered security, SSL certificates, VPNs, and more.
Shoppers at physical storefronts are acutely aware of the store layout, cleanliness, and ease of
5. Live Chat Feature: Offer a live-chat option to your customers. It is of great value to your site finding products and information. These factors are equally present for ecommerce businesses, with
as it facilitates instant communication to help your visitors through any stage they are having shelves and shiny floors replaced by:
difficulty with. The quality of customer service you offer plays a crucial role in the growth of
• Colour scheme: A website that's hard on the eyes will turn off some users. Make sure the text
your business. Therefore, rather than making the customers wait for the answers, many e-
is clearly visible in contrast to the background and the colours reflect your brand in a good way.
commerce websites have added live chat support to their help desk software.
• Navigation: No matter how informative the content or attractive the products, consumers need
6. Social Media: Add social media icons as you can make the visitors of your site better
to find it. Simple navigation that clearly points users in the right direction is essential for
understand your business via social media channels like Facebook, Instagram, and Twitter etc.
maximizing the hard work you put in to assemble inventory, and
Businesses need to leverage proper social media channels as more and more people are joining
and using social media platforms which make them one of the best ways to connect and serve • Layout: Much like navigation, the page itself needs to be presented in an attractive manner.
your customers better. Don't clutter the page with too much info: use tabbed menus if necessary so browsers aren't
overwhelmed.
7. Page Speed: Make sure your website loads faster. Analyze and optimize your website with
page speed tools to implement the required web performance practices. This may lead to higher 3.
user engagement, retention, and conversions. Customers will leave your website if it doesn’t a) Explain decision support system with example. What are the goals and applications of this system
load properly. in business and industry? Compare decision support system with executive support system.
b) A Disaster Recovery Plan (DRP) is a business plan that describes how work can be resumed quickly (3+2+2=7 marks)
and effectively after a disaster. Disaster recovery planning is just part of business continuity b) Define IT risk assessment and explain various risk assessment methodologies. (2+6=8 marks)
planning and applied to aspects of an organization that rely on an IT infrastructure to function.
Answer
The overall idea is to develop a plan that will allow the IT department to recover enough data and
system functionality to allow a business or organization to operate - even possibly at a minimal a) First Part: Decision support systems (DSSs) are the information systems that support non-routine
level. decision making for middle management in organizations. They focus on problems that are unique
and rapidly changing, for which the procedure for arriving at a solution may not be fully predefined
The creation of a DRP begins with a DRP proposal to achieve upper level management support. in advance. These systems use internal information from TPS and MIS, and often information from
Then a business impact analysis (BIA) is needed to determine which business functions are the external sources, such as current stock prices or product prices of competitors. These systems use
most critical and the requirements to get the IT components of those functions operational again a variety of models to analyze data, or they condense large amounts of data into a form in which
after a disaster, either on-site or off-site.

Page 7 of 71 Page 8 of 71

55 56
 December 2021 December 2021

decision makers can analyze them. DSS are also called business intelligence systems because they • the asset value
focus on helping users make better business decisions.
• the frequency of risk occurrence
For example, a national on-line book seller wants to begin selling its products internationally but
• the probability of associated loss
first needs to determine if that will be a wise business decision. The vendor can use a DSS to gather
information from its own resources (using a tool such as OLAP) to determine if the company has In an example of server failure, a quantitative assessment would involve looking at:
the ability or potential ability to expand its business and also from external resources, such as
• the cost of a server or the revenue it generates
industry data, to determine if there is indeed a demand to meet. The DSS will collect and analyze
the data and then present it in a way that can be interpreted by humans. • how often does the server crash
Second Part: The primary goal of using a DSS is to present information to the customer in an • the estimated loss incurred each time it crashed
easy-to-understand way. A DSS system is beneficial because it can be programmed to generate
many types of reports, all based on user specifications. For example, the DSS can generate
From these values, you can work out several key calculations:
information and output its information graphically, as in a bar chart that represents projected • single loss expectancy - costs you would incur if the incident occurs once
revenue or as a written report. The flexibility of the DSS is extremely beneficial for users who
• annual rate of occurrence - how many times a year you can expect this risk to occur
travel frequently. This gives them the opportunity to be well-informed at all times, providing the
ability to make the best decisions for their company and customers on the go or even on the spot. • annual loss expectancy - the total risk value over the course of a year
DSS has lots of applications in business and industry and is getting a lot of attention as a way to These monetary results could help you avoid spending too much time and money on
promote better projections, management and analysis within a company. DSS is extensively used reducing negligible risks. For example, if a threat is unlikely to happen or costs little or
in business and management. Executive dashboard and other business performance software allow nothing to remedy, it probably presents low risk to your business.
faster decision making, identification of negative trends, and better allocation of business resources.
Due to DSS all the information from any organization is represented in the form of charts, graphs However, if a threat to your key IT systems is likely to happen, and could be expensive to
i.e. in a summarized way, which helps the management to take strategic decision. fix or likely to affect your business adversely, you should consider it high risk.
DSS can be used to manage inventory, where decision support system applications can provide You may want to use this risk information to carry out a cost/benefit analysis to determine
guidance on establishing supply chain movement that works for a business. It can also be used for what level of investment would make risk treatment worthwhile.
sales optimization, sales projection, and financial projections necessary for determining
expenditures and revenues. Quantitative measures of risk are only meaningful when you have good data. You may not
always have the necessary historical data to work out probability and cost estimates on IT-
Third Part: Decision support system (DSS) allows senior managers to take non-routine decisions related risks, since they can change very quickly.
while the executive support system (ESS) allows senior managers to take decisions to meet the
strategic goals of the organization. DSS is designed to help managers come up with solutions to Qualitative IT risk assessment
problems on the basis of a data base or knowledge base whereas ESS is executive support system Qualitative risk assessment is opinion-based. It relies on judgment to categorise risks based
that presents summarized information that is used by executives to come up with best possible
on probability and impact and uses a rating scale to describe the risks as:
solution to problems with the help of their education, experience and business environment that
they face. • low - unlikely to occur or impact your business
DSS uses mathematical models and statistical techniques to support decision making. ESS is easier • medium - possible to occur and impact
for upper-level executives to use and take decisions. It helps to monitor the company performance
• high - likely to occur and impact your business significantly
and examine the critical success factors. It also allows analyzing trends and determines the
competitiveness in the market. Moreover, it improves flexibility, strategic control, improves For example, you might classify as 'high probability' something that you expect to happen
communication and provides time management. ESS also provides excellent reporting facilities. several times a year. You do the same for cost/impact in whatever terms seem useful, for
b) IT risk assessment is a process of analysing potential threats and vulnerabilities to your IT systems example:
to establish what loss you might expect to incur if certain events happen. Its objective is to help • low - would lose up to half an hour of production
you achieve optimal security at a reasonable cost .
• medium - would cause complete shutdown for at least three days
There are two prevailing methodologies for assessing the different types of IT risk:
• high - would cause irrevocable loss to the business
quantitative and qualitative risk analysis.
With your ratings determined, you can then create a risk assessment matrix to help you categorise
Quantitative IT risk assessment
the risk level for each risk event. This can, ultimately, help you decide which risks to mitigate using
Quantitative assessment measures risk using monetary amounts. It uses mathematical controls, and which to accept or transfer.
formulas to give you the value of expected losses associated with a particular risk, based
on:

Page 9 of 71 Page 10 of 71

57 58
 December 2021 December 2021

4. Two Hundred Thousand Rupees or with imprisonment not exceeding three years or with both
a) What is CRM? How does CRM help to acquire, enhance and retain the customers? depending on the seriousness of the offence.

• Damage to any computer Information system

(2+6=8 marks)
If any person knowingly and with a mala fide intention to cause wrongful loss or damage to
b) Describe any four offensive actions related to computer/IT according to Electronic Transaction any institution destroys, damages, deletes, alters, disrupts any information of any computer
Act 2063. 7 marks source by any means or diminishes value and utility of such
Answer information or affects it injuriously or causes any person to carry out such an act, such a
person shall be liable to the punishment with the fine not exceeding
a) Customer relationship management is a cross-functional enterprise system that integrates and
two thousand Rupees and with imprisonment not exceeding three years or with both.
automates many of the customer serving processes in sales, marketing, and customer service that
interact with a company’s customers. CRM systems use information technology to support the • Publication of illegal materials in electronic form
many companies who are reorienting themselves into customer-focused businesses as a top
business strategy If any person publishes or displays any material in the electronic media including
computer, internet which are prohibited to publish or display by the prevailing law or which
CRM support the three phases of the relationship between a business and its customers.
may be contrary to the public morality or decent behaviour or any types of materials which
Acquire – a business relies on CRM software tools and databases to help it acquire new customers may spread hate or jealousy against anyone or which may jeopardize the harmonious
by doing a superior job of contract management, sales prospecting, selling, direct marketing, and relations subsisting among the peoples of various castes, tribes and communities shall be
fulfilment. liable to the punishment with the fine not exceeding One Hundred Thousand Rupees or with
The goal of these CRM functions is to help customers perceive the value of a superior product the imprisonment not exceeding five years or with both.
offered by an outstanding company.
5.
Enhance – Web-enabled CRM account management and customer service and support tools help
keep customers happy by supporting superior service from a responsive networked team of sales a) Why are systems vulnerable? Explain spoofing cyber-attack and mention the various techniques to
and service specialists and business partners. CRM sales force automation and direct marketing avoid spoofing attack. (2+3+3=8 marks)
and fulfilment tools help company’s cross-sell and up-sell to their customers, thus increasing their b) Why is the knowledge of business crucial to develop IT strategy? 7 marks
profitability to the business.
Answer
The value perceived by customers is the convenience of one-stop shopping at attractive prices.
a) Information systems are vulnerable to technical, organizational, and environmental threats from
Retain – CRM analytical software and databases help a company proactively identify and reward internal and external sources. The weakest link in the chain is poor system management. If
its most loyal and profitable customers to retain and expend their business via targeted marketing managers at all levels don't make security and reliability their number one priority, then the threats
and relationship marketing programs. to an information system can easily become real.
The value perceived by customers is of a rewarding personalized business relationship with “their • Spoofing is a specific type of cyber-attack in which someone attempts to use a computer,
company”. device, or network to trick other computer networks by masquerading as a legitimate entity.
b) The offensive action described by the Electronic Transaction Act 2063 of Nepal are summarized • It's one of many tools hackers use to gain access to computers to mine them for sensitive data,
as: turn them into zombies (computers taken over for malicious use), or launch Denial-of-Service
(DoS) attacks.
• To pirate, destroy or alter computer program sources code:
When computer source code is required to be kept as it is position for the time being • In IP spoofing, a hacker uses tools to modify the source address in the packet header to make
the prevailing law, if any person, knowingly or with malicious intention, pirates, the receiving computer system think the packet is from a trusted source, such as another
computer on a legitimate network, and accept it.
destroys, alters computer sources code to be used for any computer, computer program,
computer system or computer network or cause, other to do so, Various techniques to avoid spoofing attack
he/she shall be liable to the punishment with imprisonment not exceeding three years or with • The options to protect against IP spoofing include monitoring networks for atypical
a fine not exceeding two hundred thousand Rupees or with both. activity, deploying packet filtering to detect inconsistencies (like outgoing packets with
source IP addresses that don't match those on the organization's network), using robust
• Unauthorized access in computer materials
verification methods (even among networked computers), authenticating all IP addresses,
If any person with an intention to have access in any program, information or data of and using a network attack blocker.
any computer, uses such a computer without authorization of the owner of or the person
responsible for such a computer or even in the case of authorization, performs any act with • Placing at least a portion of computing resources behind a firewall is also a good idea.
an intention to have access in any program, information or data contrary to from such • By using secure encryption protocols like HTTPS — and only surfing sites that also use
authorization, such a person shall be liable to the punishment with the fine not exceeding them.

Page 11 of 71 Page 12 of 71

59 60
 December 2021 December 2021

d) Dimensions of feasibility study of information system

e) Importance of patents for IT industry
Answer
a) An information technology audit, or information systems audit, is an examination of the
management controls within an Information technology (IT) infrastructure. The evaluation of
obtained evidence determines if the information systems are safeguarding assets, maintaining data
integrity, and operating effectively to achieve the organization's goals or objectives. These reviews
may be performed in conjunction with a financial statement audit, internal audit, or other form of
attestation engagement.
The purposes of an IT audit are to evaluate the system's internal control design and effectiveness.
This includes, but is not limited to, efficiency and security protocols, development processes, and
IT governance or oversight. Installing controls are necessary but not sufficient to provide adequate
security. People responsible for security must consider if the controls are installed as intended, if
they are effective, or if any breach in security has occurred and if so, what actions can be done to
prevent future breaches.
The primary functions of an IT audit are to evaluate the systems that are in place to guard an
organization's information. Specifically, information technology audits are used to evaluate the
organization's ability to protect its information assets and to properly dispense information to
authorized parties. The IT audit aims to evaluate the following:
b) Though it seems that general IT needs of organizations are similar to each other, the specific IT
needs of each organization can be entirely different. For instance, the IT needs of an academic • Will the organization's computer systems be available for the business at all times when
institution, an industrial manufacturer, a hospital and a supermarket chain can be entirely different required? (known as availability)
from each other. The nature, scale and functional area of the IT system, services and processes • Will the information in the systems be disclosed only to authorized users? (known as security
being implemented in these organizations are dictated by various factors including but not limited and confidentiality)
to the following:
• Will the information provided by the system always be accurate, reliable, and timely?
i. Area of business (measures the integrity)
ii. Type of activity IT audit is important because it gives assurance that the IT systems are adequately protected,
iii. Geography of operation provide reliable information to users and properly managed to achieve their intended benefits.
Many users rely on IT without knowing how the computers work. A computer error could be
iv. Size and type of workforce repeated indefinitely, causing more extensive damage than a human mistake. IT audit could also
v. Regulatory environment help to reduce risks of data tampering, data loss or leakage, service disruption, and poor
management of IT systems.
vi. Specific business processes and functions.
b) Business to Customer e-Commerce is an online business done between business and customer.
Before formulating the IT strategy of the organization, the following questions have to be Business organizations publish websites with information about their services and products.
answered: Customers visit organizations’ websites from home (or location different from the organization’s),
i. What is the use of IT in my business process? read product/service information if liked place order, purchase product/service. Customers can pay
for the product also. The organization delivers the product to the customers.
ii. What are the benefits of implementing a specific IT enabled process?
c) Mobile Computing is a technology that allows transmission of data, voice and video via a computer
iii. What change can be enacted by implementing IT in a specific business area?
or any other wireless enabled device without having to be connected to a fixed physical link. The
iv. What is the impact on customer service, decision making process, competitive analyses, etc.? main concept involves −
Answer to each of these queries and many more like these needs a proper and thorough knowledge • Mobile communication
of the business and related processes. Without proper knowledge of business factors, an effective • Mobile hardware
and fruitful IT strategy cannot be formulated.
• Mobile software
6. Write short notes on: (5 x 3=15 marks)
Mobile Communication: This refers to the communication infrastructure set in place, including
a) Information system audit. wireless network infrastructure, protocols, data formats, bandwidths, and portals necessary to
b) Business to Customer ecommerce ensure seamless connectivity and communication.
c) Mobile computing
Page 13 of 71 Page 14 of 71

61 62
 December 2021 December 2021

Mobile Hardware: The hardware is the mobile computing devices and supporting devices, with In any area of business, academia or creative works, copyright protection is a major tool to ensure
the capabilities required to perform their required operations and connect to networks. that the main creator is properly recognized and rewarded.
Mobile Software: The most important software component is the operating system, which is the In IT industry, proper enforcement of this copyright protection mechanism is even more crucial
brain of any computing system. For a laptop, this may be Windows, Linux or mac OS, and for a because by the nature of the technology, the ideas and innovations have greater risk of being easily
smart phone, it may be Android or iOS. The different applications running on a device are also part
stolen or otherwise unlawfully used.
of the mobile software.
d) Various dimensions of feasibility can be summarized as: Like in other area, patents help the IT industry properly recognize and reward its creators and
innovators by legally protecting their claim on their creations. This mechanism of protecting the
• Technical feasibility copyright and rewarding the creator encourages other innovators to continue working on their
• Economic feasibility innovative ideas and bringing forward new innovations into the ecosystem. In essence, patent
protection mechanism acts as the catalyst of continued innovation, development and enhancement
• Operational feasibility in IT industry as well as other industries.
• Schedule feasibility
• Legal feasibility
Technical feasibility:
Technical feasibility is concerned with the hardware and software system involved. The technical
feasibility issues are as follows:
• Does the essential technology is available to do the task?
• Do the proposed equipment have the technical capacity to hold the data?
• Does the proposed system provide adequate responses to the inquiries regardless of the number
of users?
• Do the system has scalability feature?
• Does the system provide the data security, reliability and ease of access?
Economic feasibility:
Economic feasibility is concern about the incremental costs and benefits expected if the proposed
system is implemented. Various financial and economic concerns during the system analysis and
development phases are:
• Cost of conducting full system.
• Cost of technology.
• Benefits in terms of reduced costs.
Schedule Feasibility:
Schedule feasibility focuses itself on the time frame for needed for the development of new system
and make it operational. It also evaluates the promptness of the service provided after the
implementation of the new system.
Legal Feasibility:
Analysis of any possible conflict between newly proposed system and the legal obligations of the
organizations existing system is the main concern of the legal feasibility. For example, the new
system should comply with all applicable federal and state statutes about financial reporting
requirements as well as the company’s contractual obligations.
e) Importance of patents for IT industry
Patents are designed to protect the intellectual property of an invention, innovation or an idea that
has business value and hence risks being illegally copied or plagiarized by unauthorized people
thereby depriving the main creator or innovator of the deserved rewards of the innovation.
Page 15 of 71 Page 16 of 71

