IT General Controls (ITGC)

Most business processes now run through software. Invoices are matched automatically, revenue is calculated by billing systems and financial reports are pulled from databases. These automated steps can only be trusted if the systems behind them are well controlled. If anyone can change the code that calculates revenue, or if former employees still have access to the finance system, even well-designed business controls can fail. IT general controls cover these foundations, making sure that only authorized people can access systems, that changes are tested and approved, and that systems run and recover reliably. Without these foundations, every report and automated check produced by a system is open to question.

ITGCs are a central part of financial audits and SOX compliance, because auditors cannot rely on automated controls or system reports unless the underlying ITGCs work. They are also covered by frameworks such as SOC 1, SOC 2, ISO 27001 and COBIT. For finance, IT, security and audit teams, ITGCs are where technology operations and financial control meet, and weaknesses in them are among the most common audit findings.

Definition of IT General Controls

IT general controls are controls that apply broadly across an organization's systems, rather than to a single business process, and that support the continued proper operation of information systems and the integrity of the data and automated controls that depend on them.

ITGCs underpin the automated parts of internal controls, are a core scope area for SOX compliance and often support frameworks such as COBIT.

The Main ITGC Domains

Access to programs and data covers user provisioning and removal, password and authentication settings, privileged access and periodic access reviews. Strong authentication, such as multi-factor sign-in for administrators, is now a common expectation.

Program changes cover how changes to applications, databases and configurations are requested, tested, approved and moved into production. Emergency changes need their own process, with review after the fact.

Program development covers how new systems are designed, tested and implemented, including data migration. Errors in migrated data can carry forward into financial reports for years if they are not caught.

Computer operations cover job scheduling, monitoring, backups, incident handling and recovery.

Each domain is typically applied to the applications, databases, operating systems and networks that support in-scope processes.

ITGCs and Application Controls

Application controls are automated checks inside a specific system, such as a three-way match of purchase order, receipt and invoice, or a credit limit check on sales orders.

ITGCs make it possible to rely on those application controls, because they keep the system's configuration and code from being changed without approval.

If ITGCs over a system fail, auditors may need to test application controls much more extensively, or may not be able to rely on them at all. This can turn a small IT weakness into a large increase in audit work.

System-generated reports used in reviews also depend on ITGCs for their accuracy and completeness.

Importance of IT General Controls in Risk and Compliance

ITGCs protect data integrity. They reduce the risk that financial and operational data is changed, lost or corrupted without detection.

They make automation trustworthy. Organizations can rely on automated controls, which are faster and more consistent than manual ones, only when ITGCs are effective. Automated controls also produce better evidence, since systems log what they do.

They also reduce security risk. Many ITGCs, such as removing access promptly when people leave and limiting administrator rights, are also basic security practices.

IT General Controls and Financial Management

ITGC failures can lead to SOX deficiencies and, in serious cases, material weaknesses that must be disclosed, with costs in remediation, audit fees and investor confidence.

Effective ITGCs allow auditors to rely on automated controls, which can reduce the amount and cost of audit testing.

Changes to financial systems, such as a new ERP, billing or general ledger platform, should include ITGC design from the start to avoid costly fixes.

ITGC requirements also apply to cloud and software-as-a-service systems, where organizations often rely on the vendor's SOC 1 or SOC 2 reports for part of the control environment.

Common Challenges

Terminated employees and contractors often keep system access longer than they should. Contractors are a particular gap, since they may not be managed through the main HR system.

Changes made directly in production, or by developers who also deploy their own code, bypass change management.

Evidence of reviews and approvals is often incomplete, so controls that may have operated cannot be shown to have done so. To an auditor, a control without evidence is treated as a control that did not operate.