What are IT General Controls (ITGC)?
IT general controls (ITGC) are the policies and procedures over an organization's IT environment, covering access, program changes, program development and computer operations, that let automated controls and system reports be relied on.
- IT general controls (ITGC) are the controls over the IT environment that let automated controls and system-generated reports be trusted.
- Four domains: access to programs and data, program changes, program development and computer operations, as named in the SEC's ICFR guidance.
- ITGC sit beneath application controls. Auditors test them first, because a failed ITGC removes reliance on every automated control and report above it.
- Scope only what financial reporting depends on: in-scope systems and the ITGC that automated controls and key reports rely on, plus SOC 1 reports for outsourced systems.
- Privileged access, unreviewed changes and missing access reviews are the ITGC deficiencies that recur in SOX findings year after year.
What are IT General Controls (ITGC)?
IT general controls (ITGC) are the policies and procedures over an organization's IT environment that support the reliable operation of automated controls and system-generated reports.
They cover four areas: access to programs and data, program changes, program development and computer operations. The SEC's 2007 interpretive guidance on management's report on ICFR names the four areas (program development, program changes, computer operations, and access to programs and data) and explains why they matter: while IT general controls alone ordinarily do not address financial reporting risks, the proper and consistent operation of automated controls often depends on effective IT general controls. PCAOB AS 2201 makes the same point when it says an automated control is lower risk only if the relevant IT general controls are effective. Frameworks such as COBIT 2019 provide the detailed control objectives.
Why it matters
- They decide what can be relied on. If change management over the ERP fails, every automated calculation and report it produces loses evidential value.
- They are a frequent source of SOX deficiencies. Privileged access, unreviewed changes and missing user access reviews recur in audit findings year after year.
- They cut testing effort. Strong ITGC allow benchmarking of automated controls, which reduces the annual retest burden.
The four ITGC domains
- Access to programs and data: user provisioning and de-provisioning, periodic access reviews, privileged access, authentication and segregation of duties within systems.
- Program changes: change requests, testing, approval and migration to production, with developers kept out of production.
- Program development: methodology, testing and approval for new systems and major implementations, including data conversion.
- Computer operations: job scheduling and monitoring, incident and problem management, backup and recovery.
ITGC versus application controls
Application controls live inside a business process and act on individual transactions: a three-way match, a duplicate invoice check, an approval limit. ITGC sit underneath them and apply across all applications on a platform. Auditors test ITGC first, because the conclusion on ITGC determines whether automated application controls and system reports can be tested once or must be tested repeatedly.
Scoping ITGC for SOX
Only the systems that support in-scope financial processes, and only the ITGC needed for the automated controls and reports within them, are in scope. The SEC guidance is explicit that management need not evaluate IT general controls that pertain to efficiency or effectiveness of operations but are not relevant to financial reporting risk. Cloud and outsourced systems bring the provider's SOC 1 report into scope, with complementary user entity controls owned by the company.
Related terms
- Internal control over financial reporting (ICFR)
- SOX scoping
- SOX control testing
- Access control
- Audit logging
- Internal controls
In SmartSuite
SmartSuite SOX Management maps every in-scope system to its ITGC, links each automated control and key report to the ITGC it depends on, and schedules access reviews, change samples and SOC report reviews so the ITGC conclusion is documented before application controls are tested.
Frequently asked questions
What is the difference between ITGC and application controls?
ITGC are controls over the IT environment as a whole: access, change, development and operations. Application controls are automated checks inside a business process that act on transactions. ITGC do not prevent misstatements by themselves; they make it possible to rely on the application controls and reports that do.
Which systems are in scope for ITGC testing?
Systems that initiate, process, record or report transactions in an in-scope financial process, plus the infrastructure they run on. That usually means the ERP, sub-ledgers, consolidation and reporting tools, and any spreadsheet or end-user tool that produces a number used in a key control. Operational systems without financial reporting impact are out.
Can an ITGC deficiency be a material weakness?
Yes, if it removes reliance on automated controls or reports that address a material risk and no compensating manual control operates with enough precision. In practice an ITGC deficiency is evaluated by tracing which application controls and reports depend on it and assessing the misstatement those controls would have prevented.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.