63 64
 June 2022 June 2022

vi) Don’t leave paperwork or laptops unattended: Data breaches can occur when staff and
Paper 5: Management Information and Control System volunteers leave paperwork or laptops unattended. Make sure you take steps to protect the
personal data you hold by being vigilant and storing it securely away when it’s not in use.
1. Suppose you are hired by a financial institution to design and develop a Financial Information vii) Make sure your Wi-Fi is secure: Using public Wi-Fi or an insecure connection could put
Management System (FIMS). The financial institution wanted to produce all the financial reports personal data at risk, so you should make sure you always use a secure connection when
of the institute easily and make those reports available to all the board members anytime connecting to the Internet.
anywhere. viii) Lock your screen when you’re away from your desk and make sure your staff do the
a) Which software development methodology will you use and why? (5+5=10) same. Taking steps to lock your screen when you leave your desk is a simple thing to do,
b) Financial data must be secured. What security measures will you apply to protect data from
but will prevent someone else from accessing your computer.
unauthorized users and access?
Answer: ix) Keep track of who has access to what: You have to restrict who has access to your IT
a) There are several software development methods like a waterfall, prototype, spiral, and agile systems and buildings – you can’t just let anyone in because this will leave your systems
methods. These days users want working software fast. Since they don’t necessarily need whole vulnerable. The fewer people have access, the better. Visitors should be clearly identifiable.
complete software in a single shot, I will choose extreme programming method for the financial Make sure you limit IT access to people who work for you, where possible. If someone
information system. leaves your company, or if they’re absent for long periods of time, you may want to
Extreme Programming (XP) is an agile software development framework that aims to produce consider suspending their access to your systems.
higher quality software and higher quality of life for the development team. XP is the most x) Don’t keep data for longer than you need it: Staying on top of what personal data you hold
specific of the agile frameworks regarding appropriate engineering practices for software will save you time and resources. It will also help you with your data protection
development. responsibilities. Only keep what you need, for as long as you need it.
The general characteristics where XP is appropriate were described by Don Wells: xi) Dispose of old IT equipment and records securely: Before you get rid of them, make sure
no personal data is left on personal computers, laptops, smartphones, or any other devices.
 Easy addressing of dynamically changing software requirements You could consider using deletion software or hiring a specialist to wipe the data. This will
 Easy addressing of risks caused by fixed time projects using new technology ensure no one can access the information they’re not supposed to see when you dispose of
 Small, co-located and extended development team the equipment.
 The technology being used should allow for automated units and functional tests
2. Suppose you are working as the IT head of ABC Company. Your company is currently using
b) Attacks and risks to data security do not apply for big organizations only. Small businesses, different information systems to support various business functions. Management team of the
groups and charities also have to protect their IT systems. Here are some practical steps that can company is planning to implement Enterprise Resource Planning (ERP) system as a single
be taken to tighten up data security. solution for different business function.
i) Back up the data: Regular backup should be taken of the critical data. The backed-up data
a) Do you think it is necessary to carry out business process re-engineering before the
should be stored somewhere other than the main workplace, if possible. Also, it is better to implementation of the ERP system? Why or why not? (7)
encrypt the data. That way, if there’s a break-in, fire or flood, the data loss can be b) What would be your backup and Recovery plan? (7)
minimized, and restoration can be quick. c) Why good training and documentation is necessary for the successful implementation of such
ii) Use strong passwords: Make sure you, your staff, volunteers, and anyone else involved in system? (3+3)
your operations uses strong passwords - including smartphones, laptops, tablets, email, Answer:
accounts and computers. a) Yes, it is necessary to carry out business process re-engineering because just automating the
iii) Take care when working remotely: If you, or people you work with do their work remotely, existing business practices will not help ERP to achieve the anticipated results because,
make sure the devices you use are as secure as the equipment you use in the office.
iv) Be wary of suspicious emails: Educate yourself and those working for you on how to spot Old Organization + New Technology = Expensive Old Organization
suspicious emails. Checking for obvious signs such as bad grammar, requests for you to act
Business Process Re-engineering [BPR] identifies the deficiencies of the existing setup and tries to
urgently, and requests for payment will help you avoid being caught out. If it looks replace those with more efficient processes and functions, leading to higher operational efficiency.
suspicious, don’t trust it – and warn your staff not to either. Effective BPR also leads to effective implementation of ERP creating more efficient processes and
v) Install anti-virus and malware protection and keep it up to date. workflows.
Page 4 of 77 Page 5 of 77

65 66
 June 2022 June 2022

Business Process Reengineering involves the radical redesign of core business processes to achieve  Once the problems have been determined and loss of data minimized, IT Staff should proceed
dramatic improvements in productivity, cycle times and quality. In Business Process Re- to restoration of data from backup media.
engineering, companies start with a blank sheet of paper and rethink existing processes to deliver
more value to the customer. They typically adopt a new value system that places increased Restoration of data
emphasis on customer needs. Companies reduce organizational layers and eliminate unproductive
activities in two key areas. First, they redesign functional organizations into cross-functional teams.  IT staff will determine the time and date of the lost data.
Second, they use technology to improve data dissemination and decision making.  IT staff will determine the appropriate backup media to restore the data.
 IT staff will insert the backup media into the appropriate server.
Objectives of Business Process Reengineering:  IT staff will invoke the Backup/Restore software, such as Veritas Backup Exec or Arcserve.
 IT staff will schedule the restore of the appropriate data within the Backup/Restore software.
 Refocus company values on customer needs  IT staff will monitor the restore of data.
 Redesign core processes, often using information technology to enable improvements  Upon restore, IT Staff will evaluate the integrity of the restored data.
 Reorganize a business into cross-functional teams with end-to-end responsibility for a process  IT staff will contact the end-user of the data to finalize restoration.
 Rethink basic organizational and people issues  Upon approval from the end-user, the restoration is considered finished.
 Improve business processes across the organization
Disaster Recovery

b) Backup and recovery methods are essential to data protection and security. Any loss of data due to  If a disaster occurs, IT Staff will determine the extent of the problem and proceed accordingly.
file corruption, virus, security or human error is a loss of time and money. Furthermore, loss of data  If the disaster is hardware related, IT Staff will replace the failed hardware and restore
can severely impact the success of a business. according to the steps outlined above.
The purpose backup and recovery plan is to provide a successful procedure for backup and  If there is a natural disaster, such as flood, fire, earthquake, or other, the hardware will be
recovery of critical data. Backup and recovery plan I suggest is as follows: replaced, and the server will be restored using the offsite backup media according to the steps
outlined above.
Backup Plan  Upon restoration of data, IT Staff will check the data for integrity and validity.
 IT Staff will contact the end-user of the data to finalize restoration.
 Server backups should be performed every business night, excluding holidays.  Upon approval from the end-user, the restoration is considered finished.
 Monthly backup tapes should be stored in a fireproof safe.
 The last two monthly tapes will be stored off-site in a fireproof safe. c) Importance of training and documentation for the successful implementation of such system
 Backups should be performed and monitored by a fulltime IT staff member. Implementing a new system in a company is a big change for many employees. Many times, a new
 Backups should be automated using Veritas Backup Exec, Arcserve or similar software or upgraded solution will include new sections, tools, buttons, and improved processes that will
product. allow businesses to be more productive in the long run and reduce human errors. However, because
 Backup failures should be reported to the Director of Information Technology and action will of all these changes and new processes, it is quite unlikely all users (employees) will be on the
be taken quickly to fix the problem. same page when learning the new system on their own, which can prevent the company from
 Backups will always be performed before upgrading or modifying a server. seeing all the efficiencies the IT provider promised with the upgraded system.
Training before the system officially goes live at the company will give employees a chance to get
Loss of data used to any new processes and work out any problems with the system before it is implemented.
This will also help with any resistance coming from employees who are hesitant of change. By
 If loss of data is discovered, evaluation and investigation by IT staff is immediately carried out. teaching employees from the company’s various departments on how to use the new system in the
 In most cases, loss of data is related to file corruption, virus, security, or human error. way it was meant to be used will eliminate any doubts, misunderstandings, unnecessary errors and
 If loss of data is related to data corruption, IT Staff must troubleshoot and determine if the problems.
problem is hardware or software related to prevent more file corruption. In conclusion, user training can truly help with implementation of a new system at a company and
 If the loss of data is related to a virus, IT Staff must determine the extent of the virus and ensure maximum efficiency right from the start.
remove it to prevent further loss of data.
 If the loss of data is related to security or a compromised system, IT Staff must determine the
extent of the compromise and fix the vulnerability quickly to prevent further loss of data.
 If the loss of data is related to human error, IT Staff must immediately inform and train the Necessity of good documentation
appropriate personnel to avoid further loss of data. Good documentation is critical for successful implementation of a new system because a good
documentation provides critical benefits such as:
Page 6 of 77 Page 7 of 77

67 68
 June 2022 June 2022

 Visibility (e.g., project plan, interim report) IT governance uses manages and optimizes IT in such a way that it supports, complements or
 User support (e.g., user manual) enables an organization to achieve its goals and objectives.
 Team communication (e.g., interface specifications) IT governance is a broad concept that is centered on the IT department or environment delivering
 Maintenance and evolution (e.g., requirements) business value to the enterprise. It is a set of rules, regulations and policies that define and ensure
 Serve as a vehicle of information to provide evidence of progress in the development process and the effective, controlled, and valuable operation of an IT department. It also provides methods to
to monitor the process. identify and evaluate the performance of IT and how it relates to business growth. Moreover, by
 Facilitate conversion of a system from one machine to another machine easier. following and implementing an IT governance framework such as COBIT, an organization can
 Facilitate system modification and implementation easier. comply with regulatory requirements and reduce IT business while attaining measurable business
 Help narrow down the communication gaps among users, designers and management. benefits.
 Provide means to determine in advance what will occur and when.
b)
3. There are different types of decision-making at different levels of management in the organization.
Decisions can be classified as structured, semi-structured, and unstructured. Unstructured
a) Why do we need knowledge of business for developing and using IT system? What is IT
decisions are those in which the decision-maker must provide judgment, evaluation, and insights
governance? (6 + 2=8)
into the problem definition. Structured decisions, by contrast, are repetitive and routine, and
b) What do you mean by structured and semi-structured decision-making problems? Differentiate
decision-makers can follow a definite procedure for handling them to be efficient. Semi-
between Decision Support system and Management Information system?
structured decisions are those in which only part of the problem has a clear-cut answer provided
(3 + 4 = 7)
by an accepted procedure. In general, structured decisions are more prevalent at lower
Answer:
organizational levels, and unstructured decision-making is more common at higher levels.
a)
The main difference between a Management Information System (MIS) and a Decision Support
First Part: We cannot successfully design and use IT system without having knowledge of the
business. An IT System can have a major impact on corporate strategy and organizational success. System (DSS) is that the MIS supports structured decision making while the DSS provides support
The involvement of managers and decision makers in all aspects of information systems is a major for unstructured or semi-structured decisions.
factor for organizational success, including higher profits and lower costs. Some of the benefits MIS provides information like reports for managers to make required decisions. It helps the
business organization seeks to achieve through information systems include better safety, operational and tactical levels of the organization. It mainly supports structured decision-making.
competitive advantage, fewer errors, greater accuracy, higher quality products, improved In other words, the decisions are well defined and described in detail. A DSS is a system that
communications, increased efficiency and productivity, more efficient administration, superior provides information for managers in the decision-making process. It provides support for
financial and managerial decision making.
unstructured or semi-structured decisions. In other words, these decisions cannot be described or
IT system should be designed to support different organizational business processes and
management decision making. IT systems can also be used to communicate with suppliers, defined in detail. DSS provides analytical power to the managers. Managers can switch the values
business partners, distributors, retailers, and even customers. To design and use IT system that of the attributes involved in the decision problems and see the impact of those changes in the
supports business activity efficiently and effectively, we should have knowledge of each and every problems.
activity within the organization including its structure, management style, business processes etc.
The IT system designed without having detail knowledge of the organization and its business
activities may not support the activities of the organization properly. Furthermore, the system may 4.
not fulfill the needs of different stakeholders that are affected by the IT system. The IT system a) What is mobile computing? How can modern businesses benefit from using mobile computing
designed without having detail knowledge of business may not technology? Why are mobile apps important for businesses? (2 + 3 + 3 = 8)
 Achieve the business goals articulated by the user department b) Why is it important to have a robust legal framework for development of IT industry? Discuss
 Operate at an acceptable cost, commensurate with the value produced for the firm the role of regulatory guidelines to ensure quality of an information system and its data. (3 + 4
 Meet carefully defined performance standards (such as response time and system availability) = 7)
 Produce accurate, reliable output
 Be easy to learn and use
 Be flexible

Second Part: Information Technology governance (IT governance) is the collective tools, Answer:
processes and methodologies that enable an organization to align business strategy and goals with
a)
IT services, infrastructure, or the environment.

Page 8 of 77 Page 9 of 77

69 70
 June 2022 June 2022

Mobile computing, as the name suggests, involves using the mobile handset to carry out various b) IT industry requires a lot of inter-organizational communication and sharing of data. It also
computing tasks. Though mobile started as a communication device, radical evolution of the involves a mechanism to deliver access to the end users over the network, often a public network.
ecosystem over the past two decades has meant that almost any task that can be performed by a This means various stakeholders have to be responsible towards proper use and safeguarding of the
computer can be performed by mobile devices. Modern smart phones are comparable and, in many related data & information based on the nature and criticality.
aspects, better than traditional computing devices such as desktops and laptops. Mobile devices are IT industry is also a sector where a lot of innovations and technological breakthroughs are
easy to handle, highly portable and have readily available data network to get connected to the happening regularly. As a result, those involved in such innovations and breakthroughs want their
outside world. Moreover, since mobile devices combine modern computing facilities through work to be protected against copyright infringement, piracy, plagiarism and other breaches.
specialized applications with modern communication and sharing services such as calls, instant
messages, emails and social networks, people can easily connect, collaborate and compute without By nature of the industry and because of the aspect of protection of data, privacy, intellectual
having to carry a heavy device, worry about connectivity and power. property and organizational confidentiality, the IT industry needs a proper legal framework and a
well-established mechanism to enforce that framework.
Because of the high prevalence and ever-increasing usability of mobile devices, modern businesses
are increasingly catering to the mobile user base to promote their products, services and solutions. Regulatory regimes for various sectors are established by the state to make sure that the activities
A business can benefit significantly by exploiting mobile computing and its user base. Some of the of those sectors are properly conducted while safeguarding the rights of the individual stakeholders
ways are: (both persons and entities). Since various organizations, entities and stakeholders of competing
interests can be involved in a particular sector or industry, a neutral body is needed to provide an
 It can promote new products easily through a mobile-friendly website. oversight and conduct regulation of the activities of those various stakeholders so that the rights of
 Social media, instant messaging and telecom facilities such as calls and SMS can be used to each are safeguarded. For example, in the financial sector, central bank makes sure all financial
push promotions, awareness messages and provide end user support. institutions function within the defined framework. Similarly, telecom, insurance, education and
 It can interact with existing and potential clients in real time through various communication every other sector of modern society is regulated by the state-established entity or framework
and interaction options available over mobile such as web pages, instant messaging, social specifically designed for that sector. These regulatory frameworks and guidelines also help ensure
that the information system of the entities of that sector can provide right information to the right
networks, collaboration suites etc.
stakeholder at the right time while also safeguarding the integrity, privacy, accuracy and
 A robust mobile presence makes it easier for the user to buy, use and provide feedback on the confidentiality. Regulatory guidelines also make sure that any breaches are promptly brought to
company’s products and services. notice of the relevant agency and quickly acted upon.
 Since people are almost always using their mobiles or checking them for updates, the new
information pushed over mobile platforms can immediately reach the targeted audience.
5.
Apart from the mobile friendly web pages, social media, collaboration tools and other mobile a) How do you align your business with information technology? What are the risks and opportunities
instruments, a dedicated mobile app ecosystem is a significant requirement for a modern business of using information technology in organizations? (4 + 4 = 8)
organization with a robust product portfolio and service delivery channel. This is because of
various factors that revolve around the wide prevalence of mobile devices, improving connectivity b) What do you mean by IT auditing? Explain the job and role of IT manager at the time of IT
and increasing tendency of the masses to use mobile devices rather than bigger computing devices. auditing. (2 + 5
Some of the factors accentuating importance of mobile apps are: = 7)
 Mobile apps are custom designed to provide the products or series to the end user with Answer:
minimum hassle and in a most efficient way possible under prevailing technology. a) First Part: Business – IT alignment is a process in which a business organization uses information
 Mobile apps are tailored to the specific device and its operating system so that user experience technology (IT) to achieve business objectives – typically improved financial performance or
marketplace competitiveness. Some definitions focus more on outcomes (the ability of IT to
in terms of speed, accuracy and usability are optimum. produce business value) than means (the harmony between IT and business decision-makers within
 Because of increasing quality of data networks, companies can use mobile apps to track their the organizations). Alignment is the capacity to demonstrate a positive relationship between
users and their activities such as service usage, purchase habits, perceptions and expectations in information technologies and the accepted financial measures of performance.
real time. This alignment is to solve a challenge that is often experienced in organizations: IT and business
 Mobile apps can thus be used to monitor the user activities, history, location etc. to provide professionals are unable to bridge the gap between themselves because of differences in objectives,
targeted promotions and tailored products in a subtle and effective way. culture, and incentives and a mutual ignorance for the other group's body of knowledge. This rift
 Mobile apps can be designed with embedded communication and feedback facility to instantly generally results in expensive IT systems that do not provide adequate return on investment. For
track user perceptions. That can be used to improve the products and services, leading to more this reason, the search for business-IT alignment is closely associated with attempts to improve the
business value of IT investments.
customer loyalty and greater business efficiency.
Business – IT alignment integrates the information technology to the strategy, mission, and goals
of the organization. Key characteristics in order to achieve this alignment are:
Page 10 of 77 Page 11 of 77

