IT general controls (ITGCs) are the controls that make sure your systems behave reliably: the right people have access, changes are approved and tested, and jobs and backups run as expected. If ITGCs fail, auditors cannot rely on any automated control or system report that sits on top of them.
The four ITGC domains
- Access to programs and data: user provisioning, removal of leavers, privileged access and periodic user access reviews.
- Program change: changes are requested, tested, approved and moved to production by someone other than the developer.
- Computer operations: batch job monitoring, backup monitoring and incident handling.
- Program development: new systems and major upgrades follow a controlled project process, including data migration checks.
How auditors test an ITGC
Testing has two parts. Test of design checks that the control, as described, would address the risk. Test of operating effectiveness checks that it actually worked across the period, using a sample drawn from a complete and accurate population.
A common finding: the user access review was performed, but the user listing it was based on was never shown to be complete. Always evidence where the population came from.
Getting ready
- List the in-scope applications, databases and infrastructure.
- Write each control with an owner, frequency and the evidence it produces.
- Run a dry test on a small sample before the auditor arrives.
TEKGRC tests ITGCs for clients and teaches the same method in our GRC Lab. Talk to us if you want a readiness review.