Spec checklist
Rate each point. Be honest: 'Secure' means you could answer an exam question on it now without notes.
| 5.1.1 | Describe the purpose (service or product) and sector (private, public, voluntary/charity) of organisations, including SME, large enterprise and NGO |
| 5.1.2 | Define B2C, B2B and B2M business models |
| 5.1.3 | Identify internal and external stakeholders |
| 5.2.1 | Explain how digital systems support sales and marketing, R&D, HR, operations, management, logistics and finance |
| 5.2.2 | Explain how digital systems meet user needs and ensure quality: functionality, pain points, accessibility, compatibility, availability, support, installation |
| 5.3.1 | Explain the risks to organisations of using digital systems |
| 5.3.2 | Explain the impact of those risks: legal action, fines, reputational damage, loss of licence, loss of business |
| 5.4.1–2 | Explain internal and external (PESTLE) factors that trigger change |
| 5.4.3 | Explain how organisations respond to change |
| 5.4.4 | Explain the change management process: CAB, SMARTER objectives, impact, resources, risk communication, configuration, testing, implementation methods, documentation, rollback, training, monitoring, version control |
| 5.4.5 | Explain the factors that determine feasibility: benefits and drawbacks, risks, constraints |
5.1 Business environment
Purpose of organisations (5.1.1)
| Purpose | Meaning | Examples |
|---|---|---|
| Providing a service | Carries out tasks or provides expertise for customers; nothing physical is owned afterwards. | Banks, NHS, Netflix, accountants, IT support companies |
| Providing a product | Makes or sells physical or digital goods. | Supermarkets, car manufacturers, a games studio selling games |
Sectors
| Sector | Description | Examples |
|---|---|---|
| Private: SME | Privately owned, fewer than 250 staff. Aims to make a profit. Limited budget for IT. | A local web design agency; an independent café chain |
| Private: large enterprise | Privately owned, 250 or more staff. Often has its own IT department and bigger budgets. | Tesco, Sky, Asda, BT |
| Private: NGO | Independent of government; often works on social, humanitarian or environmental issues; funded by donations and grants. | Amnesty International, Greenpeace, Oxfam |
| Public sector | Owned and funded by government (taxes) to provide services, not profit. | NHS trusts, councils, HMRC, state schools and colleges |
| Voluntary / charity: not for profit | Any surplus goes back into the cause. Relies on donations and volunteers. | Macmillan, local food banks, Age UK |
Business models (5.1.2)
| Model | Meaning | Example |
|---|---|---|
| B2C: Business to Customer | Sells directly to individual consumers. | ASOS, Spotify Premium, Deliveroo |
| B2B: Business to Business | Sells to other businesses. | Sage accounting software sold to firms; a company supplying servers to data centres |
| B2M: Business to Many | Sells to businesses and consumers at the same time, using marketing that appeals to both. | Microsoft 365 (home and business plans); Amazon (shoppers and Amazon Business) |
Stakeholders (5.1.3)
| Internal | Interest | External | Interest |
|---|---|---|---|
| Owners | Profit, growth, control | Customers / clients | Quality, price, service |
| Directors | Strategy, performance, meeting targets | Suppliers | Regular orders, being paid on time |
| Employees | Pay, job security, working conditions | Shareholders | Dividends, share price |
| Outsourced services | Contract continuing, clear requirements | ||
| Investors / funders | Return on investment; for charities, money used well | ||
| Government | Tax paid, laws followed, jobs created |
★ EXAM TIP
Shareholders are listed as external in this spec. Owners and directors are internal. Explain how a change affects a stakeholder's interest, e.g. 'Automating the warehouse may worry employees because some roles could be cut.'
- Stakeholder
- Anyone with an interest in, or affected by, an organisation.
- SME
- Small or medium-sized enterprise: fewer than 250 employees (small: fewer than 50).
- Large enterprise
- An organisation with 250 or more employees.
- NGO
- Non-governmental organisation: independent of government, usually working for a social or environmental cause.
- Private sector
- Organisations owned by individuals or shareholders, usually aiming to make a profit.
- Public sector
- Organisations owned and funded by the government to provide public services.
- Voluntary / charity sector
- Not-for-profit organisations that use any surplus for their cause.
- B2C
- Business to Customer: selling directly to individual consumers.
- B2B
- Business to Business: selling products or services to other businesses.
- B2M
- Business to Many: selling to both businesses and consumers at the same time, often with tailored marketing for each.