71 72
 June 2022 June 2022

 The organization must view information technology as an instrument to transform the business. from different countries easier and more convenient. It also means that you can have your
This includes exploring other revenue streams and integrating other facets of their business into goods delivered right to your doorstep without having to move a single muscle.
each other.  Creation of new types of jobs – One of the best advantages of information systems is the
 An organization must hold customer service, both externally and internally, with the utmost creation of new and interesting jobs. Computer programmers, Systems analyzers, Hardware and
importance. Communication between the organization and their customers must not be lost. Software developers and Web designers are just some of the many new employment
 An organization must rotate both IT and business professionals across different departments opportunities created with the help of IT.
and job functions. They must have the knowledge and experience of both sides of the business  Cost effectiveness and productivity – IT applications promote more efficient operation of the
so that understanding and communication is achieved. company and also improve the supply of information to decision-makers. These systems also
 An organization must provide clear and specific goals to both the IT and business employees. help companies to gain a competitive advantage. It has a positive impact on productivity.
This will create the integration of both entities to achieve a common goal.
 Ensure that IT and business employees understand how the company makes or loses money. b) Information Technology audit is the examination and evaluation of an organization's information
This is important so that money is not carelessly poured into the IT department and there is no technology infrastructure, applications, data use and management, policies, procedures, and
return on that investment. operational processes against recognized standards or established policies. Audits evaluate if the
 Organizations must create a vibrant and inclusive company culture. There must not only be controls to protect information technology assets ensure the integrity and are aligned with
informational unity, but a unified company as whole. organizational goals and objectives.
The audit announcement phase is the key time for an IT manager to begin preparing. This is also
Second Part: Information technology (IT) plays a critical role in many businesses. If you own or the phase that most IT managers ignore, which costs them dearly. Once an audit is announced, the
manage a business that makes use of IT, it is important to identify risks to your IT systems and
data, to reduce or manage those risks, and to develop a response plan in the event of an IT crisis. IT manager should have ample time to begin getting ready. They should take advantage of this time
Some of the common risks of using IT are: because once the auditors arrive, they will expect the IT manager to have their prep work done.
 Unemployment and lack of job security – Implementing information technology can save a Here are a few keyways to start preparing:
great deal of time taken while completing tasks and can reduce manual work. Most paperwork  IT managers should start collecting and centralizing all information that auditors might
can be processed immediately, and financial transactions are automatically calculated. As request. Gather things like system documentation, work or change requests, policy,
technology improves, tasks that were formerly performed by human employees are now carried procedures, risk assessment information, or penetration testing results. They may want to
out by computer systems. Industry experts believe that the Internet has made job security a big
develop a documentation portal where they can store the information and give auditors
issue since technology keeps on changing each day. This means that one has to be in a constant
learning mode, if he or she wishes for their job to be secure. granular access for a given period.
 Dominant culture – While information technology may have made the world a global village,  Review previous audits. Many teams overlook this. Do IT managers have any outstanding
it has also contributed to one culture dominating another weaker one. issues that need to be resolved? This will be first on an auditor’s checklist. IT manager
 Security issues – Thieves and hackers get access to identities and corporate saboteurs target should make sure she/he has done everything she/he said she/he would do after the last
sensitive company data. Such data can include vendor information, bank records, intellectual audit and documented it appropriately.
property and personal data on company management. The hackers distribute the information  Assign a point of contact (POC) for the auditors. This ensures IT managers are kept in the
over the Internet, sell it to rival companies or use it to damage the company’s image.
loop regarding any changes. If the intended purpose or timelines change, they will want to
 Implementation expenses – To integrate the information system it requires pretty good
amount of cost in a case of software, hardware and people. Software, hardware and some other be the first to know. They should also begin to plan for resource utilization to handle time-
services should be rented, bought and supported. Employees need to be trained with unfamiliar consuming audit responses. They need to make sure their people have availability during
information technology and software. the engagement. If they see any red flags, talk with their auditor. Now is the time to try and
Information technology contributes to the efficient running of organizations. Information systems adjust the schedule, not three weeks before they are on-site.
are showing the exponential growth in each decade. Some of the common opportunities are:  If IT manager don’t have a self-assessment process, start one now. This shows auditors that
 Communication – With help of information technologies the instant messaging, emails, voice he/she has a continual process and system reviews to identify any gaps and work toward
and video calls becomes quicker, cheaper and much efficient.
remediation objectives.
 Globalization and cultural gap – By implementing information systems we can bring down
the linguistic, geographical and some cultural boundaries. Sharing the information, knowledge,
communication and relationships between different countries, languages and cultures becomes
Role of IT manager in IT auditing task:
much easier.
 Availability – Information systems has made it possible for businesses to be open 24×7 all  Plan, coordinate and execute audit activities at organization level.
over the globe. This means that a business can be open anytime anywhere, making purchases
Page 12 of 77 Page 13 of 77

73 74
 June 2022 June 2022

 Communicate with operational staffs and management to obtain inputs for audits. appoint or assign a Deputy Controller and other employees as required. The employees so
 Report audit findings and conclusions to management. appointed or assigned shall perform their functions under the general direction and control of the
Controller. The functions, duties, and powers of controller are given below:
 Supervise audit staffs on their assigned engagements.
 To issue a license to the certifying Authority.
 Assist audit staffs in performing complex audits and reviews.  To exercise the supervision and monitoring over the activities of Certifying Authority.
 Develop an auditing program to offer comprehensive audit coverage within the  To fix the standards to be maintained by certifying authority in respect to the verification of
organization. digital signature.
 Analyze risks associated with IT processes and assess the effectiveness of the internal  To specify the conditions to be complied with by the certifying authority in operating his/her
control systems. business.
 Establish standard procedures and policies for IT auditing.  To specify the format of the certificate and contents to be included therein.
 To specify the procedures to be followed by the certifying authority while conducting his/her
 Determine the audit scope and objective and accordingly prepare the audit work plan.
dealings with the subscribers.
 Resolve auditing and operational issues in a timely fashion.  To maintain a record of information disclosed by the certifying authority under this act and to
 Set priorities, identify necessary audit plan changes, supervise audit processes and prepare make provision of computer database accessible to public and to update such database.
detailed reports on findings.  To perform such other functions as prescribed.
 Ensure that audit processes comply with company standards.
 Review audit reports for correctness and completeness before submitting them to c. Customization of website
management. Website personalization is the art of offering an exclusive, one-on-one custom-made experience to
your online visitors when they land on the website. Users experience is customized based on their
past purchases, their geography or behavior in a manner that serves multiple business purposes –
6. Write short notes on: (5×3=15) higher customer satisfaction, longer visit duration, boosted site visits, lower bounce rate, better
a) Fuzzy logic conversions, and an improved brand reputation.
b) The functions, duties and powers of Controller under Electronic Transaction Act, The concept of personalization has been there for decades now. While it has been more prominent in
2063 the retail market where customers enter a shop, and the seller readily shows products that suit
c) Customization of website customers’ needs, the scope of personalization was missing in the online marketplace. Realizing its
d) C2C E-commerce importance, especially in terms of revenue generation and shopping experience, more and more
e) XML Standard for digital data exchange online brands are now exploring this arena.
The better the website personalization experience, the better the website of the organization can
Answer: serve its online visitors and help them achieve their goals. This will further lead to a better retention
a. Fuzzy logic rate, higher sales and better word of mouth for the brand.
The term fuzzy refers to things that are not clear or are vague. In the real world many times we
encounter a situation when we can’t determine whether the state is true or false, their fuzzy logic
provides very valuable flexibility for reasoning. In this way, we can consider the inaccuracies and
uncertainties of any situation. d. C2C E-commerce
In the Boolean system truth value, 1.0 represents the absolute truth value and 0.0 represents the C2C or consumer to consumer electronic commerce involves direct transaction between individuals
absolute false value. But in the fuzzy system, there is no logic for the absolute truth and absolute using available electronic means. Those individuals can use a third-party common platform for
false value. In fuzzy logic, there is an intermediate value too which is partially true and partially carrying out those transactions but the commercial exchange of goods/services and the related
false. Fuzzy logic is useful for commercial and practical purposes. financial transaction is between the two individuals. For example, two persons can use Facebook to
 It can control machines and consumer products. get in touch as buyer and seller and transact using a digital wallet to make payment and a courier to
 It may not give accurate reasoning, but acceptable reasoning. deliver the goods. Though the wallet and courier provider are third party, they are not directly
 Fuzzy logic helps to deal with the uncertainty in engineering. involved in the actual buying/selling between the two persons. Hence this is in essence a C2C
b. The functions, duties and powers of Controller under Electronic Transaction Act, 2063 transaction. A rapid increase in number of P2P or C2C transactions is caused by the wide adoption
Government of Nepal may, by notification in the Nepal Gazette, designate any Government officer of social media, digital payment platforms and online delivery service providers as these platforms
or appoint any person who has qualifications in the office of the Controller. Government of Nepal enable individuals to contact each other, pitch product, agree on prices, make payment and deliver
may, in order to assist the Controller to perform his/her functions to be performed under this Act, the purchased item without having to go to any organization for support or involvement.
Page 14 of 77 Page 15 of 77

75 76
 Suggested Answers December 2022 Examination (CAP III - Group II)

June 2022

Paper 5: Management Information and Control System

e. XML Standard for digital data exchange
XML or Extensible Markup Language is a standard tool used for data exchange. It is an open
standard that enables various information systems to exchange data over standard API or
1. A hotel located in Patan is very popular among foodies for its delicious
Application Programming Interfaces. Moreover, XML is evolved out of Internet and hence can
meals, and lovely environment. This hotel has very good volume of
facilitate easy, secure and flexible data exchange over the public network. Because of the clearly customers. It has a simple billing system installed to produce bills. But has
defined structure, syntax and a wide support across platforms, XML based services can be easily no proper database to analyze its past business and do trend analysis. Suppose
accessed and used by a wide range of devices including handheld and portable devices as well. An you, software consultant, are appointed by the hotel to develop a database
XML schema allows data exchange in a standardized structure. That means if two devices, management system to keep track of all the businesses and do data analysis
irrespective of their make, model or core function, can support XML, they can easily interact with tasks.
’’

each other. XML is essentially extensible. That means it allows creation of new data exchange a) List the steps you go through to develop a database management system
language or flow by simply defining new elements such as tags and structures. Because of its for the hotel and describe two of the most important software
inherent flexibility and widely accepted standard, XML is the main driver of modern data exchange development steps from your point of view for the system development.
across various devices, platforms and systems. (4+3+3=10)
b) Explain the security measures you consider to protect data of the hotel.
10

Study the existing billing system

Collect requirements from the managers of the hotel, what they want to analyze,
what information they want, what business processes are run in the hotel, input
and output of those business processes etc.
Conceptual design of the software system will be developed on the basis of the
collected requirements, wireframes of user interfaces will be developed. Those
wireframes will be communicated with the users of the hotel. Different modules
will be developed.
The developed modules will be tested with real world data. Users will be asked
to check and test the system.
Then the software will be implemented in the real-world scenario.

Requirement collection: Requirements Gathering is a fundamental part of any

software development project. These are things like “User wants to do X. How
is this achieved?” In effect, Requirements Gathering is the process of generating
a list of requirements (functional, non-functional, technical, etc.) from all the
stakeholders (customers, users, vendors, IT staff) that will be used as the basis
for the formal definition of what the project is. Because the requirements define
the project, poorly written requirements can cause problems during
development and, more seriously, cause projects to fail if the goals have been
misunderstood.
System testing: Software Testing is a method to check whether the actual
Page 16 of 77
software product matches expected requirements and to ensure that software
product is Defect free. It involves execution of software/system components

77 4

78
 Suggested Answers December 2022 Examination (CAP III - Group II) Suggested Answers December 2022 Examination (CAP III - Group II)

using manual or automated tools to evaluate one or more properties of interest. with the access, the better. Visitors should be clearly identifiable. Make sure to limit
The purpose of software testing is to identify errors, gaps or missing IT access to people who work for the organization, where possible. If someone
requirements in contrast to actual requirements. leaves the company, or if they’re absent for long periods of time, don’t forget to
suspend their access to your systems.
1 b) Cyber-attacks do not only happen to large corporations. Small businesses, groups Don’t keep data for longer than you need it
and charities have to protect their IT systems, too. Staying on top of personal data will save the time and resources. It will also help
Here are some practical steps that can be taken today to tighten up data security. enforce the data protection responsibilities. Only keep what is needed, for as long
as it is needed.
Back up data
Dispose of old IT equipment and records securely
, if there’s a break
we don’t lose everything.

information they’re not suppose

Make sure staff, volunteers, and anyone else involved in the operations uses strong
passwords - including smartphones, laptops, tablets, email accounts and computers. 2. Assume that you are working as the ICT Manager for trading house. You
have to suggest changes/modification/upgrade of existing system of your
Take care when working remotely
organization. In this scenario answer the following question.
Make sure the devices used are as secure as the equipment used in the office. Also
a)
be mindful of the surroundings.
Be wary of suspicious emails b)
Educate those working in the organization on how to spot suspicious emails.
Checking for obvious signs such as bad grammar, requests to act urgently, and c)
requests for payment will help avoid being caught out. If it looks suspicious, don’t
trust it – and warn staffs not to either.
Install anti-virus and malware protection
And keep it up-to-date.
Don’t leave paperwork or laptops unattended
Data breaches can occur when staff and volunteers leave paperwork or laptops • The operational outcome of the system. Sometime due to the changing
unattended. This could be in the boot of a car, on a train, or at home. Make sure organizational environment and growth of the organization, the output of the
steps are taken to protect the personal and organizational data by being vigilant and system becomes insufficient and ineffective. So there arises the need for
storing it securely away when it’s not in use. modification. Thus, firstly I will analyze the need of the business and the
Make sure your Wi-Fi is secure services that we are getting from the existing system. Based upon the gap I will
Using public Wi-Fi or an insecure connection could put personal data at risk, so recommend.
make sure to always use a secure connection when connecting to the internet. • Technology saturation or need of new technology. The programing language,
frameworks and architecture of the development of the system might be
Lock your screen when you’re away from your desk
outdated so there needs to be the upgrade of the new system. Sometimes the
And make sure your staff do the same. Taking steps to lock your screen when you system should be upgraded due to changing need of hardware as well.
leave your desk is a simple thing to do, but will prevent someone else from • The technical support from the vendor. Sometimes, the system could be so old
accessing your computer. that the vendor would be unable to provide the technical support to keep it
Keep on top of who has access to what running. So, in this case there arises the need of upgrading the existing system.
Restrict who has access to the IT systems and buildings – don’t let just anyone in
unaccompanied because this will leave the systems vulnerable. The fewer people

5 6

79 80
 Suggested Answers December 2022 Examination (CAP III - Group II) Suggested Answers December 2022 Examination (CAP III - Group II)

• The existing capacity of the database may become insufficient to hold the
growing volume of the data. So, to hold the increased demand of capacity,
upgrade of the system is recommended.
• Sometimes the system needs to be upgraded to eradicate the errors and bugs and
vulnerability in the existing system. i.e., Organization needs. So, I will check if
there is any errors and bugs in the system.
• Budget is also very important parameter. While changing/modifying/upgrading • Backup Plan
the system the investment and benefit in return has to be properly analyzed so
• Emergency Plan
that it is financially sustainable. I will verify the budget that can be allocated for
• Proper Recovery Plan
the changes.
• If organization is up-scaling or diversifying the business, this might be another
issue to change/modify/upgrade the system. So, I will have detail idea about the
future plan of my organization.

• Making copy of data regularly

• Automation of data backup process
• Saving of backed-up data on different medium
• Saving of backed-up data on different location

• Personnel to be notified in case of disaster

• Equipment to be operated or shutdown
• Procedures to be followed

• Formation of recovery committee

• Prioritizing the applications and systems to be recovered
• Replacement of hardware and network

3.
a) How do systems serve different management groups in a business?
Explain role of information system at the knowledge level of the
organization.

the value stored in consumers’ bank, checking or credit card account and some of (6+2=8)
b) Rapid technological obsolescence is a major challenge in IT industry. As
an IT strategist in a modern business organization, what would you do to
ensure that the system you deploy will be able to resist rapid
obsolescence? What are the major impacts of the system being obsolete?
(4+3=7)

7 8

81 82
 Suggested Answers December 2022 Examination (CAP III - Group II) Suggested Answers December 2022 Examination (CAP III - Group II)

incorporate data about external events such as new tax laws or competitors, but
3 a) First Part: A typical business has different systems supporting the decision-making they also draw summarized information from internal MIS and DSS.
needs of each of the main management groups. Operational management, middle These systems are not designed to solve a specific problem but they provide a
management, and senior management each use systems to support the decisions generalized computing and telecommunication capacity that can be applied to a
they must make to run the company. changing array of problems. 5-year operating plan is an example in which ESS can
Systems serving operational management are transaction processing systems (TPS), be used.
such as payroll or order processing, that track the flow of the daily routine
transactions necessary to conduct business. Management information systems
(MIS) produce reports serving middle management by condensing information the business. These systems consist of office systems for increasing data workers’
from TPS, and these are not highly analytical. Decision-support systems (DSS)
support management decisions that are unique and rapidly changing using advanced workers’ productivity.
analytical models. All of these types of systems provide business intelligence that
helps managers and enterprise employees make more-informed decisions. These
systems for business intelligence serve multiple levels of management and include
executive support systems (ESS) for senior management that provide data in the
form of graphs, charts, and dashboards delivered via portals using many sources of
internal and external information.
• Transaction Processing Systems: These are the computerized systems that
perform and records the daily routine transactions necessary to conduct business.
These systems serve the operational level of the organization. Some examples
include sales order entry, hotel reservation systems, payroll, employee record
keeping, and shipping. Transaction processing systems are central to a business.
TPS failure for a few hours can cause a firm’s demise and perhaps other firms
linked to it. Managers need TPS to monitor the status of internal operations and
the firm’s relations with external environment. TPS are also major producers of
information for the other types of systems.
Online transaction processing systems (OLTPS) is an interactive data
processing system that involves a direct connection between TPS programs and
users. As soon as a single transaction is entered into a computer system, the
program interacts immediately with the user for that transaction. It is often
known as the live system where there is no time lag between data creation and
its processing. A good example of this system is online ticket reservation system.
• Management Information Systems: These are the information systems at the
management level of an organization and serve management-level functions like
planning, controlling, and decision-making. These systems provide routine
summary of reports and, in some cases, with online access to the organization’s
current performance and historical records to managers. Typically, these systems –
use internal data provided by the transaction processing systems. These systems
are used for structured decision-making and in some cases for semi-structured
decision making as well.
• Decision Support Systems: These systems also serve at the management level
of the organization. These systems combine data and sophisticated analytical ➢ Have a clear plan for short, medium and longer term. On the longer term, even the
models or data analysis tools to support semi-structured and unstructured physical platform may need partial or complete overhaul. Short term requirements
decision-making. These systems use internal information from TPS and MIS, may include patching, updates, small developments etc. Medium term may involve
and often information from external sources, such as current stock prices or
evolution of the core software, changes in major functions etc.
product prices of competitors. DSS have more analytical power than other
➢ Use of a modern, flexible and dynamic platform for development and deployment so
systems. Contract cost analysis is an example in which DSS can be used.
that the technological changes in foreseeable future are easily addressed. For example,
• Executive Support Systems: These systems serve the strategic level of the
organization. These systems are designed to address unstructured decision a modular hardware architecture, virtualization and scalability can address short to
making through advanced graphics and communication. These systems

9 10

83 84
 Suggested Answers December 2022 Examination (CAP III - Group II) Suggested Answers December 2022 Examination (CAP III - Group II)

medium term hardware changes while use of modern, omni-channel software

architecture can handle evolution on the software front.
➢ Keep the manpower skillset constantly updated to keep in pace with the technological
changes. ➢ Use a development technology that can provide easy switch from desktop to mobile
➢ Incorporate requirement of flexibility and modularity in the system if it is in stage of without loss of function or consistency of operation.
design and formulation of requirement before procurement or development. ➢ Incorporate the mobile as well as fixed UI/UX considerations from the beginning.
➢ Have an up-to-date idea of what the technological trend is and how the industry is ➢ Make the applications as clean and clutter-free as possible as a small mobile screen
adapting to those changes. A lot can be learned from peers in terms of adapting to cannot handle all the gibberish and details of a conventional desktop environment.
changes in an efficient way. ➢ Size the infrastructure to handle small but frequent sessions or requests which as the
➢ Have a clear agreement with the developer/supplier to get timely information and norm for mobile users.
support regarding impending obsolescence and plan of action to mitigate adverse ➢ Make the end applications as light and universal as possible.
effects. ➢ Consider the current and near future mobile device environment changes so that as
many devices and screen sizes are supported as possible.
➢ Have a clear strategy to provide clear message to the end users about the device
support and the pre-requisites because as the mobile device ecosystem is huge, not all
devices and platforms can be served with proper quality. So, focus on the most
➢ Need for significant reinvestment of money, time and manpower that can have major
prevalent ones.
impact on the company.
➢ Probable disruption of services if there are problem in important functions and
solutions cannot be found due to the system being obsolete and out of support.
➢ Need to carry out painful and cumbersome migration when the system has to be ➢ Choice of right technology.
replaced by a new one. ➢ Use of modern web technology that can easily adapt to various screen sizes.
➢ Difficulty to get proper and timely support from vendor/supplier. ➢ Focus on standalone apps for mobile devices and web (with modern scripting tools)
➢ Need to re-train the workforce to the new system or processes that are incorporated to for big screen.
replace the obsolete ones. ➢ Use of a common development platform, if possible, for various mobile platforms
Current tech environment provides such development platforms.
4.

a) Mobile computing is increasing in its scope and diversity. Supposing

yourself as a IT strategist of an online trading house, describe the major
factors that you consider to make your system mobile-friendly. How can
you make the system capable of serving both mobile and desktop users?
(5+3=8)
b) Explain the working principle of digital Signature generation and
verification process with neat diagram. Why it is necessary to do
System Audit in business organization? (4+3=7)

✓ Each person adopting this scheme has a public-private key pair.

