IT General Controls (ITGC) Audit

Overview

IT general controls (ITGCs) are the foundational information technology controls over your systems that underpin everything above them. Access management, change management controls, IT operations, backup and recovery, and the software development lifecycle are the ITGC domains. Weak ITGCs make application controls and financial reporting assurance unreliable, regardless of how well those upper layers are designed. Stakeholders, auditors, and boards place significant weight on whether information technology general controls are operating effectively.

We audit your ITGCs against recognised criteria, testing both control design and operating effectiveness over the relevant period. The audit process follows a structured scope and control matrix. Findings are reported with practical remediation guidance, not just a list of exceptions. ITGC compliance is what allows external auditors to rely on the controls environment rather than expanding their substantive testing. Governance over IT processes is a prerequisite for enterprise-level assurance.

This audit directly supports external financial audits, SOC 2 Type II examinations, and SOX-aligned control environments. Business continuity, unauthorized access, and data loss risks are addressed through ITGC controls. Implementing strong IT general controls, including multi-factor authentication and change management controls, reduces risk across all audit programs that depend on the ITGC foundation. A clean ITGC posture removes a significant source of auditor concern before the examination begins.

What’s included

• Logical access and identity management controls, including multi-factor authentication
• Change management and release controls
• IT operations, backup and recovery, and job-scheduling controls
• Software development lifecycle (SDLC) controls
• Control design and operating-effectiveness testing
• Findings, exceptions, and remediation guidance
• Governance and compliance assessment across ITGC domains
• Policies and procedures review

How we work

1. 01
   Scope

   We agree the in-scope systems, the ITGC domains to test, and the period under review before any fieldwork begins. Control objectives for each domain are confirmed at scoping so the audit produces findings that are directly usable in your compliance program.

2. 02
   Test design

   We assess whether the information technology general controls in each domain are appropriately designed to achieve their objectives. Design gaps are reported immediately because they affect operating effectiveness testing.

3. 03
   Test operation

   We test operating effectiveness across the period using sampling and evidence, documenting every exception with its source. Implement ITGC best practices are the benchmark. Data center, user access, and change management controls receive particular scrutiny.

4. 04
   Report

   We deliver findings, exceptions, and remediation guidance written for the people who own and fix the controls. Stakeholder-ready summaries are produced alongside the detailed findings so governance conversations have the evidence they need.

What you get

• ITGC scope and control matrix
• Design and operating-effectiveness test results
• Exceptions and rated findings
• Remediation guidance

Frequently asked questions