Identify Components Of IT Infrastructure - CPA Isc

SECTION 1

Historical Context & Motivation

The concept of IT infrastructure has evolved dramatically over the past seven decades, transforming from room-sized mainframes used exclusively by government agencies and large banks into the distributed, cloud-enabled ecosystems that underpin virtually every financial transaction today. For CPA candidates studying information systems, understanding this evolution is essential because audit and assurance standards require professionals to evaluate the technological environment in which financial data is created, processed, stored, and reported. The trajectory of IT infrastructure directly mirrors the growing complexity of enterprise accounting systems, from manual ledgers to real-time ERP platforms.

1950s • Mainframe Era

Large corporations and government agencies deployed centralized mainframes for batch processing of payroll, billing, and general ledger transactions. Hardware, software, and data resided in a single physical location.

1980s • Client-Server Architecture

Personal computers proliferated across offices, and organizations adopted client-server models that distributed computing power. Databases moved to dedicated servers while users interacted through desktop applications.

1990s • Enterprise Resource Planning (ERP)

Vendors like SAP and Oracle integrated accounting, procurement, and human resources into unified ERP systems, demanding robust networking and standardized database platforms across the enterprise.

2006–2010 • Cloud Computing Emergence

Amazon Web Services, Microsoft Azure, and Google Cloud Platform enabled organizations to rent computing resources on demand, shifting capital expenditures to operating expenditures and introducing new audit considerations.

2020s • Hybrid & Edge Infrastructure

Modern enterprises blend on-premises data centers, public cloud services, and edge devices. CPAs must now evaluate controls across multi-cloud environments and assess third-party service organization controls (SOC reports).

This historical arc raises the central question for today's CPA: given that financial data now flows across hardware, software, networks, databases, and cloud services simultaneously, how does an auditor systematically identify and evaluate each component of an organization's IT infrastructure? Answering this question requires a structured framework that maps every layer of technology to the internal controls that protect the integrity, availability, and confidentiality of financial information.

SECTION 2

Core Principles & Definitions

IT infrastructure encompasses the entirety of hardware, software, networking, data management, and human resources that an organization relies upon to process and safeguard its information. From the CPA's perspective, these components form the IT general controls environment—the foundation upon which application-level controls for financial reporting are built. Weaknesses at the infrastructure level can undermine even the most carefully designed application controls, which is why auditing standards (such as those in PCAOB AS 2201 and AICPA AT-C 205) require an understanding of the entity's IT environment as part of risk assessment.

Hardware

Physical computing devices—servers, workstations, storage arrays, and networking equipment—that provide the processing power and data persistence layer. Includes both on-premises assets and collocated equipment.

Software

Operating systems, middleware, database management systems, and application software (ERP, CRM, financial reporting tools) that execute business logic and process transactions.

Networking & Telecommunications

Routers, switches, firewalls, load balancers, VPNs, and internet connections that enable data transmission between systems, users, and external parties such as banks and regulators.

Data Management

Databases (relational and non-relational), data warehouses, backup systems, and archival solutions that store, organize, and protect the organization's financial and operational data.

Human Capital & Processes

IT personnel (administrators, developers, security analysts) and governance frameworks (ITIL, COBIT) that manage change, access, and operations across the technology stack.

✦

KEY TAKEAWAY

Think of IT infrastructure like the plumbing, electrical wiring, and structural framing of a commercial building. Just as a bank examiner inspects the vault door and the building's foundation, a CPA must evaluate not only the financial application itself but the entire underlying infrastructure—hardware, software, networks, data stores, and the people who manage them—to determine whether financial data can be trusted.

SECTION 3

Visual Explanation — The IT Infrastructure Stack

The IT infrastructure stack illustrates how each layer builds upon the one below it. Hardware forms the physical foundation, networking connects the components, operating systems and data management provide the logical platform, and application software delivers business functionality. Human capital and governance span the entire stack.

The diagram above reveals a critical principle for CPA candidates: a control deficiency at any lower layer propagates upward. For example, if the networking layer lacks a properly configured firewall, the data management and application layers above it become vulnerable to unauthorized access, potentially compromising financial statement integrity. When performing risk assessment procedures, auditors trace the flow of financially significant transactions through each layer—from the physical server where data resides, through the network that transmits it, to the application that records journal entries—to identify where general IT controls must be tested.