✓ The private key used for signing is referred to as the signature key and the public
key as the verification key.
✓ Signer feeds data to the hash function and generates hash of data.

11 12

85 86
 Suggested Answers December 2022 Examination (CAP III - Group II) Suggested Answers December 2022 Examination (CAP III - Group II)

✓ Hash value and signature key are then fed to the signature algorithm which
produces the digital signature on given hash. Signature is appended to the data
and then both are sent to the verifier.
✓ Verifier feeds the digital signature and the verification key into the verification
algorithm. The verification algorithm gives some value as output.
✓ Verifier also runs same hash function on received data to generate hash value. ➢ Is the BCP complete in terms of the possible scenarios, options and contingencies?
✓ For verification, this hash value and output of verification algorithm are ➢ Is the BCP well-documented?
compared. Based on the comparison result, verifier decides whether the digital
➢ Is the corresponding team or workforce well-versed with the BCP?
signature is valid.
➢ Does the BCP have clear stipulation of the main procedure and an alternate course of
✓ Since digital signature is created by ‘private’ key of signer and no one else can
have this key; the signer cannot repudiate signing the data in future. action if the main option does not work?
➢ Does the plan include detailed information about the stakeholders, points of contact,
Instead of signing data directly by signing algorithm, usually a hash of data is their roles and escalation procedure?
created. Since the hash of data is a unique representation of data, it is sufficient to
➢ Is the supplier/vendor well-versed with the plan or is the plan supported/verified by
sign the hash in place of data. The most important reason of using hash instead of
the partner?
data directly for signing is efficiency of the scheme.
➢ Does the plan have detailed information of the steps and timeline of each?
Necessity of System audit ➢ Does the plan provide sufficient consideration towards communication to the
IT audit is a process wherein you evaluate and examine the organization’s IT stakeholders and making them at ease with the restoration activity being performed?
infrastructure, policies, and operation. It covers a wide range of software
applications, security systems, operating systems, and more.
Your IT systems are always vulnerable to multiple risks and as you continuously ➢ Changes in business processes in terms of new additions, updates etc.
rely on technology or your company’s IT system, it is essential to protect it from ➢ Changes in capability of the environment because of obsolescence, upgrades, bugs
various threats. Since an IT audit’s main objective is to identify inaccuracies and etc.
inefficiencies in the management and use of the IT system, it is necessary for any ➢ Changes in team, both at the working level and strategic level.
business. IT audit is essential to ensure that your system is not vulnerable to any ➢ Changes in the regulatory and legal environment that might impact the BCP and its
attacks. enforcement.
IT audit isn’t a simple procedure, but it is helpful when you want to ➢ Change of system or its components in terms of functions, nature of data or processes
company’s IT infrastructure. IT of operation.

company’s business operation.

First Part: We cannot successfully design and use IT system without having
knowledge of the business. An IT System can have a major impact on corporate
5.
strategy and organizational success. The involvement of managers and decision
makers in all aspects of information systems is a major factor for organizational
a) Assume you are specifically assigned as IS auditor to audit the business success, including higher profits and lower costs. Some of the benefits business
continuity plan of the main IT system of a financial institution. What will organizations seek to achieve through information systems include: better safety,
be the major factors that you will focus on? Why is it important to have competitive advantage, fewer errors, greater accuracy, higher quality products,
the BCP regularly audited and updated? (5+3=8) improved communications, increased efficiency and productivity, more efficient
b) Why do we need knowledge of business for developing IT system? What administration, superior financial and managerial decision making.
is IT governance? (4+3=7)
IT system should be designed to support different organizational business processes
and management decision making. IT systems can also be used to communicate
with suppliers, business partners, distributors, retailers, and even customers. To
design and use IT system that support efficiently and effectively, we should have
knowledge of each and every activity within the organization including its structure,
management style, business processes etc. The IT system designed without having
detail knowledge of the organization may not support the activities of the
organization properly. Furthermore, the system may not fulfill the needs of different

13 14

87 88
 Suggested Answers December 2022 Examination (CAP III - Group II) Suggested Answers December 2022 Examination (CAP III - Group II)

stakeholders that are affected by the IT system. The IT system designed without
having detail knowledge of business may not
• achieve the business goals articulated by the user department • Confidentiality
• operate at an acceptable cost, commensurate with the value produced for the firm • Integrity
• meet carefully defined performance standards (such as response time and system • Availability/Access Control
availability)
• produce accurate, reliable output • Non-Repudiation
• be easy to learn and use
• be flexible

Second Part: Information technology governance (IT governance) is the collective

tools, processes and methodologies that enable an organization to align business
strategy and goals with IT services, infrastructure or the environment.
IT governance uses manages and optimizes IT in such a way that it supports,
complements or enables an organization to achieve its goals and objectives.

6. Write short notes on: (5×3=15)

a) User interface design
b) General attributes of Information System Security
c) Electronic fund transfer
d) e-Governance
e) Liabilities of the network service provider as per Electronic Transaction
Act, 2063.

15 16

89 90
 Suggested Answers December 2022 Examination (CAP III - Group II) Suggested Answers June 2023 Examination (CAP III - Group II)

Paper 5 – Management Information and Control System

All questions are compulsory. Working notes should form part of the answer. Make
assumptions wherever necessary.

1. Assume that you are working as a system analyst in a software development company. Your
company assigned you in a software development project to develop human resource management
software for “ABC Company”. Based on this scenario, answer the following questions:
• Liabilities referred to in the agreement with the subscriber in regard to the a. How do you model data and processes for this software during analysis phase? (10)
provision of the said service. b. Why do you incorporate controls into the design and implementation of information systems?
• Liabilities referred to in the license of the network service providers. Explain general controls and application controls that are used to control the system. What is the
• Any other liability as prescribed. role of auditing in the control process? (2 + 6 + 2 = 10)

Answer
1 a) Data Modeling: During analysis phase, a systems analyst uses entity relationship diagram (E-R
diagram) as a data modeling tool. A data model is a detailed model that captures the overall structure
of organizational data while being independent of any database management system or other
implementation consideration. The E-R diagram is a graphical representation that has three basic
concepts: entities, attributes, and relationships.
An entity is a person, place, object, event, or concept in the user environment about which the
organization wishes to capture and store data. An entity set is a collection of entities that share
common properties or characteristics. For example, STUDENT is an entity set. An entity set in E-
R diagram is drawn using rectangle.
Each entity type has a set of attributes associated with it. An attribute is a property or characteristic
of an entity that is of interest to the organization. For example, STUDENT entity set can have
Student_ID, Student_Name, Home_Address, Phone_Number, and Major as its attributes. An
attribute in E-R diagram is drawn using an ellipse. Every entity type must have an attribute or set
of attributes that distinguishes one instance from other instances of the same type. A candidate key
is an attribute or combination of attributes that uniquely identifies each instance of an entity type.
Some entity type may have more than one candidate key. In such a case, we must choose one of the
candidate keys as the identifier. An identifier (or primary key) is a candidate key that has been
selected to be used as the unique characteristic for an entity type. A multi-valued attribute may take
more than one value for each entity instance. We use a double-lined ellipse to represent multi-
valued attribute. An attribute that has meaningful component parts is called composite attribute. An
attribute whose value can be computed from related attribute values is called derived attribute. We
use dashed ellipse to denote derived attribute.
A relationship is an association between the instances of one or more entity types that is of interest
to the organization. We use diamond to denote relationships. Relationships are labeled with verb
phrases. The cardinality of a relationship is the number of instances of one entity type that can (or
must) be associated with each instance of another entity type. The cardinality of a relationship can
be in one of the following four forms: one-to-one, one-to-many, many-to-one, and many-to-many.

Process Modeling: Process modeling involves graphically representing the functions or processes
that capture, manipulate, store, and distribute data between a system and its environment and
between components within a system. A common form of a process modeling tool is a data flow
diagram (DFD). A data flow diagram (DFD) is a tool that depicts the flow of data through a system
and the work or processing performed by that system. It is also called bubble chart, transformation
graph, or process model. There are two different sets of data flow diagram symbols, but each set
consists of four symbols that represent the same things: data flows, data stores, processes, and
sources/sinks (or external entities).
Process is the work or actions performed on data so that they are transformed, stored or distributed.
Data store is the data at rest (inside the system) that may take the form of many different physical
17
The Institute of Chartered Accountants of Nepal 3

91 92
 Suggested Answers June 2023 Examination (CAP III - Group II) Suggested Answers June 2023 Examination (CAP III - Group II)

representations. External entity (source/sink) is the origin and/or destination of data. Data flow For this audit, the auditor usually interviews key individuals who use and operate a specific
represents data in motion, moving from one place in a system to another. information system concerning their activities and procedures. Application controls, overall
integrity controls, and control disciplines are examined. The auditor should trace the flow of sample
b) First Part: To minimize errors, disasters, interruptions of service, computer crimes, and breaches transactions through the system and perform tests, using, if appropriate, automated audit software.
of security, controls must be incorporated into the design and implementation of information
systems. The combination of manual and automated measures that safeguard information systems
and ensure that they perform according to management standards is termed controls. Controls 2. ABC Pvt. Ltd, through its subsidiaries, operates approximately 80 department stores in the different
consist of all the methods, policies, and procedures that ensure protection of the organization’s cities of Nepal. Its retail stores sell a range of merchandise, including adult and children’s apparel,
assets, the accuracy and reliability of its records, and operational adherence to management accessories, cosmetics, home furnishings, and house wares. Senior management wants to develop
standards. online shopping system for the company. Assuming you are hired as an IT consultant to analyze,
In the past, the control of information system was addressed only toward the end of implementation, design and implement the system:
just before the system was installed. Today, Organizations must identify vulnerability and control
issues as early as possible. The control of an information system must be an integral part of its a. What are the issues which you typically consider in feasibility study? Briefly explain the importance
design. Users and builders must pay close attention to controls throughout the system’s life span. of Software Requirement Specification (SRS). (4+3=7)
b. What will be the major features that shall make it a good e-commerce platform for ABC Pvt. Ltd?
Second Part: Computer systems are controlled by a combination of general controls and (6)
application controls. General controls establish the framework for controlling design, security, c. What are the areas which you include in disaster recovery and planning document? Discuss the
and use of computer programs and the security of data files in general throughout an organization. resources that must be considered in backup plan. (4+3=7)
Application controls, on the other hand, are specific controls unique to each computerized
application. Answer
a) The following issues are typically addressed in the Feasibility Study:
• General Controls and Data Security: General controls include software controls, physical ✓ Determine whether the solution is as per the business strategy.
hardware controls, computer operations controls, data security controls, controls over the systems ✓ Determine whether the existing system can rectify the situation without a major modification.
implementation process, and administrative controls. Although most of these controls are designed ✓ Define the time frame for which the solution is required.
and maintained by information systems specialists, data security controls and administrative ✓ Determine the approximate cost to develop the system.
controls require input and oversight from end users and business managers. ✓ Determine whether the vendor product offers a solution to the problem.
Software controls monitor the use of software and prevent unauthorized access of software
programs, system software, and computer programs. Hardware controls ensure that computer Software Requirement Specification (SRS) is a descriptive note about the software that is under
hardware is physically secure, and check for equipment malfunction. Computer operations development. It is documented by the developer of the software for the clients and users and
controls oversee the work of the computer department to ensure that programmed procedures are describes the purpose of the software. It gives a detailed overview of the software product, its
consistently and correctly applied to the storage and processing of data. Data security controls parameters and goals.
ensure that valuable business data file on either disk or tape are not subject to unauthorized access,
change, or destruction while they are in use or in storage. Implementation controls audit the Importance of Software Requirement Specification (SRS) are
systems development process at various points to ensure that the process is properly controlled and ✓ The users and the client get a brief idea about the software while in the initial stages.
managed. Administrative controls formalize standards, rules, procedures, and control disciplines ✓ The purposes and the intentions as well as the expected results are properly defined. It hence lays
to ensure that the organization’s general and application controls are properly executed and the outline for software design.
enforced. ✓ The desired goals are defined thereby easing off the efforts of the developers in terms of time and
cost.
• Application Controls: Application controls include both automated and manual procedures that ✓ It forms a basis for the agreement between the client and the developer.
ensure that only authorized data are completely and accurately processed by an application. These ✓ It becomes easier while transferring and using the solution elsewhere or with new customers as the
are unique to each computerized application. Application controls include input controls, basis of functioning of the software is mentioned.
processing controls, and output controls. ✓ It acts as a material for reference at a later stage.
Input controls check data for accuracy and completeness when they enter the system. These are ✓ It acts as the basis for reviews.
specific input controls for input authorization, data conversion, data editing, and error handling.
Processing controls establish that data are complete and accurate during processing. Output b) The online shopping system for ABC Pvt. Ltd. shall also serve as a modern e-commerce platform.
controls ensure that the results of computer processing are accurate, complete, and properly To make sure that the system can perform as a modern and full-featured e-commerce platform, the
distributed. following features shall be incorporated:
Third Part: To know that information systems controls are effective, organizations must conduct ➢ The portal shall have a modular, intuitive and easy user interface.
comprehensive and systematic audits. An MIS audit identifies all the controls that govern ➢ It shall allow users to view items and provide feedback/reviews with necessary interaction by the
individual information systems and assess their effectiveness. To accomplish this, the auditor must representatives of the company.
acquire a thorough understanding of operations, physical facilities, telecommunications, control ➢ It shall allow open as well as personalized access through user credentials.
systems, data security objectives, organizational structure, personnel, manual procedures, and ➢ It shall have personalization features to show products to users according to their individual
individual applications. interests and shopping history.
The Institute of Chartered Accountants of Nepal 4 The Institute of Chartered Accountants of Nepal 5

93 94
 Suggested Answers June 2023 Examination (CAP III - Group II) Suggested Answers June 2023 Examination (CAP III - Group II)

➢ It shall have online payment facility providing integration with all major online payment facilities. and provide reasons and theories about the produced information and results. Software with only
➢ It shall have features to track delivery and movement of the ordered items through the delivery artificial intelligent capability can do this.
chain.
Need: Consulting firm has to make lots of decisions. It has to provide different suggestions,
c) The disaster recovery and planning document may include the following areas: solutions to other business organizations. It collects several data from different organizations and
✓ The conditions for activating the plans, which describe the process to be followed before each plan, environments. The suggestions, solutions it provides to other organizations depends on the data
are activated. collected, data from external source, past data. Analyzing those data and generating solutions
✓ Emergency procedures, which describe the actions to be taken following an incident which immediately is a tough job. It needs information that is reliable, timely and only software with AI
jeopardizes business operations and/or human life. This should include arrangements for public capability can do that. So, this firm needs AI capable software for decision making processes and
relations management and for effective liaison with appropriate public authorities e.g. police, fire, performing in better and timely manner.
services and local government.
✓ Fallback procedures which describe the actions to be taken to move essential business activities or Risks: AI implementation needs huge investment in hardware and software, human resources. If
support services to alternate temporary locations, to bring business process back into operation in organization is not aware and serious about the AI implement and needs, AI may be of no value for
the required time-scale. the organization. It will be only waste of money and time. To use AI based software organization
✓ Resumption procedures, which describe the actions to be taken to return to normal business must use powerful computer systems, intelligent human resources. Sometimes it becomes necessary
operations. for human being too evaluate the results, information produced by the AI system, human have to
✓ A maintenance schedule, which specifies how and when the plan will be tested, and the process for check the input data the AI system using, source of input data. Not able to do these tasks may result
maintaining the plan. in biased or wrong decisions. AI based software solution is of great value, lots of people want to
✓ Awareness and education activities, which are designed to create an understanding of the business get benefit from the AI based Systems. AI based software if gone to wrong people then it can be
continuity, process and to ensure that the business continues to be effective. very dangerous for the organizations, and other people. People with negative intension can use AI
✓ The responsibilities of individuals describing who is responsible for executing which component systems for only their own benefits, ignoring benefits and values for the organization.
of the plan. Alternatives should be nominated as required.
✓ Contingency plan document distribution list. b. Technology rapidly changes and often becomes obsolete. It is more so in the field of IT. How can
✓ Detailed description of the purpose and scope of the plan. a modern business organization minimize risk of such changes while adopting new IT based
✓ Contingency plan testing and recovery procedure.
systems and technologies? (8)
Resources that should be considered in backup plan are Answer:
Technological evolution is a continuous process and as a result, a technology that is cutting-edge
✓ Personnel: Training and rotation of duties among information system staff to enable them to replace today shall one day be obsolete. This is how the development works. The rate and pace of such
others when required. Arrangements with another company for provision of staff. obsolescence is high in the field of IT as new technologies, services and breakthroughs are
✓ Hardware: Arrangements with another company for provision of hardware. happening almost every month. Hence, there is higher risk of fast obsolescence.
✓ Facilities: Arrangements with another company for provision of facilities. IT systems are indispensable in modern business organizations. All the business functions including
✓ Documentation: Inventory of documentation stored securely on-site and off- site. sales, finance, HR, marketing have to make heavy use of IT based facilities and tools. As a result,
✓ Supplies: Inventory of critical supplies stored securely on-site and off-site with a list of vendors IT investment is a major factor for any business organization. It is something they cannot avoid and
who provide all supplies. because of rapid technological change, such major investment can quickly become irrelevant if not
✓ Data / information: Inventory of files stored securely on site and off site. properly planned.
✓ Applications software: Inventory of application software stored on site and off site. To minimize risk of rapid obsolescence, business organizations have to adopt the following
✓ System software: Inventory of system software stored securely on site and off site. strategy:
a. Choose a system with future in mind by seeing the market standing, technology and expertise of
3. the solution provider.
a. Nowadays, a lot of development is happening in the field of Artificial Intelligence (AI). It is also
b. Keep the system updated with all the relevant upgrades, patches, additions and changes.
creating a lot of controversies and risks. Assuming that you responsible to design and implement a
c. Keep the human resource updated and well-trained about the related technology and its recent
new IT system of a modern business consulting firm, how would you define the relevance, need changes & developments.
and risks of implementing AI tools in your system? (7)
d. Carry out regular audit of the system to check its relevance and find out any part/component that
needs update, upgrade or replacement.
Answer:
e. Make long-term evolution plan to make sure changes are not disruptive.
Relevance: Today, organizations are faced with lots of challenges and issues. It is a competitive
world. Everyone is trying to do the best. Organizations have piled of huge volume of data, data is
the source of information, and information is necessary for making decisions. Processing and 4.
analyzing huge volume of data incorporating diverse type of external data is a challenging task. It a. Discuss supply chain management system in detail. Why do businesses need this system? (5 + 3 =
is not an easy, and not possible to process data and evaluate validity of information using normal 8)
software programs. It needs powerful intelligent software program capable of handling huge b. What is ethics? What ethical issues are raised by information system? How does copyright and
volume of data, provide insights to the processes, evaluate information based on their importance, patent protect digital content? (1+2+4=7)