5.2 Digital value to organisations
Supporting key organisation areas (5.2.1)
| Area | How digital systems help | Example |
|---|---|---|
| Sales and marketing |
| Tesco Clubcard data used to send personalised offers |
| Research, design and development | Provision of unique products and services: simulation, prototyping, CAD, data analysis | Car makers test designs in software before building them |
| Human Resources |
| An HR system tracks holidays, appraisals and mandatory training |
| Operations |
| Teams and SharePoint for a hybrid workforce |
| Management | Real-time monitoring of KPIs: sales, customers served, units manufactured, real-time location of assets | A dashboard showing today's sales and delivery van locations |
| Logistics | Automated stock control | Barcode scanning reorders stock when it falls below a set level |
| Finance |
| Cloud accounting gives managers live figures, not month-old reports |
Meeting user needs and ensuring quality (5.2.2)
| Factor | Meaning | Example |
|---|---|---|
| Appropriate and effective functionality | The system lets users do every task they need. | A banking app that lets users pay, transfer, freeze a card and view statements |
| Reduction of pain points: response time | Fast responses; tell users the expected wait and if it changes. | 'Your call is 3rd in the queue'; a progress bar on uploads |
| Reduction of pain points: complexity of task | Make tasks quick and simple. | One-click reorder; saved addresses |
| Appropriate accessibility provision | Usable by people with disabilities. | Screen reader support; captions; keyboard navigation |
| Compatibility | Works with internal legacy systems, proposed future systems and external services. | A new website still talks to the old stock database and to PayPal |
| Availability of service | Minimise downtime; future-proof for upgrades. | Maintenance at 3am; system designed so it can scale |
| Effective end user support | Provision of digital support. | Live chat, FAQs, help guides, tutorial videos |
| Ease of installation | Provision of an installation package. | An installer that sets everything up in a few clicks; app store download |
- KPI
- Key performance indicator: a measurable value showing how well an organisation is achieving its objectives.
- Pain point
- A specific problem or frustration users experience with a product or service.
- Legacy system
- An older system still in use that new systems may need to work with.
- Downtime
- Time when a system is unavailable.
5.3 Risk to organisations of using digital systems
Potential risks (5.3.1)
| Risk | Explanation | Example |
|---|---|---|
| Security breach: compromised confidentiality | Unauthorised people see data. | Hackers steal customer records |
| Security breach: loss of integrity | Data is changed or corrupted, so it can't be trusted. | Malware alters prices in a database |
| Security breach: reduced availability | Systems or data can't be accessed when needed. | Ransomware encrypts files; DDoS takes website offline |
| Privacy breach: personal information | Customers' or staff personal data is exposed. | Email with all customers' addresses in CC instead of BCC |
| Privacy breach: business information | Commercially sensitive data is exposed. | Product plans leaked to a competitor |
| Regulatory and legal non-compliance | Breaking laws such as data protection or accessibility. | Keeping data longer than needed; inaccessible public sector website |
| Audience exclusion: biases | System disadvantages some groups. | AI recruitment tool favours male applicants |
| Audience exclusion: poor user experience | Users struggle and give up. | Confusing checkout leads to abandoned baskets |
| Emerging rival technologies | Competitors adopt newer technology and win customers. | High street video rental shops replaced by streaming |
| Technical issues: reliance and system failure | If the system fails, the business stops. | Card payment outage means shops can't take payments |
| Technical issues: system not fit for purpose | System doesn't meet requirements. | New booking system can't handle peak demand |
Potential impact of risks (5.3.2)
| Impact | Explanation |
|---|---|
| Legal action | Customers, staff or partners sue for damages; regulators prosecute. |
| Fines | E.g. the ICO can fine up to £17.5 million or 4% of global turnover for data protection breaches. |
| Reputational damage | Bad publicity; customers lose trust and go elsewhere; harder to recruit. |
| Withdrawal of licence to practise | Regulated organisations (banks, financial advisers, healthcare) can lose permission to operate. |
| Loss of business | Customers leave, contracts are cancelled, sales lost during downtime. |
★ EXAM TIP: CHAIN THE RISK TO THE IMPACT
A risk on its own is not a full answer. Link it: 'A security breach exposing patient records (risk) would breach data protection law, so the clinic could be fined by the ICO (impact), and patients may move to another practice (impact).'
- Confidentiality, integrity, availability
- The three security properties that a breach can compromise (the CIA triad).
- Audience exclusion
- When some users cannot use or are disadvantaged by a system, e.g. through bias or poor user experience.