SECTION 4

How IT Infrastructure Components Interact

While IT infrastructure is not inherently mathematical in the way that, say, present-value calculations are, several quantitative frameworks help CPAs and IT auditors evaluate infrastructure adequacy. Understanding metrics such as availability, Recovery Time Objective (RTO), and Recovery Point Objective (RPO) is essential when assessing whether an organization's infrastructure can support the continuity of financial reporting operations.

SYSTEM AVAILABILITY

Availability (%) = (Total Time − Downtime) ÷ Total Time × 100

Where Total Time is the scheduled operating period and Downtime includes both planned maintenance and unplanned outages. A '99.99%' target (four nines) permits only ≈ 52.6 minutes of downtime per year.

ANNUALIZED LOSS EXPECTANCY

ALE = SLE × ARO

SLE (Single Loss Expectancy) = Asset Value × Exposure Factor. ARO (Annualized Rate of Occurrence) is the estimated frequency of the threat per year. CPAs use ALE to justify infrastructure investments in business continuity and disaster recovery plans.

These formulas underscore an important point: IT infrastructure decisions have direct financial consequences. When an organization invests in redundant servers, mirrored databases, or geographically dispersed cloud availability zones, it is effectively purchasing a reduction in its Annualized Loss Expectancy. For the CPA, the ability to connect infrastructure components to quantifiable business risk is what distinguishes a competent IS auditor from one who merely checks boxes on a control checklist.

💡

CPA Exam Relevance

The ISC section of the CPA exam frequently tests your ability to identify which IT infrastructure component is implicated in a given scenario. For instance, a question might describe a data breach and ask which layer of infrastructure—network, database, or application—likely contained the control weakness. Map each scenario to the layered stack model.

SECTION 5

Detailed Classification of Infrastructure Components

To prepare for both the CPA exam and professional practice, it is helpful to classify IT infrastructure components along two dimensions: physical versus logical and on-premises versus cloud-based. This two-dimensional classification allows auditors to quickly determine which controls are managed internally versus those that require reliance on a service organization's SOC report.

This 2 × 2 classification matrix helps auditors determine control ownership. On-premises components are fully entity-managed, while cloud-based components operate under a shared responsibility model requiring SOC report reliance.

Component Category	Examples	Key Audit Consideration
Hardware	Servers, workstations, storage, UPS, biometric scanners	Physical access controls, environmental controls (HVAC, fire suppression), asset inventory
Operating Systems	Windows Server, Linux (RHEL, Ubuntu), macOS	Patch management, hardening configuration, privileged account management
Database Systems	SQL Server, Oracle, PostgreSQL, MongoDB	Access controls to tables/views, encryption at rest, backup frequency and integrity testing
Networking	Firewalls, IDS/IPS, VPN gateways, DNS servers	Firewall rule reviews, network segmentation, encryption in transit (TLS/SSL)
Application Software	SAP, Oracle Financials, QuickBooks, custom web apps	Segregation of duties, input validation, change management procedures
Cloud Services	AWS, Azure, GCP (IaaS, PaaS, SaaS)	SOC 1/SOC 2 report review, shared responsibility model, data residency compliance

Summary of IT infrastructure components and their primary audit considerations

SECTION 6

Worked Example — Mapping Infrastructure in an Audit Engagement

Consider the following scenario: you are a CPA performing an IT general controls assessment for Meridian Manufacturing, Inc., a mid-sized company that uses SAP S/4HANA hosted on-premises for financial reporting. The company recently migrated its payroll system to a SaaS provider (ADP Workforce Now) and uses Microsoft Azure for backup and disaster recovery. Your task is to identify and classify all IT infrastructure components relevant to the financial statement audit.

Meridian Manufacturing — IT Infrastructure Mapping

1
Step 1 — Identify Financial Applications

Begin by listing all applications that process financially significant transactions. At Meridian, these include SAP S/4HANA (general ledger, accounts payable, accounts receivable, inventory) and ADP Workforce Now (payroll, tax withholding). These represent the application software layer.

