Data Collection and Use of Information

1 Introduction

Every technique in this paper runs on data. The relevant cash flows of chapter 12, the divisional performance measures of chapter 5, the probabilities of chapters 15 and 16 and the risk register of chapter 17 are only as good as the data behind them.

This chapter therefore serves two parts of the syllabus at once:

• The data required for decision-making — where the data for a medium-term decision comes from, whether it can be relied on, and the role of business intelligence systems in producing it. Chapters 10 to 14 use that data; this chapter is about the data itself.

• The use of information systems and data in managing risk — how the systems that hold the data support the risk management cycle of chapter 17, and what risks the data itself creates.

It also covers the costs, benefits and evaluation of an investment in an information system, which is a capital investment decision of a particular and awkward kind.

2 Sources and integrity of data

2.1 Where the data comes from

In a digital business the flow runs from raw data captured everywhere, through storage and structuring, to the tools that turn it into something a manager can act on.

• A data lake holds data in its raw form, in whatever format it arrived, without deciding in advance what it will be used for. It is cheap to load into and flexible, but nothing in it has been validated.

• A data warehouse holds data that has been cleaned, structured and modelled for analysis — a single consistent version, organised so that it can be queried. Work has been done to it, which is why it can be relied on and why it is more expensive.

• Business intelligence systems sit on top and turn what is in the warehouse into reports, dashboards and analyses for decision-makers (section 3).

2.2 Integrity of the data

Integrity means that the data is what it claims to be, and that it has not been degraded on the way from where it arose to the report on the manager's screen. A capital investment appraisal carried out to four decimal places on data that fails these tests is worth nothing.

Not all the data a decision needs is financial or quantitative. Qualitative information — the strength of a customer relationship, the mood of the workforce, the likelihood that a regulator will act — is often the part that decides the outcome, and it is precisely the part that no system captures. It has to be gathered deliberately and stated in the report, not left out because it will not fit a column.

3 Business intelligence tools

Information systems are the components of hardware, software, databases and network connections that an organisation uses to capture, process, store, distribute and report data. Several types are distinguished by who uses them and what kind of decision they support.

Business intelligence is more than the hardware and the software. It is an organisation-wide recognition that the data collected is a valuable asset. Used to its full potential it is a powerful tool for decision-making and a basis on which management can implement change; left in the systems that captured it, it is a cost.

3.1 Analytics, visualisation and self-service

Three developments have changed how business intelligence reaches managers, and they matter for the responsibility-centre reporting of chapter 5 as much as for risk:

• Analytics — moving beyond reporting what happened to explaining why, predicting what will happen, and recommending what to do about it.

• Visualisation — presenting the result graphically so that the pattern is visible rather than buried in a table. A well-chosen chart carries more to a non-financial manager than a page of figures.

• Self-service — giving managers tools to ask their own questions of the data, instead of waiting for the finance function to run a report. It shortens the cycle from question to answer, at the cost of a new risk: several versions of the truth, unless the underlying definitions are controlled centrally.

4 Big data

Big data refers to the masses of structured and unstructured information collected and stored continuously from mobile phones, websites, social media, sensors and other electronic sources.

4.1 The four Vs

A fifth V, value, is often added: whether the data is worth what it costs to collect, store and analyse. It is the question a management accountant is best placed to ask.

4.2 Benefits

Competitive advantage can be gained where a business is able to analyse and correctly interpret the data to gain insight into customer preferences, buying habits, and consumer trends or patterns of behaviour. In the language of chapter 1, it is what makes customer and channel profitability analysis possible at the level of the individual customer rather than the segment.

4.3 Risks

• Storage and security. Customer data held in bulk is an attractive target. It should be encrypted, access-controlled and retained no longer than it is needed.

• Transparency and lawful basis. Customers must be told what is done with their data, and the organisation must have a lawful basis for doing it. Consent is one such basis, and where consent is the basis relied on — or where a particular rule requires it, as the rules on electronic direct marketing do — it must actually have been obtained. It is not, however, the only lawful basis; see section 5.2.

• Misinterpretation. Data may be unrepresentative, or misleading, or simply misread by the decision-makers, causing them to take the wrong course of action and to spend real resources on a pattern that was not there. Correlation found in a large enough dataset is not evidence of anything on its own.

• Cost. Collection, storage, cleaning and analysis all cost money, and the fifth V is not automatic.

