Protect accounting data in a computerised system
Combine access controls, validation, backups and reconciliation to protect the confidentiality and integrity of accounting records.
Section 1.2 · The accounting system
Cambridge International AS & A Level Accounting 9706, 2026–2028 syllabus, Version 2. These lessons cover Topic 1.2 only. The 2029 syllabus has a separate document and is not mapped here. Practice is self-checked, not an official Cambridge grade; timed-paper practice and human subject-teacher review remain outstanding.
Before you begin
- Topic 1.1 introduces business forms and finance. In these lessons, keep each transaction tied to its source evidence and record both sides of its effect.
Work on paper. Try each question before revealing help, and explain why your method works.
Quick readiness check
Which control most directly limits a former employee's access?
What you will learn
- Identify practical controls for accounting data
- Distinguish confidentiality, accuracy and availability
- Explain why backups and review do not replace each other
Limit access and protect changes
Use individual accounts, strong authentication and role-based access so people can view or change only what their duties require. Remove access promptly when a role changes or ends, and review unusual access.
Use validation and approval controls to reduce errors or unauthorised changes. Keep an audit trail that records who changed what and when. Separate duties where practical so one person does not control every stage of a sensitive transaction.
Plan for recovery and check the records
Back up data regularly and test that a backup can be restored. Keep copies protected from the same failure or attack that could affect the live system. Updates and anti-malware controls help reduce security exposure.
Reconciliation and review can reveal missing, duplicated or altered entries. Security, backups and reconciliation solve different problems: a backup supports recovery, while a reconciliation checks whether records agree with independent evidence.
Pause and explain
What does a reconciliation add after access controls and backups are in place?
Worked example
A former employee can still log in and a weekly backup has never been restored in a test. Identify two risks and two controls.
Show the worked solution
- The former employee's active account creates an unauthorised-access risk.
- An untested backup may fail when the business needs to restore it.
- Remove or disable obsolete access and test a protected backup restoration.
Answer Disable the former employee's account and review access. Test restoration from a protected backup; an untested copy is not proof that data can be recovered.
Try a topic test
Choose Easy, Normal or Difficult. Save your answers and open worked review after finishing.
Test this topic →From guided practice to a new situation
Write your answer and reasoning first. Use a hint only if you are stuck. The model solution is for self-checking; your written work is not automatically marked.
A finance assistant needs to enter supplier invoices but not approve payments. Suggest an access-control design.
Give me a hint
Give the user the permissions needed for the task and restrict approval separately.
Compare my reasoning
- Create an individual account for the assistant.
- Grant invoice-entry permissions only.
- Reserve payment approval for an authorised separate role and review the audit trail.
Use an individual account with invoice-entry access; keep payment approval with an authorised separate user and review recorded changes.
Look for these in your work
- Individual access
- Least privilege
- Approval and logging separated
A company stores daily backups on the same laptop as its accounting database. Explain one weakness and propose an improvement.
Give me a hint
Consider a failure or attack that affects both copies.
Compare my reasoning
- The laptop could be lost, damaged or compromised, affecting both the live database and backup.
- Keep encrypted backups in a separate protected location or service.
- Test restoration and restrict who can access or delete copies.
The backup shares the same failure point as the database. Keep protected copies separately, restrict access and test recovery so the business can restore records after a device loss or compromise.
Look for these in your work
- Common failure identified
- Separate copy proposed
- Restore test included
A manager asks one employee to create suppliers, change bank details and approve payments. Explain a risk and a better control.
Give me a hint
Think about one person controlling the whole payment path.
Compare my reasoning
- A single user could create a false supplier and redirect payment without an independent check.
- Separate supplier setup or bank-detail changes from payment approval where practical.
- Use independent verification for bank changes and review the audit trail.
Concentrating setup, bank-detail changes and payment approval in one account raises fraud and error risk. Separate duties, independently verify bank changes and review the change log.
Look for these in your work
- Risk identified
- Duties separated
- Independent verification proposed
Common mistakes
- Treating one shared password as an audit trail
- Keeping a backup connected to the same system without considering common failure
- Assuming an access control proves that transaction amounts are correct
What can you explain now?
Why should a business test backup restoration?
Compare with the explanation
To check that the copy can actually recover usable records
A backup is useful only if it can be restored when needed.
After trying it yourself, choose your next review. This is your self-assessment.
Your review choice appears on Today. Sign in to sync it across devices.
Make it stick
How does an access control differ from a reconciliation?
If you needed the solution, close it and solve the problem again from a blank page. A correct answer is stronger when you can explain the reason for each step.