5.4.1–3 Triggers for change and responses
Internal factors (5.4.1)
| Factor | Digital impact example |
|---|---|
| Organisational restructuring | Departments merged, so user permissions and systems must be reorganised. |
| Expansion | New branches need network connections, more licences and more server capacity. |
| Downsizing | Fewer staff; processes automated; licences and hardware reduced. |
| New strategic objectives: diversification | A clothing retailer starts selling homeware: new product categories in the website and stock system. |
| New strategic objectives: rebranding | Website, app, email templates and social media all need updating. |
| New strategic objectives: additional features or services | A gym adds online class booking to its app. |
External factors: PESTLE (5.4.2)
| Factor | Spec examples | Digital impact example |
|---|---|---|
| Political | Change in government; conflict; shift in government priorities | New government funding for digital health; sanctions stop use of a supplier |
| Economic | New services; recession; inflation; interest rates; consumer trends; new competitors; entering new markets | Recession cuts IT budget; a competitor launches an app so you must too |
| Social | Changing demographics; market/social trends; adapting to remote working; cultural expectations | Customers expect mobile apps and contactless payment |
| Technological | New technologies emerge; obsolete ones are retired; system failure; zero-day vulnerabilities | Windows 10 end of support forces upgrades; a zero-day forces an urgent patch |
| Legal | New legislation; changes to legislation | New data protection or accessibility rules require system changes |
| Environmental | Sustainability issues; pandemics; natural disasters | Pandemic forces remote working; flooding damages a server room |
Practise: which PESTLE factor?
The operating system on every till reaches end of support.
A new law requires all apps to offer a 'delete my account' button.
Interest rates rise and the company delays buying new servers.
Younger customers expect to pay by phone rather than card.
A storm floods the basement where the servers are kept.
A new government shifts funding towards digital public services.
How organisations respond to change (5.4.3)
| Response | Examples |
|---|---|
| New or amended policies | New remote working policy; updated AUP |
| New or amended business processes | Change in staffing numbers; change in delivery schedules; change in opening hours |
| New or amended products or services | Completely new products; next generation products; minor updates to existing products |
| New or improved digital systems | Back-end systems (stock, payroll, databases); customer-facing systems (website, app, chatbot) |
| Improved training | Training staff on a new system or new security threats |
| Restructuring | Change in management structure; redrawing of boundaries (e.g. regions or departments) |
- PESTLE
- Political, Economic, Social, Technological, Legal, Environmental: the external factors that trigger change.
- Zero-day vulnerability
- A security flaw unknown to the vendor, with no patch available, that attackers can exploit.
5.4.4 The change management process
Change management is the controlled process for making changes to digital systems so that they are planned, approved, tested and documented, and so disruption is kept to a minimum.
| Stage | What happens |
|---|---|
| Identify the type of change | New system, or amendment to an existing system? |
| Role of the change advisory board (CAB) | Prioritise change requests; review them; manage stages of approval; monitor the change (collate and analyse change data, check implementation, take action to accelerate change); provide feedback. |
| Identify the changes to be made | Set SMARTER objectives (below). |
| Identify impact of change | Measure or forecast positive and negative impact; analyse it. |
| Allocation of resources | Budget, time, staffing, hardware and software. |
| Communicate risks and desired impact to stakeholders | To gain acceptance and ensure compliance. |
| Configuration of the new system or process | Integration with legacy systems; maintaining service during the change. |
| Fully test the new system | Results must be reproducible; use a test environment (hardware and software) that matches the live one. |
| Choose the implementation method | Parallel, phased, direct or pilot (below). |
| Document the change process | Requirement traceability (responsibility and accountability); up-to-date information; record all decisions; retain change documentation; user training manuals. |
| Rollback planning | Backup methodology, backup location, recovery plan, so the old system can be restored if the change fails. |
| Identify training needs | New training requirements; refresher courses. |
| Monitor progress | Post-progress review: did the change meet its objectives? |
| Version control software | Tracks every change to code and documents so earlier versions can be restored and changes traced to a person. |
SMARTER objectives
| Letter | Meaning | Example: new online booking system for a dental practice |
|---|---|---|
| S | Specific | Patients can book, change and cancel appointments online |
| M | Measurable | 40% of bookings made online |
| A | Achievable | Uses an existing booking platform the practice can afford |
| R | Realistic | Staff have time to be trained |
| T | Time-bound | Live within 3 months |
| E | Evaluated | Patient feedback and booking data assessed after 1 month |
| R | Reviewed | Objectives reviewed and adjusted at 6 months |
Implementation methods
| Method | How it works | Benefits | Drawbacks | Best for |
|---|---|---|---|---|
| Parallel | Old and new systems run side by side; results compared. | Lowest risk: old system is a fallback; outputs can be checked. | Double the work and cost; staff may resist dropping old system. | Critical systems: payroll, banking |
| Phased | New system introduced one module at a time. | Problems limited to one part; staff learn gradually. | Slow; old and new must work together during transition. | Large systems with separate modules |
| Direct | Old system switched off, new one switched on at once. | Quickest and cheapest; no duplication. | Highest risk: if it fails there is no fallback. | Small or non-critical systems; when old system cannot continue |
| Pilot | New system used in one branch or by one group first. | Problems found on a small scale; pilot users can train others. | Slower to roll out everywhere; pilot site bears the risk. | Organisations with many similar branches |
✎ WORKED EXAMPLE
A supermarket chain with 300 stores is replacing its till software. Pilot is suitable: install in three stores first, fix problems with real customers on a small scale, then roll out. Direct would risk every store being unable to take payments at once; parallel is impractical because each till can only run one system.