Two financially significant applications identified: SAP (on-premises) and ADP (SaaS cloud).
2
Step 2 — Trace Underlying Infrastructure Per Application

For SAP (on-premises): the application runs on two Dell PowerEdge servers in the company's data center, using a SAP HANA database on SUSE Linux Enterprise Server. The servers connect to the corporate LAN via Cisco switches and are protected by a Palo Alto next-generation firewall. For ADP (cloud): the physical and logical infrastructure is managed by ADP; Meridian accesses it via encrypted HTTPS over the internet.

SAP stack: Dell servers → SUSE Linux → HANA DB → Cisco network → Palo Alto firewall. ADP stack: CSP-managed (SOC report required).
3
Step 3 — Map Backup and Disaster Recovery Components

Meridian replicates SAP database snapshots nightly to Microsoft Azure Blob Storage using Azure Site Recovery. This introduces a cloud infrastructure component (IaaS) that supports the on-premises SAP environment, meaning the auditor must also evaluate Azure's controls—typically by reviewing Microsoft's SOC 2 Type II report.

Azure DR introduces a hybrid infrastructure model; Microsoft SOC 2 report required.
4
Step 4 — Classify Components Using the 2 × 2 Matrix

Using the physical/logical and on-premises/cloud matrix from Section 5, classify each component. Dell servers, Cisco switches, and Palo Alto firewall fall into Physical + On-Premises. SUSE Linux and SAP HANA fall into Logical + On-Premises. ADP Workforce Now falls into Logical + Cloud (SaaS). Azure Blob Storage falls into Logical + Cloud (IaaS). Microsoft's and ADP's physical data center infrastructure falls into Physical + Cloud.

All four quadrants of the matrix are populated—Meridian has a hybrid infrastructure.
5
Step 5 — Determine Control Ownership and Audit Approach

For entity-managed components (on-premises), the auditor performs direct testing of IT general controls: access management, change management, and computer operations. For cloud components (ADP, Azure), the auditor obtains and reviews the service organizations' SOC 1 and SOC 2 reports, evaluates complementary user entity controls (CUECs), and performs bridge-letter inquiries if the SOC report period does not align with the audit period.

Final output: A complete IT infrastructure map with control ownership assignments for every component.

SECTION 7

Strengths, Limitations, and Risk Implications

Each infrastructure model—on-premises, cloud-based, or hybrid—carries distinct advantages and risks that influence the CPA's audit strategy. The table below contrasts these models across dimensions that matter most to financial statement auditors and IT governance professionals.

Dimension	On-Premises	Cloud-Based	Hybrid
Control Visibility	Full visibility; direct testing possible	Limited; reliance on SOC reports	Mixed; requires dual approach
Scalability	Requires capital expenditure for capacity additions	Elastic; resources scale on demand (OpEx model)	Flexible burst capacity with on-prem baseline
Data Residency	Known physical location; simpler regulatory compliance	Multi-region; potential cross-border data issues	Sensitive data can remain on-prem while other workloads go to cloud
Disaster Recovery	Requires secondary site; expensive to maintain	Built-in geo-redundancy from CSPs	Cloud serves as DR for on-prem workloads
Vendor Dependency	Low; entity retains full operational control	High; lock-in risk and CSP concentration risk	Moderate; critical apps may have exit strategies

Comparative analysis of infrastructure models from an audit and governance perspective

🔍

AUDITOR'S PERSPECTIVE

Much like a portfolio manager who diversifies investments across asset classes to manage risk, organizations increasingly adopt hybrid infrastructure to balance control, cost, and resilience. The CPA's job is to understand the full portfolio of IT components—on-prem and cloud alike—and evaluate whether the aggregate control environment adequately mitigates the risk of material misstatement in the financial statements.

SECTION 8

Connection to Advanced IT Governance & Emerging Technologies

The foundational IT infrastructure concepts covered in this lesson serve as a gateway to more advanced topics that are increasingly relevant to CPA practice. As organizations adopt artificial intelligence, blockchain, robotic process automation (RPA), and Internet of Things (IoT) devices, the infrastructure supporting financial systems becomes more complex and demands a more sophisticated understanding from the auditor.