The Institute of Chartered Accountants of Nepal 6 The Institute of Chartered Accountants of Nepal 7

95 96
 Suggested Answers June 2023 Examination (CAP III - Group II) Suggested Answers June 2023 Examination (CAP III - Group II)

society, and preserving values and institutions considered essential to the quality of life in an
Answers: information society.
4 a) First Part: Supply chain management is the close linkage and coordination of activities in buying,
making, and moving a product. It integrates supplier, manufacturer, distributor, and customer Third part: Copyright is a statutory grant that protects creators of intellectual property from
logistics processes to reduce time, redundant effort, and inventory cost. The supply chain is a having their work copied by others for any purpose during the life of the author plus an additional
network of organizations and business processes for procuring materials, transforming raw 70 years after the author’s death. For corporate-owned works, copyright protection lasts for 95 years
materials into intermediate and finished products, and distributing the finished products to after their initial creation. Most industrial nations have their own copyright laws, and there are
customers. It links suppliers, manufacturing plants, distribution centers, conveyances, retail outlets, several international conventions and bilateral agreements through which nations coordinate and
people and information through processes such as procurement, inventory control, distribution, and enforce their laws. Copyright protects against copying of entire software programs or their parts;
delivery to supply goods and services from source through consumption. Supply chain also includes However, the ideas behind a work are not protected, only their manifestation in a work; A
reverse logistics in which returned items flow in the reverse direction from buyer back to the seller. competitor can build new software that follows the same concepts without infringing on a copyright.
The manufacturer also manages internal supply chain process for transforming the materials,
components, and services furnished by suppliers into finished goods and for merging materials and A patent grants the owner an exclusive monopoly on the ideas behind an invention for 20 years.
inventory. The intent behind patent law is to ensure that inventors receive the full financial and other rewards
Information systems make supply chain management more efficient by helping companies and yet still make widespread use of the invention possible for those wishing to use the idea under
coordinate, schedule, and control procurement, production, inventory management, and delivery of license from the patent’s owner. The granting of a patent is determined by the Patent Office and
products and services. Supply chain management systems can be built using intranets, extranets, or relies on court rulings. The key concepts in patent law are originality, novelty, and invention. Patent
special supply chain management software. protection is that it grants a monopoly on the underlying concepts and ideas of software. The
Inaccurate or untimely information in the supply chain causes inefficiencies such as parts shortages, difficulty is passing stringent criteria for novelty and invention.
underutilized plant capacity, excessive finished goods inventory, or runaway transportation costs.
One recurring problem in supply chain management is the bullwhip effect, in which information 5.
about the demand for a product gets distorted as it passes from one entity to next across the supply a. Discuss the Auditor’s role with respect to application software acquisition /selection process. [7]
chain. Supply chain management uses systems for supply chain planning (SCP) and supply chain b. Information security risks are increasing with wider adoption of IT services, tools and facilities.
execution (SCE). Supply chain planning systems enable the firm to generate demand forecasts for How can a business organization ensure that those risks are minimized while implementing IT
a product and to develop sourcing and manufacturing plans for that product. Supply chain execution systems? (8)
systems manage the flow of products through distribution centers and warehouses to ensure that
products are delivered to the right locations in the most efficient manner. Answer
5 a) Major roles of auditors with respect to application software acquisition/selection process are:
Second Part: Information systems for supply chain management can help participants in the supply
chain in the following activities: ✓ To highlight risks before a vendor contract or a software agreement contract is signed.
• Decide when and what to produce, store, and move
• Rapidly communicate orders ✓ To ensure that the decision to acquire software flows from the thorough feasibility study, vendor
• Track the status of orders evaluation and RFP (Request for proposal) adequacy checked for.
• Check inventory availability and monitor inventory levels
• Reduce inventory, transportation, and warehousing costs ✓ A RFP would include transaction volume, data base size, turnaround time and response time
• Track shipments requirements and vendor responsibilities.
• Plan production based on actual customer demand
✓ The auditor needs to also check the criteria for pre-qualification of vendors and sufficient
• Rapidly communicate changes in product design
documentation available to justify the selection of the final vendor / product.

✓ The auditor may also collect information through his own sources on vendor viability, support
b) First Part: Ethics refers to the principle of right and wrong that individuals, acting as free moral
infrastructure, service record and the like.
agents, use to make choices to guide their behaviors.
✓ Thorough review of the contract signed with the vendor for adequacy of safeguards and
Second Part: Information systems raise new ethical questions for both individuals and societies
completeness.
because they create opportunities for intense social change, and thus threaten existing distributions
✓ The contract should address the contingency plan in case of vendor failures such as, source code
of power, money, rights, and obligations. Information technology can be used to achieve social
availability and third party maintenance support.
progress, but it can also be used to commit crimes and threaten cherished social values. The
✓ To ensure that the contract went through legal scrutiny before it was signed.
development of information technology will produce benefits for many and costs for others. Ethical
issues in information systems have been given new urgency by the rise of Internet and electronic
commerce, unleashing new concerns about the appropriate use of customer information, the
5 b) Modern businesses are driven by wider reach, connectivity, availability and accessibility. All those
protection of personal privacy, and the protection of intellectual property. Other issues raised by
facilities can be availed of only through the adoption of effective adoption of modern IT-based
information systems include establishing accountability for the consequences of information
tools, facilities and functionalities.
systems, setting standards to safeguard system quality that protects the safety of the individual and
The Institute of Chartered Accountants of Nepal 8 The Institute of Chartered Accountants of Nepal 9

97 98
 Suggested Answers June 2023 Examination (CAP III - Group II) Suggested Answers June 2023 Examination (CAP III - Group II)

A modern business organization can reach a wide mass of customers, suppliers, partners and other b. Electronic Payment
stakeholders through the use of IT based systems and tools. Answer
However, as such connectivity and exposure increases, so do the risks associated with such Electronic Payment is a mechanism to issue payments digitally without the need to handle cash.
exposure. Over the wide reaching connectivity, rogue elements can gain unlawful access to the Digital payment is an important feature of modern businesses, specifically e-commerce and online
system, carry out theft of information, compromise personal data of clients and other stakeholders, trade platforms. In electronic payment, money is stored as digital currency balance in a bank
tamper with financial transactions and cause other different types of harm that vary in impact and account or a digital wallet and when a payment is made, the paid amount is debited from the
severity from minor to critical. account/wallet of the payer and credited to the account/wallet of the payee.
However, such risks do not mean the businesses have to stop using IT systems. Without IT systems, Electronic payment facility has helped in explosive growth of online commerce wherein customers
effective operation is not possible. Hence, business organizations need to take various can order goods and services online and pay for them digitally. There are various advantages of
countermeasures to ensure such risks are minimized and the benefits of adopting IT systems are electronic payment over cash payment. Some of the major benefits include accuracy, speed,
maximized. Some of those measures can be as follows: transparency, ease of maintaining records and ability to present accurate reports for auditory,
• The systems and their components have to be properly designed and envisioned with respect to taxation and other regulatory/legal purposes.
their functionality, benefits, risks and possible weaknesses.
• Teams have to be properly trained and made aware of the risks and measures to mitigate those risks. c. Business application of expert system
• Deployment should be such that the business continuity is not affected or minimally affected even
if the systems are compromised. System redundancy, backup-recovery procedures and business Answer
continuity plans are critical in this respect. Some of the business applications of expert system are:
• A proper and healthy relationship needs to be developed between the developers (or vendors) and ✓ Decision Management
the users of the system. ✓ Diagnostic/troubleshooting
• Regular auditing, upgrades, patches, repair & maintenance regime has to be in place to minimize ✓ Maintenance Scheduling
disruptions. ✓ Design/configuration
✓ Selection/classification
• Proper security measures and tools such as access control, firewall, antivirus, maintaining proper
✓ Process monitoring/control
audit trains etc. have to be implemented to safeguard against threats from both internal and external
sources.
d. CASE Tools
6. Write short notes on the following: (5×3=15) Answer
The Computer Assisted System Engineering (CASE) provides software tools to automate the
a. Virtualization and its advantages methodologies of system development and hence reduce the time, resources and cost needed to
Answer prepare the functional system. These tools also facilitate the creation of clear documentation and
Virtualization is the creation of a virtual form of a computing resource like a computer, server, or the coordination of team development efforts. Team members can share their work easily by
other hardware component, or a software-based resource such as an operating system. accessing each other’s files to review or modify what has been done. By providing automated
Virtualization is classified based on the resource that is being created. There are various categories graphics facilities for producing charts and diagrams, screen and report generators, data
such as: dictionaries, extensive reporting facilities, analysis and checking tools, code generators, and
✓ Network virtualization documentation generators, CASE tools help Enforce a standard development methodology and
✓ Server virtualization design discipline. They also Improve communication between users and technical specialists. In
✓ Desktop virtualization short, for rapid system development and deployment, CASE tools automate tedious and error-prone
✓ Hardware virtualization portions of analysis and design. They also automate code generation and testing and control rollout.
✓ Software virtualization
✓ Storage virtualization e. High Availability Planning
Advantages of virtualization: Answer
✓ Gain better performance and efficiency from resources in the existing computing components, While planning for a fault-tolerant, highly reliable information system, a major factor is the high
using CPU virtualization. availability planning. It is about making sure that the system and its services are functioning and
✓ Boost virtual machine (VM) security. Since VMs are logically separated from each other, a malware available even in case of a major disaster. For such capability, the system deployment has to be
attack or other software glitch on one VM won't affect other VMs. planned with high availability a major objective. High availability computing is a mechanism to
✓ Save money on hardware. Virtualization software involves less cost, and also requires lesser implement a computing platform to make sure that the data and application are available in normal
hardware to run than physical machines. network and power outage scenarios. To make this happen, the system is replicated into two or
✓ Gain peace of mind. VMs provide better reliability in terms of disaster recovery as well as better more identical installation, probably at different geographical regions. It also involves redundancy
backup and retrieval capabilities. of networks and power systems. Apart from that, another major technique is server replication and
clustering within a site or between two distant sites so that the system continues to perform with
automatic switchover from one unit to another in the event of unavailability of the first node. Hence,
high availability planning tries to ensure that the services and data are available in normally
disruptive situations such as power outages, network disconnections or other disaster.

The Institute of Chartered Accountants of Nepal 10 The Institute of Chartered Accountants of Nepal 11

99 100
Suggested Answers - December2023 – Management Information and Control System Suggested Answers - December2023 – Management Information and Control System

MANAGEMENT INFORMATION AND CONTROL SYSTEM associated with the correction of error or irregularity.
Suggested Answer Failure cost: The control malfunctions or not designed to detect an error or irregularity. These un-
detected or uncorrected errors cause losses.
Roll No……………. Maximum Marks - 100 Maintenance costs: The cost associated in ensuring the correct working of a control. For example,
rewriting input validation routines as the format of input data changes.
Total No. of Questions - 6 Total No. of Printed Pages - 12
Answer of 1.b:
Time Allowed - 3 Hours
The controls to consider while reviewing the organization and management controls in an Informa-
Marks tion system shall include:
All questions are compulsory. Working notes should form part of the answer. Responsibility: The strategy to have a senior management personnel responsible for the IS within
Make assumptions wherever necessary. the overall organizational structure.
An official IT structure: There should be a prescribed organization structure with all staff deliber-
XYZ & Company is dealing in the information systems audit. The audit of an IS environment to ated on their roles and responsibilities by written down and agreed job descriptions.
evaluate the systems, practices and operations may include one or both of the following: An IT steering committee: The steering committee shall comprise of user representatives from
all areas of the business, and IT personnel. The committee would be responsible for the overall
Assessment of internal controls within the IS environment to assure validity, reliability, and security direction of IT. Here the responsibility lies beyond just the accounting and financial systems, for
of information. example, the telecommunications system (phone lines, video-conferencing) office automation, and
Assessment of the efficiency and effectiveness of the IS environment in economic terms. manufacturing processing systems.
The IS audit process is to evaluate the adequacy of internal controls with regard to both specific An IS auditor is responsible to evaluate the following while reviewing the adequacy of data security
computer programs and the data processing environment as a whole. This includes evaluating both controls:
the effectiveness and efficiency. The focus (scope and objective) of the audit process is not only
on security which comprises confidentiality, integrity and availability but also on effectiveness (re- Who is responsible for the accuracy of the data?
sult-orientation) and efficiency (optimum utilization of resources). Who is permitted to update data?
In the context of the above, answer the following questions: Who is permitted to read and use the data?
Who is responsible for determining who can read and update the data?
a) The audit objective and scope has a significant bearing on the skill and competence requirements
of an IS auditor. There is a set of skills that is generally expected from an IS auditor. Discuss those Who controls the security of the data?
skills in brief. Explain various costs involved in the implementation and operation of controls. If the IS system is outsourced, what security controls and protection mechanism does the vendor
(5+5=10) have in place to secure and protect data?
b) Discuss the controls to consider when reviewing the organization and management controls in an Contractually, what penalties or remedies are in place to protect the tangible and intangible values
of the information?
Information System. While reviewing the adequacy of data security controls, what are the items
The disclosure of sensitive information is a serious concern to the organization and is mandatory
which need to be evaluated by an IS auditor? (4+6=10)
on the auditor’s list of priorities.
Answer of 1.a:
You are working as an IT consultant in a company and your company is going to develop and im-
The set of skills that is generally expected from an IS auditor, include: plement contact center software “to help businesses handle high volumes of communications and
✓ Sound knowledge of business operations, practices and compliance requirements, inquiries through different channels like phone calls, live chats, messaging, social media etc." Many
✓ Should possess the requisite professional technical qualification and certifications, organizations have failed to achieve their systems development objectives. In this context answer
✓ An good understanding of information Risks and Controls, the following questions:
✓ Knowledge of IT strategies, policy and procedure controls,
What may be the major reasons for failures? Discuss the areas which should be studied in depth,
✓ Ability to understand technical and manual controls relating to business continuity, and in order to fully understand the present system and its related problems.
✓ Good knowledge of Professional Standards and Best practices of IT controls and secu- (3+4=7)
rity. Discuss the advantages and drawbacks of following the best practices suggested by SDLC.
Implementing and operating controls in a system involves the following five costs: (4+2=6)
Initial setup cost: This cost is incurred to design and implement controls. For example, a security Explain the Agile method of Software Development process with merits and limitations.
specialist must be employed to design a physical security system. (4+3=7)
Executing cost: This cost is associated with the execution of a control. For example, the cost in-
curred in using a processor to execute input validation routines for a security system.
Answer of 2.a:
Correction costs: The control has operated reliably in signaling an error or irregularity, the cost
There are many reasons why organizations fail to achieve their systems development objectives.

