ITGC Controls: A Comprehensive Guide for IT Auditors

IT General Controls (ITGCs) are the foundational controls that ensure the reliability and integrity of information systems and the data they process. They support the effective functioning of application controls and are critical for financial reporting, regulatory compliance, and operational efficiency.

• Key Controls:
• User access provisioning and de-provisioning procedures
• Periodic access reviews and recertification
• Privileged access management
• Password policies and multi-factor authentication
• Segregation of duties enforcement
• Service and system account management

• Common Findings:
• Terminated employees retaining active access
• Excessive privileged access without justification
• Infrequent or incomplete access reviews
• Shared accounts without accountability

• Key Controls:
• Change request and approval workflows
• Segregation of duties between development and production
• Testing and quality assurance procedures
• Emergency change procedures
• Change documentation and audit trail
• Rollback procedures

• Common Findings:
• Changes promoted without proper testing
• Developers with production access
• Incomplete change documentation
• Emergency changes not retroactively approved

• Key Controls:
• System Development Life Cycle (SDLC) methodology
• Requirements gathering and documentation
• Security requirements integration
• User acceptance testing
• Data migration validation
• Post-implementation reviews

• Common Findings:
• Security requirements not included in design
• Insufficient user acceptance testing
• Missing data migration validation
• No post-implementation reviews

• Key Controls:
• Job scheduling and monitoring
• Backup and recovery procedures
• Incident management processes
• Capacity and performance monitoring
• Environmental controls (data centers)
• Disaster recovery planning and testing

• Common Findings:
• Backup restoration not tested regularly
• Incomplete job failure investigation
• Outdated disaster recovery plans
• Missing capacity monitoring thresholds

1. Prioritize by Risk: Address findings based on their potential impact on data integrity and financial reporting
2. Automate Where Possible: Implement automated provisioning, access reviews, and change management workflows
3. Document Thoroughly: Maintain clear evidence of control execution for auditors
4. Train Personnel: Ensure IT staff understand control requirements and their importance
5. Monitor Continuously: Implement continuous monitoring for key ITGC controls
6. Leverage Tools: Use GRC platforms, ITSM tools, and PAM solutions to enforce controls

For each control, auditors should:

1. Understand: Document the control objective, design, and operation
2. Evaluate Design: Assess whether the control, as designed, would effectively address the risk
3. Test Effectiveness: Verify that the control operated effectively during the audit period
4. Sample: Use appropriate sampling methodologies based on control frequency
5. Document: Record test procedures, results, and conclusions

Scope failures cause more rework than testing failures. Work top-down:

1. Start from the financial statements or trust criteria — identify significant accounts, disclosures or service commitments.
2. Trace to business processes and the applications that produce or store the relevant data.
3. Include supporting layers — operating systems, databases, middleware, job schedulers and the cloud control plane for each in-scope application.
4. Document exclusions with rationale — a system is out of scope only when it cannot affect in-scope data or reporting.
5. Map reliance — any automated application control, system-generated report or key report you rely on inherits the ITGC conclusion for its platform. If change management fails, that reliance falls away.

Traditional ITGC wording assumes servers and quarterly releases. Modern environments need the same objectives evidenced differently:

Two points auditors press on: branch protection settings must actually prevent self-approval (a policy that can be bypassed is not a control), and pipeline service accounts need the same access review rigour as human accounts.

Providing these upfront typically cuts fieldwork time substantially:

• Complete user listings for each in-scope application, database and OS, with roles and last-login dates
• Joiner and leaver listings for the audit period from HR, to reconcile against access changes
• Access review completion records with evidence of remediation for flagged accounts
• Privileged user listing plus approval basis for each
• Full population of changes for the period, exported from the change or version-control system
• Evidence packs for sampled changes: request, approval, test result, deployment record
• Emergency change listing with retrospective approvals
• Job failure listing and evidence of investigation
• Backup schedule, failure log and most recent restore test
• Disaster recovery test plan, results and management sign-off
• Configuration exports: password policy, MFA enforcement, logging and session settings

Sampling from an incomplete population makes the entire test void. Before sampling, establish completeness independently: reconcile change records to version-control commits or deployment logs, reconcile user listings to the identity provider rather than the application's own report, and confirm the extract covers the full period with no filters applied. Document how completeness was established in the workpaper; a reviewer cannot infer it.

The same control set usually satisfies several obligations at once:

Test once, report many: align control wording and evidence periods so a single walkthrough and sample set can support the statutory audit, SOC 2 and ISO 27001 internal audit.

Not every exception is a deficiency, and not every deficiency is significant. Evaluate in this order: is the exception an actual control failure or a documentation gap; what is the magnitude and duration of exposure; do compensating controls reduce risk; and could the failure permit a material misstatement or a breach of a service commitment. Cluster related exceptions — three separate access findings on the same platform usually aggregate into one significant deficiency rather than three minor ones.

• Scope top-down from reporting or trust criteria, and document exclusion rationale
• ITGCs are fundamental to IT governance and financial reporting integrity
• The four domains (Access, Changes, Development, Operations) cover the IT control landscape
• Common findings often stem from process gaps rather than technical limitations
• Automation and continuous monitoring significantly improve ITGC effectiveness
• Regular training and awareness ensure consistent control execution

CyberWave GRC helps audit and compliance teams design, test and remediate IT general controls as part of our SOC 2 and ISO 27001 engagements — talk to our team.