Foundational Concept	Advanced Extension	CPA Relevance
Physical servers (hardware layer)	Containerization (Docker, Kubernetes) and serverless computing	Audit trails become more ephemeral; controls must be embedded in CI/CD pipelines
Relational databases (data layer)	Distributed ledger technology (blockchain)	Immutable transaction records may reduce certain reconciliation procedures but introduce smart contract audit risks
Application software (ERP)	AI/ML-powered financial analytics and automated journal entries	Auditors must evaluate model governance, training data integrity, and algorithmic bias
Network firewalls (security layer)	Zero Trust architecture and micro-segmentation	Traditional perimeter-based controls are replaced by identity-centric models requiring continuous authentication testing
Cloud services (IaaS/SaaS)	Multi-cloud and edge computing	Multiple SOC reports from different CSPs must be reconciled; data sovereignty becomes a significant compliance concern

How foundational IT infrastructure concepts extend to emerging technologies

Looking forward, the AICPA's evolving guidance—including updates to the Trust Services Criteria and the IT SOC framework—reflects the profession's recognition that IT infrastructure is no longer static. The CPA who develops a strong mental model of infrastructure components today will be well-positioned to adapt as these components evolve. On the ISC section of the CPA exam, expect questions that test not only your ability to identify current infrastructure components but also your understanding of how emerging technologies reshape the control environment.

SECTION 9

Practice Problems

Question 1: CONCEPTUAL

A CPA is conducting a risk assessment and learns that the client's general ledger application runs on an operating system that has not received security patches for over 18 months. Which layer of the IT infrastructure stack does this deficiency primarily affect, and why would it concern the auditor beyond just the operating system layer?

Show answer

The deficiency resides at the operating system layer (Layer 3 in the infrastructure stack). However, the concern extends beyond this layer because of the principle of upward propagation: an unpatched OS can be exploited to gain unauthorized access to the database layer (Layer 4) and the application layer (Layer 5) above it. A known vulnerability in the OS could allow an attacker to bypass application-level access controls entirely, potentially leading to unauthorized modification of financial data. The auditor would likely conclude that IT general controls over computer operations and security administration are deficient, increasing the assessed risk of material misstatement.

Question 2: BASIC CALCULATION

A company's primary financial reporting server was available for 8,700 hours out of a total scheduled operating time of 8,760 hours during the past year. Calculate the server's availability percentage and determine whether it meets the 'three nines' (99.9%) availability standard.

Show answer

Applying the availability formula: Availability = (8,760 − 60) ÷ 8,760 × 100 = 8,700 ÷ 8,760 × 100 ≈ 99.32%. The server experienced 60 hours of downtime (approximately 2.5 days). This falls short of the 99.9% standard, which permits only 8.76 hours of downtime per year. The auditor should investigate whether the downtime affected any financial reporting deadlines or data integrity, and evaluate whether the organization's disaster recovery and business continuity controls are adequate for the level of availability required by its financial operations.

Question 3: INTERMEDIATE

Ridgeview Corp. uses Oracle Financials hosted on on-premises servers for accounts payable and receivable but recently migrated its payroll to Workday (SaaS). The company also uses AWS for data backup. For each of these three systems, classify the infrastructure as on-premises or cloud, identify which components the auditor can test directly, and specify which components require SOC report reliance.

Show answer

Oracle Financials (on-premises): The hardware (servers, storage), operating system, database, and network infrastructure are all entity-managed. The auditor can perform direct testing of all IT general controls—access management, change management, patch management, and computer operations. Workday Payroll (SaaS cloud): All infrastructure layers—physical data centers, networking, OS, database, and the application itself—are managed by Workday. The auditor must obtain and review Workday's SOC 1 Type II report to assess controls relevant to financial reporting, evaluate any CUECs listed in the report, and test Ridgeview's complementary controls (e.g., user access provisioning within Workday). AWS Backup (IaaS cloud): AWS manages physical hardware and virtualization. Ridgeview manages the configuration of backup jobs and encryption settings. The auditor obtains AWS's SOC 2 Type II report for the physical and logical security of the cloud platform and directly tests Ridgeview's backup configuration, retention policies, and restoration testing procedures.

