IT GENERAL CONTROLS AUDIT: Check the controls behind access, changes and daily operations.
An IT general controls review examines how access, system changes and routine IT operations are controlled. We assess design and operating evidence against agreed criteria, using records and samples to show where controls support reliable systems and where weaknesses could affect their use or the information they process.
- Discipline
- Governance, Risk & Compliance
- Engagement type
- Assessment
A defined procedure needs evidence of being followed.
An access policy can look sound while leavers retain accounts. Change approvals may exist while emergency changes bypass review. We examine the connection between the documented control and the activity it is meant to govern, within the systems and period selected for review.
Logical and privileged access
Review provisioning, role changes, departures, administrative privileges and periodic access reviews.
Change management
Examine how changes are requested, approved, tested and released, including emergency changes and separation of responsibilities.
IT operations
Assess agreed controls over jobs, backups, incidents, recovery and operational monitoring relevant to the systems in scope.
Control evidence and exceptions
Establish the relevant populations, select samples and assess whether the evidence supports the control's stated design and operation.
Findings should explain the control failure and its consequence.
We agree the criteria, systems and review period before collecting evidence. Walkthroughs establish how each control is intended to work; inspection and sampling test the selected activities. We discuss exceptions with control owners, distinguish missing evidence from ineffective operation and identify corrective actions that address the cause.
What you receive
Control and testing record
Criteria, systems, review period, procedures performed and sample basis.
Findings and evidence
Observed exceptions, their implications and the limitations of the work.
Corrective action plan
Changes, owners and a practical basis for follow-up or subsequent testing.
Is this a financial statement audit?
No. ITGC work examines selected technology controls. If a statutory auditor intends to use the work, their required scope, evidence and reliance conditions need to be established separately.
What is the difference between design and operating effectiveness?
Design considers whether a control is capable of addressing the relevant risk. Operating effectiveness examines whether it was performed as intended over the selected period.
Will every transaction or account be tested?
Not necessarily. Testing methods and sample selection depend on the criteria, population and risk. The report explains what was examined so conclusions are not extended beyond that work.
Which systems and review period need to be covered?
Bring the audit request, relevant applications and any existing findings. We can establish the control review and evidence required.
Related services: SOC 2 Readiness and Identity & Access Management.