Practise: which implementation method suits best?
A council's payroll system, where every payment must be checked against the old system for a month.
A bank with 80 branches trialling new counter software.
A small café replacing a broken booking spreadsheet that can no longer be opened.
A hospital moving to a new system one module at a time: appointments first, then prescriptions, then billing.
- Change advisory board (CAB)
- A group that reviews, prioritises and approves proposed changes to systems and monitors their implementation.
- SMARTER
- Specific, Measurable, Achievable, Realistic, Time-bound, Evaluated, Reviewed: a framework for setting objectives.
- Version control
- Software that tracks every change to files, who made it and when, so earlier versions can be restored (e.g. Git).
- Requirement traceability
- Being able to link each change back to the requirement it meets and who was responsible.
- Rollback
- Returning to the previous version of a system if a change fails.
- Pilot implementation
- Introducing the new system in one location or to one group first, then rolling it out.
- Direct implementation
- Switching off the old system and starting the new one at the same moment (big bang).
- Phased implementation
- Introducing the new system one part (module) at a time.
- Parallel implementation
- Running the old and new systems side by side for a period.
5.4.5 Feasibility of a digital project
A feasibility study decides whether a project is worth doing. It weighs benefits against drawbacks, risks and constraints.
| Factor | Examples |
|---|---|
| Benefits and drawbacks |
|
| Risks |
|
| Constraints |
|
★ EXAM TIP
In an evaluate question about feasibility, weigh the benefits against costs, risks and constraints for the organisation in the scenario, then make a judgement: is it feasible, and under what conditions? For example: 'It is feasible if implemented in phases so the cost is spread over two financial years.'
- Feasibility
- Whether a project is practical and worthwhile given its benefits, risks and constraints.
Knowledge organiser
ORGANISATIONS
- Service or product
- Private: SME (<250), large, NGO
- Public sector
- Voluntary / charity: not for profit
MODELS AND STAKEHOLDERS
- B2C, B2B, B2M
- Internal: owners, directors, employees
- External: customers, suppliers, shareholders, outsourced services, investors, government
DIGITAL VALUE
- Sales and marketing: analytics, personalisation
- HR records
- Operations: automation, remote working
- Management: real-time KPIs
- Logistics: stock control; finance: reporting
MEETING USER NEEDS
- Functionality
- Fewer pain points: response time, complexity
- Accessibility
- Compatibility
- Availability, support, easy installation
RISKS → IMPACTS
- Security and privacy breaches
- Non-compliance; audience exclusion
- Rival technologies; system failure
- Impacts: legal action, fines, reputation, loss of licence, loss of business
TRIGGERS FOR CHANGE
- Internal: restructure, expand, downsize, new strategy
- External: PESTLE
- Zero-day vulnerabilities, new laws, pandemics
CHANGE PROCESS
- Change advisory board approves, prioritises and monitors
- SMARTER objectives
- Resources, risks, testing
- Documentation, rollback plan, training
- Version control
IMPLEMENTATION AND FEASIBILITY
- Parallel: safe, costly
- Phased: one module at a time
- Direct: fast, risky
- Pilot: one site first
- Feasibility: benefits vs risks vs constraints
Flashcards
Every Quick recall definition on this page. Click the card to flip it; use the arrow keys to move.
Quiz me
Random questions on CA5 from the course question bank. Pick a topic or question type, answer in your head or on paper, then check. Your score is saved on this device.
Exam-style questions
Allow about 80 minutes.
State the difference between the public sector and the private sector.
- Public sector organisations are owned/funded by government to provide services (1); private sector organisations are owned by individuals/shareholders and usually aim to make a profit (1).
Give one example of an NGO.
- Any valid NGO, e.g. Oxfam, Amnesty International, Greenpeace, Red Cross.
Identify two internal stakeholders and two external stakeholders of a college.
- Internal (any two): owners/governors; directors/principal/senior leaders; employees/lecturers/support staff.
