IT General Controls (ITGC)

These controls apply across many systems rather than to one business process. Four areas are typical. Access controls decide who may log in and what they can do, including joiner, mover and leaver processes and privileged accounts. Change management controls cover code changes and their approval and testing. Operations controls deal with job scheduling, backups and incident handling. Development and acquisition controls cover how new systems are built or bought. If these are weak, controls inside applications cannot be trusted, since someone could alter the logic or the data without detection. External auditors test ITGCs when they plan to rely on automated controls and system reports for financial statements, and the work is central to rules such as the Sarbanes-Oxley Act. They differ from application controls, which check specific transactions, such as a payment limit. Weak ITGCs often lead to wider audit procedures and findings.

During a year-end audit of a mid-sized manufacturer, testers find that former employees still have active accounts on the finance system, and that several users can both change code and move it to production. Because the ITGCs fail, the auditors cannot rely on automated reports and carry out extra manual checks.