4| The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal |5

101 102
Suggested Answers - December2023 – Management Information and Control System Suggested Answers - December2023 – Management Information and Control System
Some of them are as follows: partment, noting their number and size, where they are located, who uses them and the number of
times per given time interval these are used. Information on common data files and their size will be an
Lack of senior management support and involvement in information systems development: important factor, which will influence the new information system. This information may be contained
Developers and users of information systems watch senior management to determine which sys- in the systems and procedures manuals. The system analyst should also review all on-line and off-line
tems development projects are important and act accordingly by shifting their efforts away from files which are maintained in the organization as it will reveal information about data that are not con-
any project which is not receiving management attention. In addition, management can see that tained in any outputs. The related cost of retrieving and processing the data is another important factor
adequate resources, as well as budgetary control over use of those resources, are dedicated to that should be considered by the systems analyst.
the project.
Shifting user needs: User requirements for information technology are constantly changing. Review methods, procedures and data communications: Methods and procedures transform input
As these changes accelerate, there will be more requests for systems development and more de- data into useful output. A method is defined as a way of doing something; a procedure is a series of
velopment projects. When these changes occur during a development process, the development logical steps by which a job is accomplished. A procedure review is an intensive survey of the meth-
team faces the challenge of developing systems whose very purposes might change since the ods by which each job is accomplished, the equipment utilized and the actual location of the opera-
development process began. Strategic decision making is unstructured, the requirements, speci- tions. Its basic objective is to eliminate unnecessary tasks or to perceive improvement opportunities
fications, and objectives for such development projects are difficult to define. in the present information system. A system analyst also needs to review and understand the present
data communications used by the organization. He must review the types of data communication
New technologies: When an organization tries to create a competitive advantage by applying equipment including data interface, data links, modems, dial- up and leased lines and multiplexers.
advance Information technology, it generally finds that attaining system development objectives The system analyst must understand how the data-communications network is used in the present
is more difficult because personnel are not as familiar with the technology. system so as to identify the need to revamp the network when the new system is installed.
Lack of standard project management and systems development methodologies: Some or- Analyze outputs: The outputs or reports should be scrutinized carefully by the system analysts in or-
ganizations do not formalize their project management and system development methodologies, der to determine how well they will meet the organization’s needs. The analysts must understand what
thereby making it very difficult to consistently complete projects on time or within budget. information is needed and why, who needs it and when and where it is needed. Additional questions
concerning the sequence of the data, how often the form reporting is used, how long it is kept on file,
Overworked or under-trained development staff: In many cases, systems developers often etc. must be investigated. Often many reports are a carry-over from earlier days and have little rele-
lack sufficient education background. Furthermore, many companies do little to help their de- vance to current operations. Attempt should be made to eliminate all such reports in the new system.
velopment personnel stay technically sound. Currently in these organizations, training plan and
training budget do not exist. Review internal controls: A detailed investigation of the present information system is not complete
until internal controls are reviewed. Locating the control points helps the analyst to visualize the es-
Resistance to change: People have a natural tendency to resist change, and information systems sential parts and framework of a system. An examination of the present system of internal controls
development projects signal changes - often radical - in the workplace. When personnel perceive may indicate weaknesses that should be removed in the new system. The adoption of advanced meth-
that the project will result in personnel cutbacks, threatened personnel will dig in their heels, and ods, procedures and equipments might allow much greater control over the data.
the development project is doomed to failure.
Model the existing physical system and logical system: As the logic of inputs, methods, procedures,
Lack of user participation: Users must participate in the development effort to define their re- data files, data communications, reports, internal controls and other important items are reviewed and
quirements, feel ownership for project success, and work to resolve development problems. User analyzed in a top down manner; the process must be properly documented. The flow charting and
participation also helps to reduce user resistance to change. diagramming of present information not only organizes the facts, but also helps disclose gaps and du-
plication in the data gathered. It allows a thorough comprehension of the numerous details and related
Inadequate testing and user training: New systems must be tested before installation to de- problems in the present operation.
termine that they operate correctly. Users must be trained to effectively utilize the new system. Undertake overall analysis of the present system: Based upon the aforesaid investigation of the
To overcome these, organizations must execute the systems development process efficiently and ef- present information system, the final phase of the detailed investigation includes the analysis of the
fectively. present work volume; the current personnel requirements; the present benefits and costs and each of
these must be investigated thoroughly.
In order to understand the present system and its related problems, the following areas should be stud-
ied in depth: Answer of 2.b:
Review historical aspects: A brief history of the organization is a logical starting point for an analysis
of the present system. The historical facts should identify the major turning points and milestones that Users will be able to create a product that is incredibly good if the phases and processes of the software
have influenced its growth. A review of annual reports and organization chart can identify the growth development life cycle are adhered to precisely and properly. The documentation created as part of the
of management levels as well as the development of various functional areas and departments. The software development life cycle gives developers a clear concept of what they need to build and what
system analyst should investigate what system changes have occurred in the past including operations the client's requirements are, while also giving clients a sense of what they are receiving and allowing
that have been successful or unsuccessful with computer equipment and techniques.
them to make any necessary changes.
Analyze inputs: A detailed analysis of present inputs is important since they are basic to the manipu-
lation of data. Source documents are used to capture the originating data for any type of system. The Some advantages of the software development life cycle are
system analyst should be aware of the various sources from where the data are initially captured, keep-
ing in view the fact that outputs for one area may serve as an input for another area. The system analyst o Efficient with regard to costs
must understand the nature of each form, what is contained in it, who prepared it, from where the form o Efficient in terms of time
is initiated, where it is completed, the distribution of the form and other similar considerations. If the
o Enhances teamwork and coordination, defines suitable roles for employees and increases work-
analyst investigates these questions thoroughly, he will be able to determine how these inputs fit into place transparency.
the framework of the present system.
o Minimal danger when the project is implemented
Review data files maintained: The analyst should investigate the data files maintained by each de-

6| The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal |7

103 104
Suggested Answers - December2023 – Management Information and Control System Suggested Answers - December2023 – Management Information and Control System
Software development life cycle drawbacks are: useful for the accounting information system, sells and marketing information system, production
information system, human resource information system. Further data generated during certain
o The project may take longer and cost more if the planning is not done properly.
interval of time can be utilized to develop the business intelligence.
o Correcting problems in code can occasionally take a long time and cause deadlines to be missed Moreover, as the payment is made through the credit card/online banking it additionally generates
if there are many of them. data like credit card numbers, credit checks, customer billing, inventory changes, increase in ac-
Answer of 2.c: count receivable balances which in turn generates further data. This example shows that transaction
processing activities are needed to capture and process such data, or the operations of a business.
Agility involves incremental builds presented in multiple iterations to stakeholders for feedback. Based Therefore, transaction processing systems play a vital role in supporting operations of e-business
on the feedback, changes are incorporated in the next iterations of the build on the basis of their priority. and definitely is the building block of most of the information system.
It is focused on delivering quality software quickly and is based on the seven lean principles; eliminate Answer of 3.b
waste, amplify learning, decide late, deliver fast, empower the team, build integrity, and see the whole The business function of marketing is concerned with the planning, promotion and sale of existing
product. products in existing markets and the development of new product and new markets to better attract
Advantages of Agile methodology of Software Development and serve present and potential customers. Business firms have increasingly turned to information
technology to help them perform vital marketing function in the face of the rapid changes of today’s
• Encourage changing requirements during collaboration with the customer environment.
• Focus on frequent delivery from the very start of the project Business firms are using information technology in the form of internet/intranet and websites to
• Encourage knowledge sharing and visibility between the business and development team promote and extend their business opportunities. These tools help the marketing activities in fol-
• Involve key stakeholders who are affected by a problem which the software will solve for them lowing ways which are different than marketing without use of information technologies tools:
• Encourage constant communication and sharing of thoughts • Interactive marketing
• Focus on delivering working software quickly • Target marketing
• Encourage constant development and improvement without compromising on software quality • Sales force automation
• Focus on technical excellence and good design • Customer relationship management
• Encourage to keep things simple • Marketing research and forecasting
• Encourage self-organizing and lack of micro-management • Advertising promotion
• Product management
Disadvantages of Agile methodology of Software Development

• Lack of documentation With the use of various tools of information technologies the marketing can be focused to the
• Developer skill set and training specific groups of the people with common fields from the prospects of the behavior, purchasing
• Lack of planning and project management software capacity, demography and geography etc. This enables the marketing to be more particular and cus-
• Scope creep tomer centric. Emails and instant messaging helps the receive the customer feedback immediately
and to provide them the answer to their queries. The sales person’s activities can be increased and
enhanced by providing the real time customized data of the probable customers. The relationship
a) “Transaction Processing System is the building block of any information system”. Justify this of the customer can be enhanced by retaining the potential customer and by attracting the new cus-
statement with the relevant examples. 7 tomer with the help websites and internet and intranet technologies.

b) How is Information Technology changing the scenario of marketing in modern days' busi- Similarly advertising and promotion can be done in the relevant websites by personalizing on home
ness? 8 pages. The marketing research can be done effectively with the use of websites and taking the on-
Answer of 3.a line feedbacks. Now various tools are available which even involve the customer in the product/
services design so that they have the sense of belongingness to the product/services. And these
Transaction processing systems are cross-functional information systems that process data result-
tools also facilitate after sales services. Information technology is now helping not only in the niche
ing from the occurrence of business transactions. These transactions can be any business incidents
marketing of the product also involves the customer in product/services design and facilitate the
that occur as a part of business such as sales, purchases, deposits, with drawls, refunds, payment to
after sales services. Search engine optimization (SEO) is one simple tool which help for better vis-
name a few. For any type of information system, the initial data is generated by these transactions.
ibility in the internet and social media. Similarly, Sales force Automation (SFA) is an Information
Thus, the transaction processing system generates the building block of most of the information
System used in marketing and sales management that help to automate some sales and sales force
system.
management functions.
Let’s take an example that data generated whenever a business sells something to a customer on
credit, whether in a retail store or at an e-commerce site on the web. In this case, there are data about
the customer who purchases the product, about the salesperson, about the product, stores etc will These are some of the activities which are carried out with the use of information technologies in
be generated. These are the first stage data generated for the information system. These data will be the sales and marketing which are not possible by other means. Use of information technology

8| The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal |9

105 106
Suggested Answers - December2023 – Management Information and Control System Suggested Answers - December2023 – Management Information and Control System
assisted business firms to make marketing more focused, target customer oriented and it breaks the Global approach to IT infrastructure: Accessible IT infrastructure in cloud computing enables enter-
geographical boundaries. On top of this information technology created marketing process to be an prises to access cloud services with a reliable internet connection worldwide easily. This can elevate
interactive between business firms and customer. economic growth in regions where IT infrastructure is void. It allows businesses to compete with
other companies in the neighboring countries effectively. It helps them focus on running the business
rather than tracking or monitoring the IT infrastructure.
a) Define cloud computing. How can cloud computing be beneficial for economic development of
Improves growth and employment: The rapidly growing cloud computing industry creates excel-
corporate business organization? (3+4=7)
lent employment opportunities in multiple directions. While skilled professionals rightfully fulfill
upcoming cloud skill sets, the company can upgrade the existing workforce, training to match the
b) Why is cyber law important? Explain Capability Maturity Model (CMM) in brief. (3+5=8) requirements. This results in accelerated income streams and subsequent economic growth.
Answer of 4.a: Fast, secure, and no fussy updates: While cloud computing depends on the services delivered via
data centres, there is a continuous upgrade for increased speed, performance, and protection. Since
First part: the cloud data is not located at a suitable location, it is secure from natural disasters or adverse hard-
Cloud computing is the on-demand availability of computing resources such as storage and in- ware failures. At the same time, cloud computing utilizes third parties to handle data storage and
frastructure as services over the internet. It eliminates the need for individuals and businesses to security, enabling hassle-free software updates, troubleshooting, and maintenance.
self-manage physical resources themselves, and only pay for what they use. No need for a Disaster Recovery (DR) site: Cloud service providers offer disaster recovery and
Cloud computing service models are based on the concept of sharing on-demand computing resourc- business continuity as an integral part of the cloud migration services within the organization. These
es, software, and information over the internet. Companies or individuals pay to access a virtual pool services are sufficient, and small-scale businesses do not have to invest in a separate DR solution.
of shared resources, including computer, storage, and networking services, which are located on Drives innovation: One of the better opportunities the cloud provides is encouraging innovation. The
remote servers that are owned and managed by service providers. low costs of computing and software applications enable enterprises to initiate product or service de-
Typically, there are three main types of cloud computing service models that a business organization velopments actively. It also allows businesses to undertake minimal risks to close projects via cloud
can select based on the level of control, flexibility, and management that business needs. They are computing. Enterprises can utilize cloud infrastructure to build and offer their innovative in-house
as follows SaaS products.
Infrastructure as a service (IaaS): IaaS offers on-demand access to IT infrastructure services, includ-
ing compute, storage, networking, and virtualization. It provides the highest level of control over Answer of 4.b:
your IT resources and most closely resembles traditional on-premises IT resources. First Part: Cyber law is of paramount importance in our digital age as it safeguards digital assets,
Platform as a service (PaaS): PaaS offers all the hardware and software resources needed for cloud prevents cybercrimes, regulates online activities, protects e-commerce and consumer rights, fosters
application development. With PaaS, companies can focus fully on application development without international cooperation, upholds intellectual property rights, ensures data privacy, and provides
the burden of managing and maintaining the underlying infrastructure. legal remedies. It plays a vital role in establishing legal order and security in the digital realm, pro-
Software as a service (SaaS): SaaS delivers a full application stack as a service, from underlying tecting both individuals and organizations in an interconnected world.
infrastructure to maintenance and updates to the app software itself. A SaaS solution is often an Second Part: The Capability Maturity Model (CMM) is a methodology used to develop and refine
end-user application, where both the service and the infrastructure is managed and maintained by an organization's software development process. The model describes a five-level evolutionary path
the cloud service provider. of increasingly organized and systematically more mature processes. There are five levels to the
Second part: CMM development process.
Since it is scalable and straightforward, cloud computing effectively diminishes capital, mainte-
• Initial. At the initial level, processes are disorganized, ad hoc and even chaotic. Success likely
nance, and administrative costs. The economic benefits of cloud computing for any corporate busi-
depends on individual efforts and is not considered to be repeatable. This is because processes
ness organization are as follows
are not sufficiently defined and documented to enable them to be replicated.
Drives businesses agility, innovation, and competition: Cloud computing allows enterprises to de-
ploy applications rapidly and utilize cloud computing services in real time. It helps scale up, helping • Repeatable. At the repeatable level, requisite processes are established, defined and document-
achieve business agility and significantly decreasing the time to market so businesses can conquer ed. As a result, basic project management techniques are established, and successes in key pro-
more market share and revenue growth. At the same time, cloud computing allows exploring new cess areas are able to be repeated.
opportunities simply due to its cost-effective attribute to acquire adequate resources and infrastruc- • Defined. At the defined level, an organization develops its own standard software development
ture. This increases the chance for IT leaders to pitch better ideas leading to economic growth glob- process. These defined processes enable greater attention to documentation, standardization and
ally. integration.
Cost efficient: Cost efficiency houses the concept of “economies of scale.” Organizations transition-
ing from an on-premise model to a public cloud environment can accomplish economies of scale • Managed. At the managed level, an organization monitors and controls its own processes
by taking advantage of the maximum efficiency of numerous tenants sharing computing resources. through data collection and analysis.
Additionally, renting the hardware and IT assets can help achieve economies of scale. Most cloud • Optimizing. At the optimizing level, processes are constantly improved through monitoring
services employ the cost-efficient pay-per-use model, which boosts the organizations’ economy. feedback from processes and introducing innovative processes and functionality.

10 | The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal | 11

107 108
Suggested Answers - December2023 – Management Information and Control System Suggested Answers - December2023 – Management Information and Control System
5. v) Electronic Wallets: Electronic wallets, also named E-wallets or Digital wallets, allow online
a) Do you agree that COVID-19 was an opportunity to grow e-commerce and online payment? Jus- shoppers to purchase products faster and smoother. Because only one or two clicks are enough
tify your answer. List out the commonly used payment mechanisms in e-commerce. (3+4=7) to complete a payment, the shopping experience can be done within seconds. E-wallets work
as storage for both the shoppers’ information and the funds. After linking their bank account to
b) How does change in technology affect business? How can a modern business organization min- an e-wallet, if the users choose to pay online with their e-wallets, they will be directed to the
imize negative effects of change in technology? (4+4=8) e-wallet page, and entering their password will be enough to finalize the purchase.
vi) Mobile Payment: One of the latest ways of making online payments is through mobile phones.
Answer of 5.a: Instead of using a credit card or cash, all the customer has to do is send a payment request to his/
her service provider via text message; the customer’s mobile account or credit card is charged
E-commerce or electronic commerce is the buying and selling of goods and services, or the transmit-
for the purchase. To set up the mobile payment system, the customer just has to download a
ting of funds or data, over an electronic network, primarily the internet. These business transactions
software from his/her service provider’s website and then link the credit card or mobile billing
occur either as Business-to-Business (B2B), Business-to-Consumer (B2C) or Consumer-to-Con-
information to the software.
sumer (C2C). E-commerce is powered by the internet. Customers access an online store to browse
through and place orders for products or services via their own devices. Yes, I do strongly agree that Answer of 5.b
COVID-19 is an opportunity to grow e-commerce and online payment. Modern businesses are increasingly reliant on technology for their operation. Essential business
With the rise of the digital economy, digitalization has fundamentally transformed the way we live functions such as marketing, finance, human resource, customer service, communication etc. make
and work. Since the outbreak of the COVID-19, people have been increasingly relying more on use of technology for automation and efficiency. No business can be envisaged without some use
digital technologies due to pandemic prevention and control strategies such as lockdown, social of technology.
distancing, enclosure of restaurants and malls, etc. COVID-19 has been intensively transforming the As more and more business functions are dependent on technology, the change in technology
world's trends, people's behavior, nature of business, and daily life. Meanwhile, it has been acting as directly affect the business process and operation. The major effects of technology change can be
a catalyst or accelerator of this new digital revolution in the COVID-19 Era, especially for the rapid outlined as follows:
adoption of e-commerce globally. ➢ Need for adapting existing business processes to suit the new technology.
Both direct and indirect impacts of COVID-19 have forced people to purchase goods online. Mean- ➢ Need to train users (staff and others) on the new technology
while, traditional producers and traders have also moved their business online regarding the declin- ➢ Significant effort needed to migrate data, information and processes from old technology to
ing shares of conventional trade and the unstable markets due to the COVID-induced supply chain new technology.
disruptions, resource shortage, lack of human capital, declined customer demand, etc. The World ➢ Possible disruption in business process continuity while the new system is put in place and old
Trade Organization states that it is the exact time for e-commerce to rescue the global economy from is phased out.
the COVID-19 and that it is to interfere with vigor and energy and demonstrate e-commerce of its A business organization can minimize the negative effects of change in technology by adopting
prominence and effectiveness in the field of trade and online shopping. several strategies including but not limited to the following:
The commonly used payment mechanisms are as follows ➢ Proper planning of technology change and switchover process
i) Credit Card Payment: Credit cards are the most commonly used payment method in e-Com- ➢ Rigorous training and handholding of the stakeholders on the new system and ways of adapt-
merce. Since credit cards are easy and mostly safe to use, the high popularity of using them in ing the old processes in the new system.
online purchases is no surprise. Shoppers only need to enter their card details to finish buying ➢ Careful system and data backup regime to ensure no data is lost during the switchover.
the products at the checkout. ➢ Close coordination with provider of old system as well as new system to address unforeseen
issues during system switchover and data migration.
ii) Debit Card Payment: Debit Cards are also widely used worldwide, and using them for online
purchases is a close second to credit cards as the most commonly used online payment method. 6. Write short notes on the following: (5×3=15)
While the process of purchasing is the same, debit card payments permit users only to use their
savings in the connected bank account. On the other hand, credit card payments are made at the a) High availability computing
end of the billing period, way after the purchase is made.
iii) Bank Transfer: One of the most secure payment methods is bank transfers when it comes to Answer:
online shopping. Since it may cause online shoppers to fall into swindlers’ hands, people tend High availability computing is a mechanism of making mission-critical, business computing system
to be hesitant while making payments on e-Commerce stores; some even don’t want to enter resilient to possible disruptions and outages due to both man-made and natural causes. These sys-
their credit/debit card credentials. tems are deployed in multiple levels of redundancy to ensure a round-the-clock operation for pro-
iv) Electronic Checks: Electronic checks, or E-checks, in short, have practically the same process longed periods of time so that the business functions enabled by them are not disrupted. To achieve
in use as standard paper checks, but since they can be processed online, the challenges time and such uninterrupted operation various hardware means such as clustered, multi-node installations
place may cause are eliminated, making e-checks much faster. across multiple geographical locations are employed along with software capabilities of clustering,
automatic data synchronization, automatic switchover of operation from disrupted node to the avail-