- External (any two): students/customers; parents; suppliers; government/funding bodies (e.g. DfE); employers/partners; Ofsted. One mark each.
Explain how real-time monitoring of KPIs could help the manager of a parcel delivery company.
- Manager can see where vans are / parcels delivered in real time (1) so problems such as delays can be spotted and resources redeployed quickly (1).
Explain two ways a digital system can reduce pain points for users of a train ticket app.
- Pain point (1) + how the system reduces it (1), twice. E.g. response time: show live delay information and estimated times (1) so passengers can plan (1). Complexity: save payment details and favourite journeys (1) so buying takes a few taps (1).
A hospital's patient record system fails for six hours. Explain two potential impacts on the hospital.
- Impact (1) + explanation (1), twice. E.g. patient safety risk because staff cannot see medication history (1), possible legal action (1); reputational damage (1) loss of public trust (1); disruption/cancelled appointments (1); regulatory investigation (1).
Explain one political and one technological factor that could trigger change in a bank.
- Political (1) + explanation (1): e.g. new government regulations on open banking require the bank to share data via APIs, so systems must change (1).
- Technological (1) + explanation (1): e.g. a zero-day vulnerability in online banking software requires urgent patching (1); customers expect new technology such as biometric login (1).
Describe the role of a change advisory board.
- Any three: reviews change requests; prioritises them; approves or rejects through stages of approval; monitors the change (collating data, checking implementation, accelerating); provides feedback.
■ SCENARIO FOR QUESTIONS 9–13
BrewBox is a Yorkshire SME with 60 staff that sells coffee subscriptions online to customers and supplies coffee beans to cafés. It uses an old stock system and a separate website. The directors want a new integrated system covering the website, stock, deliveries and customer accounts.
State which business model BrewBox uses and justify your answer.
- B2M (1): it sells subscriptions to individual customers (B2C) and supplies cafés (B2B) (1). Accept B2C or B2B only if clearly justified with reference to one part (max 1).
Write two SMARTER objectives for BrewBox's new system.
- One mark per objective that is specific and measurable with a time element, e.g. 'All stock levels update automatically when an online order is placed, from launch in March.' 'Reduce delivery errors by 50% within six months.'
Explain why BrewBox needs a rollback plan.
- If the new system fails or has serious bugs (1) BrewBox could restore the old system and data from backup (1) so customers can still order and income is not lost (1).
Discuss the suitability of direct and parallel implementation for BrewBox's new system.
Indicative content:
- Direct: cheapest and quickest, important for an SME; no need to run two systems. But high risk: if the new system fails, customers cannot order and cafés cannot be supplied; no fallback.
- Parallel: low risk because the old system continues; outputs can be compared (e.g. stock levels). But 60 staff would have to enter data twice; costly and time-consuming; the old website and stock system are separate, making parallel running complex.
- Could consider timing a direct change during a quiet period, with a strong rollback plan, as a compromise.
Evaluate the feasibility of BrewBox's new integrated system.
◆ SUPPORT: SENTENCE STARTERS
- Direct implementation would be quicker because ... however, if the system failed ...
- Parallel implementation means staff would have to ...
- BrewBox would benefit from the new system because ...
- A risk is that staff ... which could mean ...
- BrewBox is an SME, so the budget ...
Indicative content:
- Benefits: integrated stock and website avoids selling out-of-stock items; automated deliveries; customer accounts improve retention; better reporting for directors; supports growth in both B2C and B2B.
- Costs: software, hardware, consultants, training, data migration from old system; significant for an SME.
- Risks: staff resistance; inadequate knowledge of the new system; disruption during implementation; integration problems with the legacy stock data.
- Constraints: limited budget and IT staff in an SME; time (avoid busy periods such as Christmas).
- Judgement: e.g. feasible if phased over time to spread cost, with training and a rollback plan, because the long-term savings and customer benefits outweigh the costs.
Explain the importance of version control software during a change to a company's website.
- Point (1) + linked explanation (1), twice. E.g. tracks every change and who made it (1) so mistakes can be traced and responsibility identified (1); allows rollback to a previous working version (1) if the update breaks the site (1); allows several developers to work at once without overwriting each other's work (1)(1).
Explain why documentation is important in the change management process.
- Point (1) + linked explanation (1), twice. E.g. requirement traceability (1) so every change can be linked to a requirement and a responsible person (1); records decisions (1) so the reasons can be reviewed later (1); user training manuals (1) help staff use the new system (1); keeps information up to date for future maintenance (1)(1).
▲ STRETCH
- For question 13, recommend a specific implementation method and justify it using the constraints you have identified.
- Identify which PESTLE factors might have triggered BrewBox's decision, and explain the link.