Question 4: APPLIED

During an audit of Pinnacle Financial Services, you discover that the company's ERP database (SQL Server) experienced a ransomware attack that encrypted 72 hours of transaction data. The most recent successful backup was four days old because the nightly backup to Azure had been silently failing for three nights. Pinnacle's management states the RPO is 24 hours. Calculate the Annualized Loss Expectancy (ALE) given the following: the estimated cost to reconstruct the lost data is $450,000 (SLE), and management estimates such incidents occur once every five years (ARO = 0.2). Then, discuss which IT infrastructure components failed and what controls should have prevented this outcome.

Show answer

ALE = SLE × ARO = $450,000 × 0.2 = $90,000 per year. This means the organization should be willing to invest up to approximately $90,000 annually in preventive and detective controls to address this risk. Multiple infrastructure components failed: (1) The backup system (data management layer) failed silently, indicating inadequate monitoring and alerting controls. (2) The network security layer failed to prevent the ransomware intrusion, suggesting firewall or endpoint protection deficiencies. (3) The RPO of 24 hours was violated because the actual recovery point was 96 hours (four days), demonstrating a gap between policy and operational reality. Controls that should have been in place include: automated backup verification with daily success/failure alerts sent to IT operations, backup restoration testing on a regular schedule (at least quarterly), endpoint detection and response (EDR) tools on the database server, network segmentation to isolate database servers from general user networks, and immutable backup copies that cannot be encrypted by ransomware.

Question 5: CRITICAL THINKING

A global manufacturing client is evaluating whether to migrate its entire on-premises SAP environment to a cloud-based SAP S/4HANA Cloud (SaaS) deployment. As the CPA advising on IT governance and audit implications, prepare a memorandum outline that identifies at least four IT infrastructure components that will shift from entity-managed to vendor-managed, describes the audit implications of each shift, and recommends how the client should contractually protect its ability to obtain assurance over the outsourced controls.

Show answer

The migration shifts the following components: (1) Physical servers and storage—from entity-managed data center hardware to SAP's (or its subservice organization's, e.g., AWS/Azure) data centers. Audit implication: the client loses direct inspection capability and must rely on SAP's SOC 1 Type II report. Recommendation: the contract should require SAP to provide an annual SOC 1 Type II report with an unqualified opinion, and the client should negotiate right-to-audit clauses. (2) Operating system and database—from entity-managed SUSE Linux and HANA to SAP-managed platform. Audit implication: the client can no longer directly test OS patch management or database access controls. Recommendation: the contract should specify SLAs for patch cadence and include incident notification requirements. (3) Network security—from entity-managed firewalls to SAP's cloud network architecture. Audit implication: the auditor cannot directly review firewall rules. Recommendation: require SOC 2 reporting that covers network security criteria, and negotiate for penetration test summaries. (4) Change management—from entity-controlled SAP transport system to SAP's managed release cycle. Audit implication: the client may have reduced control over when changes are deployed to production. Recommendation: contractually require advance notification of major updates, sandbox testing environments, and rollback capabilities. Additionally, the client should establish a vendor management program that includes annual review of all SOC reports, tracking of CUECs, monitoring of subservice organization relationships (the carve-out vs. inclusive method in SOC reports), and a formal exit strategy with data portability provisions.

SUMMARY

Lesson Summary

Summary

IT infrastructure comprises five interdependent layers: hardware (servers, storage, physical devices), networking and telecommunications (routers, firewalls, VPNs), operating systems and middleware (the software platform layer), data management (databases, backups, warehouses), and application software (ERP, financial reporting, CRM). Spanning all five layers is the critical dimension of human capital and governance—the IT personnel and frameworks (COBIT, ITIL) that ensure controls operate effectively across the entire stack.

For CPA candidates preparing for the ISC section, the essential skill is the ability to classify any IT component along two axes—physical versus logical and on-premises versus cloud—to determine whether control assurance comes from direct testing or from SOC report reliance. Remember that control weaknesses at lower layers propagate upward through the stack, and that quantitative tools like system availability calculations and Annualized Loss Expectancy help translate infrastructure risks into financial terms that management and audit committees can act upon.