5 Risks of information, and the law

5.1 Risks of information systems

Information systems and electronic data carry general and specific risks that have to be controlled and reduced to an acceptable level — the same TARA analysis as chapter 17, applied to the information asset:

• theft of, or damage to, hardware;

• data corruption, and the loss of data that cannot be reconstructed;

• operational errors and erroneous input;

• fraud and industrial espionage;

• malware, including ransomware;

• hacking and unauthorised access;

• loss of availability — a system that is down when the decision has to be taken;

• over-dependence on a single supplier, platform or key individual.

5.2 Data protection legislation

Most jurisdictions legislate to protect individuals against the misuse of their personal data. The best-known regime is the General Data Protection Regulation (GDPR), which applies across the European Union, and the UK GDPR, which is the United Kingdom's own version of it and sits alongside the Data Protection Act 2018. The two started from the same text and have been amended separately since, so they are close relatives rather than one law, and a comparable regime in another country will differ again. What follows is the shape common to them; the detail is jurisdiction-specific and P2 does not examine any single country's law.

• Principles. Personal data must be processed lawfully, fairly and transparently, collected for specified purposes, limited to what is necessary, kept accurate and up to date, retained no longer than necessary, and kept secure.

• A lawful basis is needed to process it at all. The EU GDPR sets out six: consent, performance of a contract, a legal obligation, vital interests, a public task, and legitimate interests, and that six-basis list is the model to learn. The UK GDPR has since added a seventh — recognised legitimate interests, inserted by the Data (Use and Access) Act 2025 for a closed list of purposes fixed in law, where no balancing test is needed — so do not describe the six as current UK law, and do not carry the UK's seventh across to the EU regime. Consent is one basis among them and not a general requirement; where it is relied on it must be freely given, specific and capable of being withdrawn, and some activities — much electronic direct marketing, for instance — are governed by separate rules that require consent where those rules apply.

• Individual rights. Individuals can ask what data an organisation holds about them and receive a copy — a subject access request. Under the GDPR this is normally free of charge and must be answered within one month; a fee may only be charged for a request that is manifestly unfounded or excessive, or for further copies. Individuals may also have rights to correction, erasure, restriction and portability.

• A supervisory authority. Each jurisdiction has a national data-protection authority that investigates breaches and enforces the law. In the United Kingdom, for example, it is the Information Commissioner's Office (ICO), which has taken a particular interest in the use of big data and analytics.

• Penalties. Organisations that fail to comply can be fined, and the maximum penalties are set as a percentage of worldwide turnover or a fixed ceiling, whichever is the higher — under the GDPR, up to 4% of total annual worldwide turnover or €20 million. Serious breaches normally have to be reported to the supervisory authority within a short deadline (72 hours under the GDPR), and affected individuals told where the risk to them is high. Individuals may in addition claim compensation for the damage or distress caused.

6 Using information systems and data to manage risk

Chapter 17 set out the risk management cycle. Each stage of it depends on information systems, and this is the syllabus topic the chapter exists to serve.

The systems also create risk, and the same chapter deals with both: a business whose risk reporting depends on one dashboard has concentrated its exposure in that dashboard.

7 Evaluating an investment in an information system

An information system is a capital investment, and in principle it is appraised like any other — net present value, or a cost-benefit analysis, using the techniques of chapters 10 to 13.

In practice it is one of the awkward cases, because its cash flow profile does not look like a conventional project's.

• The costs are largely up front and largely certain; the benefits arrive later and are largely uncertain — which is exactly the profile that a conventional NPV, discounting the later flows most heavily, treats least kindly.

• Many of the benefits are intangible. It is genuinely difficult to put a figure on “better decisions” or “more secure data”, and a benefit left out of the appraisal because it cannot be quantified is valued at nil, which is the one figure certain to be wrong.

• The benefits often depend on changes in behaviour — that managers actually use the dashboards — rather than on the system alone.

Because of this, NPV and cost-benefit analysis are sometimes less useful here than elsewhere, and are supplemented rather than replaced:

• A balanced scorecard approach — assessing the investment against customer, internal process and learning objectives as well as financial ones (chapter 8).

• Assigning a financial value to the achievement of objectives — if the system is expected to cut the order-to-cash cycle by five days, the working capital released is a real and measurable cash flow (chapter 12).

• Phasing the commitment — a pilot, then a decision to roll out. That is the real option to expand or abandon from chapter 13, and it is worth something precisely because the benefits are uncertain.

• Post-completion audit — comparing what the system actually delivered with what was promised, which is the only way the next appraisal of this kind gets any better.

8 Test your knowledge

Two quick checks before you move on: work through the flashcards to fix this chapter’s key terms and definitions, then sit the objective questions for exam-style practice. Both mark themselves and explain the answers as you go.