12 | The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal | 13

109 110
Suggested Answers - December2023 – Management Information and Control System Suggested Answers - December2023 – Management Information and Control System
able node, data replication across multiple storage devices in one location (RAID, mirroring) as well Information system audit or IS Audit is specifically performed to make sure that the systems, tools
as across locations are deployed. and processes are in their optimum level of health and performance and also that they are rightly
Along with computing hardware and software resources, other essential resources are also deployed used by right people with right authority and privileges. Hence, an IS audit exercise evaluates and
in redundant modes such as redundant power supply sources, diesel generator and UPS backup, re- scrutinizes not only the systems but also how they are being used, what are their weaknesses (and
dundancy in cooling systems, multiple network connections etc. strengths) and what can be done to improve the situation. IS Audit is a very important exercise for
the management to know the status and have right pointers to work on having a better system.
b) PERT
e) Benefits of personalization in modern e-commerce.
Answer:
A Program Evaluation Review Technique (PERT) chart is a graphical representation of a project's Answer
timeline that displays all of the individual tasks necessary to complete the project. Specially since the advent of social media, mobile computing and modern web technologies, elec-
As a project management tool, the PERT chart is often preferred to the Gantt chart because it iden- tronic commerce has greatly evolved and expanded in its scope. Nowadays, almost every commer-
tifies task dependencies. However, a PERT chart can be more difficult to interpret. cial transaction can be performed electronically. With rapid expansion of Internet access and smart
A project manager creates a PERT chart in order to analyze all of a project's tasks while estimating devices, people are increasingly using e-commerce to meet their immediate needs and also explore
the amount of time required to complete each one. Using this information, the project manager can other possibilities. The combination of smart devices, social media, consumer profiling and modern
estimate the minimum amount of time required to complete the entire project. web technology (and mobile apps) have enabled businesses to push products, services and solutions
This information also helps the manager develop a project budget and determine the resources to end users based on their individual interests, choices and past transactions. Such personalized
needed to accomplish the project. push makes the end user happier that their needs are being catered and increases the possibility of
A PERT chart uses circles or rectangles, called nodes, to represent project events or milestones. The transaction happening, hence creating better prospect for the business performing the push. More-
nodes are linked by vectors or lines that represent various tasks. over, personalized e-commerce also enables end users to quickly explore areas of their interest
Dependent tasks are items that must be performed in a specific manner. For example, if an arrow is while avoiding the vast array of options in which they would not have any interest. This saves time
drawn from Task No. 1 to Task No. 2 on a PERT chart, Task No. 1 must be completed before work and hassle for both the end user as well as the business.
on Task No. 2 begins.
Items at the same stage of production but on different task lines within a project are referred to as
parallel tasks. They're independent of each other, and occur at the same time.

c) Distinguish between network access control and application control. 3

Answer
Network access control refers to controlling access into a information system or device from outside
using network connectivity. It also refers to transfer of various kinds of data through the network.
Here, network may mean organization’s own Intranet or the Internet connectivity. Controlling net-
work access can achieved through implementation of access control policies, firewalls, well-de-
fined and personalized credentials for administrative access etc.
Application control is a mechanism to control the facilities and processes in the application level.
That means controlling what applications are allowed to which set of people. For example, an or-
ganization may decide to disallow social media applications in office computers or allow the cor-
porate CRM only on corporate devices. Some may allow only a specific application for a specific
purpose such as a specific email client, a specific browser, a specific office application etc. Such
controls are used specifically for a security objective or a license / copyright purpose so that the
stipulated organizational IT standards are met.

d) Importance of IS Audit.

Answer
Audit is the process of closely scrutinizing an established process or system for the purpose of
identifying its strengths and weaknesses so that the concerned people can maximize the strengths
and resolve the weaknesses.

14 | The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal | 15

111 112
 Suggested Answers June 2024 Examination (CAP III - Group II) Suggested Answers June 2024 Examination (CAP III - Group II)

System audit has a very critical role in ensuring that the data protection and other security
mechanisms put in place for the core banking system shall be effective. The following are the roles
Paper 5 – Management Information and Control System of the audit process in this respect:
➢ Audit process carries out neutral and impartial evaluation of the processes, practices and systems
All questions are compulsory. Working notes should form part of the answer. Make to make sure that all security and data safeguard measures are in place.
assumptions wherever necessary. ➢ Audit process also evaluates the system redundancy and high availability measures put in place
are properly designed and without any critical flaws.
1. Axyb Pvt Ltd. is a reputed technology company focusing on data analytics, AI and software ➢ Audit process also investigates in detail the system accesses, datacenter access and other
development. They aim to develop a core banking system from scratch. Assume you are appointed
transactions to identify any insecure and risky activities. If such are found the audit process also
as the project manager overseeing all the activities related to the development.
duly reports it to the management so that the corrective measures are taken as soon as possible.
In this context, answer the following questions:
a) Core banking is a very sophisticated application with multiple major modules. Create a plan to ➢ It is also helpful to ensure that people with proper authority and privilege are only allowed access
effectively use rapid application development approach with involvement of a client bank. How to the designated infrastructure, resources and services related to the core banking system.
can you effectively use their involvement in better designing the input and output of the core ➢ Moreover, the audit process also interacts with the users and other stakeholders of the system to
banking system? (5+5=10) identify any practices that may lead to security breach and data protection compromise.
b) Core banking data are very critical data with a lot of finance-related information. How do you
2. Suppose that you are hired to develop an e-commerce system of an online food store to sell its
make sure that the system and its deployment ensures protection of the data and the privacy of the
food items to customers. Based on this scenario, answer the following questions.
clients? Describe the role of audit to ensure that your data protection scheme is working
a) Why do you need CASE tools in system development? What different features are available in
(6+4=10)
CASE tools? (3+4=7)
b) What different payment systems will you consider in this system for customers? 7
Answer:1
c) What is your plan for disaster recovery if this website goes down? 6
a) Plan for effectively using rapid application development approach:
To develop software system quickly, it is necessary to know the high priority requirements of users
Answer
and high risk associated requirements. So, plan for using RAD will contain following steps:
2 a) First Part: Computer-aided systems engineering (CASE) tools are the software programs that help
- Identification users and their requirements
the development team do their jobs more efficiently and more effectively. These tools support the
- Prioritization of the requirements
drawing and analysis of system models. Some CASE tools also provide prototyping and code
- Associated risks with the system
generation capabilities. The focus of CASE tools remains the improvement of the overall systems
- Feasibility analysis of the system to be developed
development process. CASE tools enable the developing of systems that are easier to test and
- Development of use cases, design models
maintain and contain good quality documentation. In a nutshell, software developed using CASE
- Development of modules addressing risks, testing of developed models.
tools has improved quality due to fewer defects.
- Incrementally enhancing developed model until they become stable.
Designers can input the requirements of a system and the CASE tool can generate the code
- Implementing developed modules in real working environment
(forward engineering). CASE tools also support reverse engineering (RE), where existing code
from legacy systems can be turned into design specifications, which in turn can be used to
By encouraging users to provide feedbacks and comments during the development process, their
restructure the code and ultimately the system to meet new business needs. The automation of
involvement can be effectively used in better designing input and output of the core banking
previously manual tasks by CASE tools can reduce the time to perform certain tasks, such as
system. Users will be asked to test the developed modules with real data. Different types of user
diagramming and code generation. CASE tools can even assist in the laborious task of project
interfaces will be introduced to the users to select from. How the output should be displayed will
estimation and can assist with the estimation of work effort in hours through the use of project
be discussed in detail. Processing time, execution time for each process will be discussed with the
estimation tools. A big advantage of CASE tools is that the usage of CASE tools enables an
users and get their feedbacks, comments on execution time, design etc.
organization to implement a single design philosophy for all projects, systems and people. With
CASE tools, developers working in different teams utilize the same procedures and methods for
b) Protection of data and privacy of clients can be ensured by testing each security measures taken
developing their aspect of the project, sharing information common to all the development teams.
in the design and development of each module. All the user interfaces will be checked to ensure
Because of this, CASE tools have the ability to synchronize the model design and implementation.
safety from any kind of attack. All the users provided data and output data will be synthesized.
The result is better analysis and design and more accurate coding due to procedures like automatic
Users’ role and responsibilities defined will be properly checked and tested. All backups and
testing and debugging. This also leads to a reduction in lifetime maintenance of the product. CASE
computers where user data is stored will be tested properly to ensure high security of those backups
tools provide better documentation during each phase of development. With the advent of object-
and computers. All the user data will be stored in database in the encrypted form. It will be also
oriented methodologies being incorporated into CASE tools, inexperienced or even non-
ensured that whatever data goes out from the bank system will be encrypted. Secure Socket layer
programmers are able to utilize CASE tools due to the simplicity of object-oriented module usage.
and digital certificates will be used for the proper authentication of the users.
Hence, primary reasons for utilizing CASE tools are:
• Reduce the amount of time and money spent on projects
• Improve the quality of the system developed
• Enhance the developers' productivity and satisfaction
• Make the system development task more enjoyable
4 5
The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal

113 114
 Suggested Answers June 2024 Examination (CAP III - Group II) Suggested Answers June 2024 Examination (CAP III - Group II)

After recovering the website, why the site went down? Reasons for that will be studied carefully.
Second Part: Around the CASE repository is a collection of tools or facilities for creating system Then action plan will be developed and implemented such that the website does not go down
models and documentation. These facilities generally include: because of those reasons. Also, the website will be studied to figure out if any security issues are
• Diagramming tools enable system process, data, and control structures to be represented still there.
graphically.
• Computer display and report generators help prototype how systems “look and feel.” Display 3.
(or form) and report generators make it easier for the systems analyst to identify data requirements a) Information Systems are arrangement of People, Process and Technology to address information
and relationships. needs of management working at different roles viz. Operational, Tactical and Strategic roles.
• Analysis tools automatically check for incomplete, inconsistent, or incorrect specifications in MIS and DSS are systems that help tactical level of management for their problem solving and
diagrams, forms, and reports. decision-making needs. Discuss difference between MIS and DSS Systems and how they support
• A central repository enables the integrated storage of specifications, diagrams, reports, and management. How do you think management decision makings are better complemented by
project management information. Artificial Intelligence Systems? (5+3=8)
• Documentation generators produce technical and user documentation in standard formats. b) What are different reasons that case failure of Enterprise IT implementations? Discuss on change
• Code generators enable the automatic generation of program and database definition code directly management processes with regard to people, process and technology changes. (4+3=7)
from the design documents, diagrams, forms, and reports.
Answer
2 b) E-commerce payment systems allow businesses to accept payments from customers online, and 3 a) First Part: Management Information Systems (MIS) and Decision Support Systems (DSS) are
offer diverse features and benefits to both parties. The most common types of e-commerce both information systems used in tactical level at organizations to help managers to support
payment systems considered are given below. decision making and problem-solving situations, however, they serve different purposes and have
• Online credit card transactions: It is the most dominant form of online payment system. It is distinct characteristics. Following are key differences
processed in much the same way that in-store purchases are, with the major differences being that Purpose:
online merchants never see the actual credit card being used, no card impression is taken, and no MIS: Management Information Systems focus on providing managers and decision-makers with
signature is available. These types of purchases are also called CNP (Cardholder Not Present) the information needed to monitor and control organizational performance. MIS typically provides
transactions. These are most closely resemble MOTO (Mail Order-Telephone Order) transactions. predefined reports and summaries of operational data, such as sales figures, inventory levels, and
There are five parties involved in an online credit card purchase: consumer, merchant, financial performance, to support routine decision-making and operational management.
clearinghouse, merchant bank (sometimes also called the “acquiring bank”), and the consumer’s DSS: Decision Support Systems are designed to help managers and decision-makers analyze
card issuing bank. In order to accept payments, online merchants must have a merchant account complex problems and make semi-structured or unstructured decisions. DSS provide analytical
established with a bank or financial institution. A merchant account is simply a bank account that tools, models, and interactive interfaces to facilitate decision-making processes, allowing users to
allows companies to process credit card payments and receive funds from those transactions. explore data, perform what-if analysis, and evaluate alternative courses of action.
• Digital wallets: Digital wallets (sometimes called e-wallets) are small electronic packages that Nature of Decisions Supported:
automatically supply information such as credit card numbers and shipping addresses for use in MIS: MIS primarily supports structured or routine decision-making processes that involve
conducting e-commerce transactions. These systems provide a means by which customers may predefined criteria, rules, and procedures. These decisions are typically repetitive, well-defined,
order products and services online without ever entering sensitive information and submitting it and occur at operational or tactical levels within the organization.
via e-mail or the World Wide Web, where it is vulnerable to theft by hackers and other cyber- DSS: DSS support both structured and semi-structured or unstructured decision-making processes
criminals. Allow consumers to make online purchases easily and securely. Traditionally, digital that involve uncertainty, complexity, and ambiguity. DSS are designed to handle dynamic and
wallets were stored on the desktops of personal computers; new digital wallets are compatible with changing environments, allowing users to explore multiple options and scenarios before making
wireless and other mobile devices, and are more often stored on a central server owned by a digital decisions.
wallet vendor or Internet service provider (ISP). Digital wallet vendors maintain relationships with Data and Information Processing:
online merchants. MIS: MIS typically processes structured data from internal and external sources, such as
• Digital cash: Digital cash (e-cash) is an alternate payment system developed for e-commerce in transactional databases, operational systems, and external reports. MIS focus on aggregating,
which unique, authenticated tokens representing cash value are transmitted from consumers to summarizing, and presenting data in predefined formats, such as reports, dashboards, and charts.
merchants. Banks issue digital tokens (unique encrypted numbers) for various dimensions of cash, DSS: DSS can handle both structured and unstructured data from multiple sources, including
and consumers can spend these at merchants’ site. Merchants in turn deposit these electronic internal databases, external sources, and real-time feeds. DSS support ad-hoc querying, data
tokens in banks. Some examples are, DigiCash, First Virtual, and Millicent. mining, and analytical processing to help users analyze and interpret data in various formats and
from different perspectives.
2 c) A Disaster Recovery Plan (DRP) is a business plan that describes how work can be resumed quickly
and effectively after a disaster. Disaster recovery planning is just part of business continuity User Interaction:
planning and applied to aspects of an organization that rely on an IT infrastructure to function. MIS: MIS typically provide predefined reports and summaries that are generated and distributed
If website goes down, in that case the web site will be restored using the backups of the website. to managers and decision-makers on a regular basis.
The recovery plan contains high availability of the system, arrangement of backups of the system DSS: DSS offer interactive interfaces and analytical tools that allow users to explore data,
in different places or computer. So, recovering web site will not be difficult task. manipulate variables, and conduct analysis in real-time. DSS support iterative and exploratory
decision-making processes, enabling users to interactively modify parameters and assumptions.
6 7
The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal

115 116
 Suggested Answers June 2024 Examination (CAP III - Group II) Suggested Answers June 2024 Examination (CAP III - Group II)

Poor Project Management and Governance:

Scope and Flexibility: Ineffective project management practices, such as inadequate planning, scheduling, and resource
MIS: MIS have a narrower scope and focus primarily on operational and tactical activities within allocation, can lead to project delays, budget overruns, and quality issues.
specific functional areas or departments of the organization. Lack of governance mechanisms, including project oversight, risk management, and decision-
DSS: DSS have a broader scope and can support decision-making across multiple levels and making processes, can result in project mismanagement and failure to address issues promptly.
functions of the organization. Technical Challenges and Complexity:
Enterprise IT implementations often involve complex technologies, integrations, and
3 (a) Second Part: dependencies that may pose technical challenges.
Artificial Intelligence has the potential to significantly complement decision-making processes Inadequate technical expertise, architectural design flaws, and compatibility issues can lead to
across various industries and domains by providing insights, automation, and predictive system failures, performance bottlenecks, and security vulnerabilities.
capabilities. Several ways AI can enhance decision-making are as below. Poor Quality Assurance and Testing:
Data Analysis and Insights: Poor vendor selection, communication, and collaboration can lead to delays, conflicts, and subpar
AI algorithms can analyze vast amounts of data quickly and efficiently to uncover patterns, trends, outcomes.
and insights that may not be apparent to human analysts.
Predictive Analytics: External Factors and Environmental Changes:
AI-powered predictive models can forecast future outcomes and trends based on historical data External factors such as changes in market conditions, regulatory requirements, or technological
and real-time inputs. disruptions can impact the success of enterprise IT implementations.
Predictive analytics enables organizations to anticipate customer behavior, market trends, and Change Management is a complex process and important journey organization should pass during
business opportunities. the time of transformation. Technology changes are often easy by process changes and people
Personalized Recommendations: changes are tough job for many enterprises.
AI-driven recommendation systems can analyze user preferences, behavior, and past interactions People, Process, and Technology change management is a holistic approach to managing
to deliver personalized recommendations and content. organizational change that focuses on three interconnected dimensions: people, processes, and
Automation and Optimization: technology
AI-based automation technologies can streamline repetitive tasks, workflows, and processes, People:
reducing manual effort and human error. The people dimension emphasizes the importance of understanding and addressing the human
Robotic Process Automation (RPA) can automate routine tasks such as data entry, document factors involved in change, including employee attitudes, behaviors, skills, and capabilities.
processing, and customer support Key Tactics for People Change management
Natural Language Processing (NLP): Stakeholder Analysis: Identify key stakeholders, their interests, concerns
NLP enables machines to understand and process human language, including text and speech, Communication and Engagement: Develop a communication plan to inform, involve, and engage
allowing for more natural and intuitive interactions. employees throughout the change process.
Training and Development: Provide training, resources, and support to help employees develop
3 b) Enterprise IT implementations can fail for various reasons, often stemming from challenges related the knowledge, skills, and capabilities
to technology, people, processes, and organizational factors. Following are the reasons for failure, Change Leadership: Empower leaders and managers to champion the change, model desired
Poor Requirements Definition: behaviors, and support employees through the transition.
Inadequate or unclear requirements can lead to misalignment between IT solutions and business Process:
needs. The process dimension focuses on redesigning organizational processes, workflows, and systems
Failure to involve key stakeholders and end-users in the requirements gathering process can result to enable and sustain the desired change.
in solutions that do not meet user expectations. Key Tactics for Process Change management
Lack of Executive Sponsorship and Leadership: Process Analysis: Assess current processes and workflows to identify inefficiencies, bottlenecks,
Enterprise IT implementations require strong executive sponsorship and leadership to drive and areas for improvement.
alignment, support, and resources across the organization. Redesign and Optimization: Redesign processes and workflows to align with the goals and
Without visible support from senior management, projects may face resistance, resource objectives of the change initiative.
constraints, and competing priorities Change Governance: Establish governance structures and mechanisms to oversee and manage the
Scope Creep and Change Management: implementation of process changes.

