Why an IT System is exactly like an onion

For anyone tackling the ISC2 CC, CISA, or diving into IT Audit, you have to stop thinking of "systems" as just computers and servers. A system is any set of related parts working toward a goal—whether it's an app, a car engine, or a payroll department.

Here is the "Garlic & Onion" guide to system basics, stripped of the academic fluff.

---

1. The Core Engine: IPO

Every system, no matter how complex, boils down to three stages:

• Input: The raw material or data entering the system.
• Process: The "black box" where the magic happens. This changes the input into something else.
• Output: The finished product or result that leaves the system.

Auditor's Note: We call the changing parts within this process "variables". If the input is "Hours Worked" and the process is "Multiply by Rate," the variable is the $Rate$.

---

2. The "Onion" Concept (Subsystems)

Systems are nested. A system is like a garlic bulb—you peel back one layer, and there are smaller "cloves" (subsystems) inside.

• Example: Your "Finance System" is the big bulb. Inside, you have "Accounts Payable" and "Payroll" (the subsystems).
• The Boundary: This is the imaginary line we draw to define what we are auditing. Everything inside the line is internal; everything outside is the environment or external.

---

3. Open vs. Closed Systems

• Closed Systems: These are predictable and ignore the outside world.
• Open Systems: These interact constantly with their environment.
• The "Turbulence" Rule: If the business environment is chaotic (changing laws, new tech), a system must be "open" to adapt quickly, or it will fail.

---

4. The Control Loop (The "Juicy Bits")

For a system to be "controlled," it needs:

• Detector: A sensor that sees what is happening (e.g., an error log).
• Reference Point: The standard or "goal" (e.g., "No errors allowed").
• Comparator: The brain that compares the actual data to the goal.
• Activator: The person or code that takes action to fix the gap.