ITGC Testing

The challenge

IT gen­er­al con­trols sit un­der­neath every au­to­mat­ed con­trol and every sys­tem re­port your busi­ness re­lies on. When an ITGC fails, the dam­age spreads. One un­re­viewed ac­cess change or untest­ed code re­lease can call into ques­tion every con­trol that de­pends on that sys­tem. Many teams dis­cov­er the prob­lem only when ex­ter­nal au­di­tors ex­pand their test­ing, or when an ex­am­in­er asks for ev­i­dence that was never kept.

How we help

We test ITGCs across the four do­mains that mat­ter most. Logical ac­cess cov­ers pro­vi­sion­ing, ter­mi­na­tions, priv­i­leged ac­cess, and user ac­cess re­views. Change man­age­ment cov­ers ap­provals, test­ing, and the sep­a­ra­tion be­tween de­vel­op­ers and pro­duc­tion. IT op­er­a­tions cov­ers job sched­ul­ing and in­ci­dent han­dling. The fourth do­main is back­up and re­cov­ery.

For each con­trol, we con­firm the de­sign ad­dress­es the risk, then test whether it op­er­at­ed through­out the pe­ri­od, using sys­tem-gen­er­at­ed ev­i­dence rather than screen­shots taken on the day. Where your con­trols sup­port fi­nan­cial re­port­ing, we align the work with SOX ex­pec­ta­tions for man­age­ment and in­ter­nal audit, so your ex­ter­nal au­di­tors can re­view it ef­fi­cient­ly.

Every ex­cep­tion comes with a root cause and a fix your con­trol owner agrees to. We retest re­me­di­at­ed con­trols be­fore the issue clos­es.

What you get

• ITGC risk and control matrix review, mapped to in-scope systems
• Design and operating effectiveness testing across access, change, operations, and recovery
• Privileged access and user access review testing
• Segregation of duties analysis for change and production access
• SOX-aligned testing for management's assessment and internal audit
• Exception analysis with root causes, owners, and retesting

Standards we work with: COBIT 2019, the COSO Internal Control frame­work, ISACA's IT Audit Framework (ITAF), and the IIA Global Internal Audit Standards.

We test con­trols for man­age­ment and in­ter­nal audit. We don't issue an audit opin­ion on your fi­nan­cial state­ments or on in­ter­nal con­trol over fi­nan­cial re­port­ing.

Good fit if year-end test­ing is com­ing, your ex­ter­nal au­di­tors have raised ITGC de­fi­cien­cies, or a new sys­tem went live and no­body has test­ed its con­trols.

Questions clients ask