Scope creep occurs when project requirements, objectives, or deliverables expand beyond the Technology:
original scope, leading to schedule delays, cost overruns, and project complexity. The technology dimension involves leveraging technology solutions and systems to enable and
Inadequate change management processes can exacerbate scope creep by failing to manage support the desired change.
stakeholder expectations, communication, and resistance to change effectively. Key Tactics for Technology Change management
Resistance to change from employees, stakeholders, or organizational culture can hinder the Technology Assessment: Evaluate existing technology infrastructure, systems, and applications to
adoption and success of IT implementations assess their suitability and alignment with the change initiative.

8 9
The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal

117 118
 Suggested Answers June 2024 Examination (CAP III - Group II) Suggested Answers June 2024 Examination (CAP III - Group II)

Solution Selection and Implementation: Identify and select technology solutions that address Copyright: Copyright is a statutory grant that protects creators of intellectual property from having
specific business needs, enhance capabilities, and support organizational goals. Implement and their work copied by others for any purpose during the life of the author plus an additional 70 years
integrate technology solutions into the organization after the author’s death. For corporate-owned works, copyright protection lasts for 95 years after
Change Enablement: Provide training, support, and resources to help employees adapt to and their initial creation. Copyright protects against copying of entire programs or their parts. Damages
leverage new technology solutions effectively. and relief are readily obtained for infringement.
Patents: A patent grants the owner an exclusive monopoly on the ideas behind an invention for 20
4. years. The congressional intent behind patent law was to ensure that inventors of new machines,
a) Describe key technology trends that raise ethical issues. What is intellectual property? How do devices, or methods receive the full financial and other rewards of their labor and yet make
you protect intellectual property? (3+2+3=8) widespread use of the invention possible by providing detailed diagrams for those wishing to use
the idea under license from the patent’s owner. The key concepts in patent law are originality,
b) As an IT manager at a manufacturing company, how would you reduce computer frauds and
novelty, and invention. The strength of patent protection is that it grants a monopoly on the
leakage of business secrets from your organization? How can the Electronic Transaction Act help
underlying concepts and ideas of software.
you in this regard? (4+3=7)
4 b) As the IT manager, I would adopt the following measures to reduce computer frauds and leakage
Answer of business secrets from my organization:
4 a) First part:
Ethical issues long preceded information technology. Information technology has heightened ➢ Have a clearly articulated IT security and information security policy.
ethical concerns, taxed existing social arrangements, and made some laws obsolete or severely ➢ Make all the stakeholders (staff, management, partners) aware of the security issues, risks, policy
crippled. There are four key technological trends responsible for these ethical stresses provisions, implications and preventive measures against computer fraud and information leakage.
Doubling of computer power: The doubling of computing power every 18 months has made it ➢ Use appropriate technology to ensure information safeguards such as enforce use of official email
possible for most organizations to use information systems for their core production processes. As address for all business correspondences, banning portal storage devices for non-essential
a result, our dependence on systems and our vulnerability to system errors and poor data quality purposes, use genuine and licensed software, ban pirated software.
have increased. Social rules and laws have not yet adjusted to this dependence. Standards for ➢ Restrict use of unnecessary online services such as torrents, social media etc in the corporate
ensuring the accuracy and reliability of information systems are not universally accepted or computers.
enforced. ➢ Have a proper whistleblowing and follow-up mechanism to bring any breach of the policies and
Rapidly declining data storage costs: Advances in data storage techniques and rapidly declining
laws to the knowledge of management.
storage costs have been responsible for the multiplying databases on individual employees,
➢ Keep software and tools update with necessary patches, upgrades, support from vendor etc.
customers, and potential customers maintained by private and public organizations. These
advances in data storage have made the routine violation of individual privacy both cheap and ➢ Promptly isolate and act upon any case of impropriety and data loss.
effective. Already massive data storage systems are cheap enough for regional and even local ➢ Conduct regular security and information system audit to ensure the systems, processes and
retailing firms to use in identifying customers. practices are properly tuned to ensure maximum security and to prevent fraud.
Networking advances and the Internet: Advances in data analysis techniques for large pools of
data are a third technological trend that heightens ethical concerns because companies and The Electronic Transaction Act shall help in the following ways to reduce computer frauds and
government agencies are able to find out much detailed personal information about individuals. leakages:
With contemporary data management tools, companies can assemble and combine the myriad ➢ It specifies the categories of the offenses related to computer fraud and mismanagement.
pieces of information about data stored on computers much more easily than in the past. ➢ It also specifies what constitutes the unlawful access to information and information system
Advances in data analysis techniques: Companies with products to sell purchase relevant infrastructure.
information from these sources to help them more finely target their marketing campaigns. ➢ Apart from defining the offenses and unlawful activities, the Act also specifies the action and
Companies can analyze large pools of data from multiple sources to rapidly identify buying punishment for the defined offenses along with the initial process of reporting and investigation.
patterns of customers and suggest individual responses.
As the Electronic Transaction Act defines offenses and the actions/punishment for those offenses,
Second part: it serves as a baseline to specify organization-wise policy to control frauds as well as take action
Intellectual property is a broad categorical description for the set of intangible assets owned and on the acts of frauds that have been committed. As a result, organizations and their security team
legally protected by a company or individual from outside use or implementation without consent. have a good frame of reference regarding controlling and managing computer frauds.
An intangible asset is a non-physical asset that a company or person owns.

Third part: 5.
Three main ways that protects intellectual property are as follows a) Why do you need IT strategy? How do you align IT strategy with business strategy?
Trade secret: Any intellectual work product such as a formula, device, pattern, or compilation of (3+5=8)
data used for a business purpose can be classified as a trade secret, provided it is not based on b) Why do we need information systems audit? Explain standards for information systems audit.
information in the public domain. Protections for trade secrets vary from state to state. In general, (3+4=7)
trade secret laws grant a monopoly on the ideas behind a work product, but it can be a very tenuous Answer
monopoly.
10 11
The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal

119 120
 Suggested Answers June 2024 Examination (CAP III - Group II) Suggested Answers June 2024 Examination (CAP III - Group II)

To align IT with the business and use information technology effectively for competitive
advantage, managers need to perform a strategic systems analysis. To identify the types of systems
5 a) First Part: In today's digital age, every organization is dependent on technology to carry out its that provide a strategic advantage to their firms, managers should ask the following questions:
business functions. From managing customer data to processing financial transactions, technology • What is the structure of the industry in which the firm is located?
has become an integral part of every organization’s operations. Having an IT strategy is crucial for What are some of the competitive forces at work in the industry? Are there new entrants to the
organizations to leverage technology effectively and achieve their business objectives. industry? What is the relative power of suppliers, customers, and substitute products and services
Having an IT strategy is critical for organizations of all sizes and industries. It helps align IT with over prices? Is the basis of competition quality, price, or brand? What are the direction and nature
the organization’s business goals, increase efficiency and productivity, enhance security and of change within the industry? From where are the momentum and change coming? How is the
compliance, improve customer experience, foster innovation, manage costs, and enable scalability. industry currently using information technology? Is the organization behind or ahead of the
By investing in an IT strategy, organizations can leverage technology effectively and achieve their industry in its application of information systems?
desired outcomes, driving growth and success in today's digital age. • What are the business, firm, and industry value chains for this particular firm?
• Align IT with Business Goals: One of the primary benefits of having an IT strategy is that it helps How is the company creating value for the customer – through lower prices and transaction costs
align IT with the organization’s business goals. or higher quality? Are there any places in the value chain where the business could create more
• Increase Efficiency and Productivity: An IT strategy can also help increase efficiency and value for the customer and additional profit for the company? Does the firm understand and
productivity within the business. manage its business processes using the best practices available? Is it taking maximum advantage
• Enhance Security and Compliance: Security and compliance are critical concerns for every of supply chain management, customer relationship management, and enterprise systems? Does
organization, particularly in today's environment where cyber threats are rampant. An IT strategy the firm leverage its core competencies? Is the industry supply chain and customer base changing
can help organizations enhance their security and compliance posture by identifying the right in ways that benefit or harm the firm? Can the firm benefit from strategic partnerships, value webs,
security tools and processes to protect their assets, data, and systems. ecosystems, or platforms? Where in the value chain will information systems provide the greatest
• Improve Customer Experience: Customer experience is a key differentiator for businesses today. value to the firm?
With an IT strategy in place, you can leverage technology to enhance the customer experience by • Have we aligned IT with our business strategy and goals?
offering more personalized, responsive, and seamless interactions across all touchpoints. Have we correctly articulated our business strategy and goals? Is IT improving the right business
• Foster Innovation: Innovation is critical for any business to stay competitive in today's fast-paced processes and activities to promote this strategy? Are we using the right metrics to measure
environment. An IT strategy can help foster innovation by identifying emerging technologies and progress toward those goals?
trends that can be leveraged to create new products, services, and business models.
• Manage Costs: IT costs are often a significant burden for organizations, particularly for small and 5 b) First Part: An information technology audit, or information systems audit, is an examination of the
medium-sized businesses with limited resources. An IT strategy can help manage costs by management controls within an Information technology (IT) infrastructure. The evaluation of
identifying the most cost-effective solutions and technologies that meet the business's needs. obtained evidence determines if the information systems are safeguarding assets, maintaining data
• Enable Scalability: As businesses grow and evolve, their IT needs also change. An IT strategy integrity, and operating effectively to achieve the organization's goals or objectives. These reviews
can help enable scalability by identifying technologies and processes that can grow and adapt with may be performed in conjunction with a financial statement audit, internal audit, or other form of
the organization. attestation engagement. IT audits are also known as "automated data processing (ADP) audits" and
"computer audits". They were formerly called "electronic data processing (EDP) audits".
Second Part: Technology & Business are almost inseparable. We cannot even imagine a business The purposes of an IT audit are to evaluate the system's internal control design and effectiveness.
This includes, but is not limited to, efficiency and security protocols, development processes, and
without computers, internet & software today. Information Technology plays a very vital role in
IT governance or oversight. Installing controls are necessary but not sufficient to provide adequate
the efficient functioning of a Business.
security. People responsible for security must consider if the controls are installed as intended, if
Business strategy is the roadmap to achieve the company’s business objectives. The business
strategy consists of defining business goals, planning the course of actions, business processes, they are effective, or if any breach in security has occurred and if so, what actions can be done to
and taking decisions to achieve specified business objectives. prevent future breaches.
IT Strategy or Information technology strategy provides guidelines on how technology should be The primary functions of an IT audit are to evaluate the systems that are in place to guard an
used to help the business achieve its objectives. organization's information. Specifically, information technology audits are used to evaluate the
Business-IT alignment is a process where businesses leverage information technology (IT) to organization's ability to protect its information assets and to properly dispense information to
achieve strategic business objectives, such as expanding the reach of their products, improving authorized parties. The IT audit aims to evaluate the following:
financial performance, or more. For example, companies that only sell their products through • Will the organization's computer systems be available for the business at all times when required?
physical stores, can leverage IT to launch an eCommerce website & carry out online sales to (known as availability)
expand their reach and increase market share • Will the information in the systems be disclosed only to authorized users? (known as security and
The business scenario is changing rapidly. Customers’ expectations have also increased. They confidentiality)
want the right quality product, at the right price to be delivered to them right away. Adopting • Will the information provided by the system always be accurate, reliable, and timely? (measures
technology is inevitable for improving customer experience & satisfaction. the integrity)
With advancements such as computing power, internet, mobility, cloud computing, automation Many organisations are spending large amounts of money on IT because they recognise the
tools, application software are now widely available & affordable. Technology is now well within tremendous benefits that IT can bring to their operations and services. However, they need to
the reach. So, companies must leverage IT to meet and overcome current business challenges and ensure that their IT systems are reliable, secure and not vulnerable to computer attacks.
stay ahead of the competition.
12 13
The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal

121 122
 Suggested Answers June 2024 Examination (CAP III - Group II) Suggested Answers June 2024 Examination (CAP III - Group II)

IT audit is important because it gives assurance that the IT systems are adequately protected, Long distances: If you outsource IT to a provider in another country, the time difference and long
provide reliable information to users and properly managed to achieve their intended benefits. distance can make communication difficult. It can also make business trips costly and time-
Many users rely on IT without knowing how the computers work. A computer error could be consuming.
repeated indefinitely, causing more extensive damage than a human mistake. IT audit could also
help to reduce risks of data tampering, data loss or leakage, service disruption, and poor 6 b) Cloud computing is a general term for the delivery of hosted services over the internet. Cloud
management of IT systems. computing enables companies to consume computer resources, such as a virtual machine
(VM), storage or an application, as utility rather than having to build and maintain computing
Second Part: The specialized nature of Information Systems auditing and the professional skills infrastructures in house.
and credibility necessary to perform such audits, require standards that would apply specifically Cloud computing boasts several attractive benefits for businesses and end users. Five of the main
to IS auditing. Standards, procedures and guidelines have been issued by various institutions, benefits of cloud computing are:
which discuss the way the auditor should go about auditing Information Systems. The framework • Self-service provisioning: End users can spin up compute resources for almost any type of
for the IS Auditing Standards provides multiple levels of guidance. Standards provide a framework workload on demand. This eliminates the traditional need for IT administrators to provision and
for all audits and auditors and define the mandatory requirements of the audit. They are broad manage compute resources.
statement of auditors’ responsibilities and ensure that auditors have the competence, integrity, • Elasticity: Companies can scale up as computing needs increase and scale down again as demands
objectivity and independence in planning, conducting and reporting on their work. decrease. This eliminates the need for massive investments in local infrastructure, which may or
The IT Audit Framework can serve as a reference for mandatory standards and recommended best may not remain active.
practices to follow during IT audit and assurance engagements. The standards are divided into
• Pay per use: Compute resources are measured at a granular level, enabling users to pay only for
three categories:
the resources and workloads they use.
• General standards: These are the guiding principles under which the IS assurance profession
• Workload resilience: Cloud service providers often implement redundant resources to ensure
operates. They apply to the conduct of all assignments and deal with the IS audit and assurance
resilient storage and to keep users' important workloads running -- often across multiple global
professional’s ethics, independence, objectivity, and due care as well as knowledge, competency,
regions.
and skill. These are: Audit Charter, Organizational Independence, Professional Independence,
• Migration flexibility: Organizations can move certain workloads to or from the cloud or to
Reasonable Expectation, Due Professional Care, Proficiency, Assertions, and Criteria.
different cloud platforms as desired or automatically for better cost savings or to use new services
• Performance standards: They deal with the conduct of the assignment, such as planning and
as they emerge.
supervision, scoping, risk and materiality, resource mobilization, supervision and assignment
management, audit and assurance evidence, and the exercising of professional judgement and due
6 c) High availability planning of the system is a detailed planning of how the system’s operation is
care. These are: Engagement Planning, Risk Assessment in Planning, Performance and
continued even if there is a major disruption and outage. A high-availability plan consists of the
Supervision, Materiality, Evidence, Using the Work of Other Experts, Irregularity and Illegal Acts.
infrastructure and logistics as well as a set of clearly defined policies & plan of action regarding
• Reporting standards: These address the types of reports, means of communication and the how to ensure business continuity in case of a major disruption caused by system failure, natural
information communicated. These are: Reporting and Follow-up Activities. disaster, network link outages as well as other causes.
A well-prepared high-availability plan may consist of a combination of the following:
6. Write short notes on the following: (5×3=15) ➢ Details of the high-availability design including server/storage redundancy, network redundancy
a) Disadvantages of IT Outsourcing and geographical redundancy in terms of central and disaster recovery
b) Cloud computing ➢ Step-by-step procedure of restoring services, bringing up backup site if main site is down, starting
c) High availability planning up services and applications.
d) B2C e-Commerce ➢ Clear matrix of responsibilities and persons involved.
e) Categories of Application Controls 6 d) Business-to-Consumer (B2C) refers to a process of businesses selling products and services
directly to consumers, with no middle person. B2C typically refers to online retailers who sell
Answer products and services to consumers through internet. A business website is a place where all
6 a) IT outsourcing is a strategic business technique whereby companies contract with outside service transactions take place directly between a business organization and a consumer. A consumer goes
providers to handle particular IT tasks or full projects. This technique is an essential part of to the website, selects products and orders the products. After receiving the order, goods are
contemporary corporate operations since it includes a wide range of services and activities. dispatched to the customer.
Disadvantages of IT Outsourcing
Loss of control: When you outsource, you are handing over control of your IT operations to a
third party. This can be a concern for some organizations that want to maintain secure control over
their network.
Dependence on the service provider: When outsourcing, you depend on the service provider to
manage your IT operations. This can be a risk if the service provider is not reliable, or fails to meet
your expectations.
Hidden costs: You may have to deal with hidden costs with IT outsourcing, such as contract
termination fees or unexpected changes in scope.
14 15
The Institute of Chartered Accountants of Nepal The Institute of Chartered Accountants of Nepal

123 124
 Suggested Answers June 2024 Examination (CAP III - Group II)

6 e) Categories of application controls

The objective of application controls is to ensure that Input data is accurate, complete, authorized,
and correct. Data is processed as intended in an acceptable time period. Data stored is accurate and
complete.
Outputs are accurate and complete. A record is maintained to track the process of data from input
to storage and to the eventual output
Categories of application controls are as follows:
Input Controls – These controls verify the integrity of data input into a business application. This
data can be entered directly, remotely, or through a web-enabled application or interface. The
purpose of these checks is to confirm that the data stays within the set parameters.
Processing Controls – These controls are designed to verify that the processing of the input data
is complete, accurate, and authorized in a timely manner.
Output Controls – These controls focus on processing the data and aim to validate the output by
comparing it with the expected outcome, ensuring that the results align with the original input.
Integrity Controls – These controls monitor processed data and data at rest for integrity and
accuracy.
Management Trail – These controls allow management to trace transactions and events from
their inception to their final output and vice versa. They also evaluate the efficiency of other control
mechanisms and pinpoint errors as near to their origin as feasible.

16
The Institute of Chartered Accountants of Nepal

125