CPA (ISC) • BUSINESS PROCESSES AND INTERNAL CONTROLS

Evaluate IT General Controls (ITGCs)

Understanding how foundational IT controls safeguard the reliability of financial reporting systems.

Historical Context & Motivation

Before organizations relied on complex enterprise resource planning systems and cloud-based platforms to process financial transactions, most accounting records were maintained manually, and internal controls focused primarily on physical safeguards such as locked file cabinets and dual-signature requirements. As businesses began automating their general ledgers and transaction processing in the 1960s and 1970s, auditors quickly realized that the integrity of financial data depended not only on the application-level checks within accounting software but also on the broader technology environment in which those applications operated. This recognition gave rise to the concept of IT General Controls (ITGCs) — the foundational controls over the IT infrastructure that support all automated business processes. Without reliable ITGCs, application controls such as automated three-way matching in accounts payable or system-enforced approval workflows could be overridden, manipulated, or rendered ineffective.

1977
Foreign Corrupt Practices Act (FCPA)
The FCPA mandated that publicly traded companies maintain adequate systems of internal accounting controls, indirectly requiring organizations to consider the reliability of their emerging computerized systems.
1992
COSO Internal Control Framework
The Committee of Sponsoring Organizations of the Treadway Commission published its integrated framework for internal controls, establishing the conceptual foundation that later frameworks — including guidance on IT controls — would build upon.
1996
COBIT Framework Released
ISACA introduced the Control Objectives for Information and Related Technologies (COBIT), providing the first comprehensive, globally recognized framework specifically designed for IT governance and control evaluation.
2002
Sarbanes-Oxley Act (SOX)
In the wake of Enron and WorldCom, SOX Section 404 required management and external auditors to assess internal controls over financial reporting, making ITGC evaluation a central component of every public company audit.
2013–Present
Updated COSO & Cloud Era
COSO updated its framework to explicitly address technology, and auditing standards (PCAOB AS 2201, AICPA SOC reports) evolved to cover cloud-hosted systems, heightening the importance of ITGCs across complex, distributed IT environments.

The central question that ITGC evaluation addresses is straightforward yet profoundly important: Can we trust that the IT environment underlying our financial systems has operated reliably throughout the reporting period? If the answer is no — if unauthorized changes to programs are possible, if access rights are poorly managed, or if system failures are not detected and corrected — then every automated control and every piece of system-generated financial data becomes suspect. This is why ITGCs occupy a foundational tier in the auditor's assessment of internal controls over financial reporting.

Core Principles & Definitions

IT General Controls are the policies, procedures, and technical safeguards that govern the overall IT environment and, by extension, ensure the continued effective operation of application-level controls. Unlike application controls, which are embedded within specific software programs (such as input validation rules or automated reconciliation routines), ITGCs operate at the infrastructure level and affect every application running on the relevant systems. The failure of a single ITGC can cascade, undermining confidence in multiple application controls simultaneously. Professional auditing standards — including PCAOB Auditing Standard 2201 and AICPA guidance for SOC engagements — identify several domains of ITGCs, commonly organized into four or five categories depending on the framework in use.

1

Logical Access & Security

Controls that restrict system and data access to authorized individuals. This includes user provisioning, authentication mechanisms (passwords, multi-factor authentication), role-based access controls, and periodic access reviews to ensure that only appropriate personnel can view or modify financially significant data.
2

Change Management

Controls that govern modifications to programs, configurations, and databases. Proper change management requires formal change requests, impact assessments, testing in non-production environments, segregation of duties between developers and those who migrate code to production, and management approval before deployment.
3

Computer Operations

Controls that ensure systems process data as intended. This domain covers job scheduling, batch processing monitoring, incident management, system performance monitoring, and error handling procedures that detect and correct processing failures before they corrupt financial records.
4

Program Development (SDLC)

Controls over the creation and implementation of new systems and applications. The Software Development Life Cycle should include formal requirements gathering, design reviews, user acceptance testing, data migration validation, and post-implementation reviews to ensure new systems reliably process financial transactions.
5

Backup, Recovery & Physical Security

Controls that protect data and systems against loss from hardware failure, natural disaster, or unauthorized physical access. Regular backups, off-site or cloud-replicated storage, disaster recovery testing, and physical access restrictions to data centers all fall within this domain.
KEY TAKEAWAY
Think of ITGCs as the foundation of a building. Application controls are like the walls, plumbing, and electrical systems inside. If the foundation is cracked or shifting, it does not matter how well the plumbing was installed — the entire structure is unreliable. In the same way, if access controls are weak, change management is absent, or backups are untested, even perfectly designed automated journal entry controls or system-generated reports cannot be trusted. Auditors must evaluate the foundation first before relying on anything built on top of it.

Visual Explanation — The ITGC Control Hierarchy

The diagram illustrates the layered dependency among financial reporting assertions, application controls, and IT General Controls. At the bottom tier, the five ITGC domains — Access Controls, Change Management, Operations, SDLC, and Backup & Recovery — form the foundation upon which application controls rest. If any ITGC domain is deficient, the dashed 'depends on' arrow breaks, and the application controls and the financial assertions they support become unreliable.

The visual above captures a principle that is central to every ITGC evaluation: the indirect but pervasive nature of IT General Controls. Whereas an application control such as a system-enforced credit limit directly prevents an overextension of customer credit, an ITGC like access management does not directly validate a transaction. Instead, it ensures that the person running the credit-check module is authorized to do so and that no unauthorized party has altered the credit-limit parameter in the system configuration. Consequently, when an auditor identifies an ITGC deficiency — for instance, a failure to review user access rights on a quarterly basis — the impact is not confined to a single transaction or account. It potentially taints every process and every balance that relies on the affected system, which is precisely why regulators and audit standards treat ITGC failures with heightened severity.

How ITGC Evaluation Works — The Audit Approach

Evaluating ITGCs is a structured process that follows a logical progression from understanding the IT environment to testing specific controls and assessing the implications of any deficiencies identified. Although the CPA examination does not require candidates to execute walkthroughs in the field, it expects a solid understanding of the evaluation methodology and the auditor's decision-making framework. The process can be distilled into several interrelated phases.

Phase 1 — Scoping the IT Environment

The auditor begins by identifying all applications, databases, operating systems, and network components that are relevant to financial reporting. This includes not only the enterprise resource planning (ERP) system — such as SAP, Oracle, or Microsoft Dynamics — but also middleware, data warehouses, and any end-user computing tools (e.g., complex spreadsheets) that feed into financial statements. The scope determination considers which systems process, store, or transmit data affecting significant accounts and disclosures. In practice, a publicly traded company might scope five to fifteen applications for ITGC evaluation, depending on the complexity of its IT landscape.

Phase 2 — Understanding Control Design

Once the in-scope systems are identified, the auditor performs walkthroughs and inquiries with IT management to understand the design of each ITGC. For example, the auditor might review the organization's change management policy and trace a recent software modification from initial request through approval, testing, and deployment to production. The objective at this stage is to assess whether the control, if operating effectively, would achieve its intended objective — a concept referred to as design effectiveness.

Phase 3 — Testing Operating Effectiveness

A well-designed control is of limited value if it is not consistently applied. The auditor selects samples of control instances — such as a sample of user access provisioning tickets, a sample of program changes, or a sample of backup restoration tests — and examines the evidence to determine whether the control operated as intended throughout the period under review. The sample size depends on the nature of the control (automated versus manual) and the frequency of its operation. Automated controls that are embedded in software and do not require human intervention (such as system-enforced password complexity rules) typically require only a single test per period because the control operates identically every time it fires, provided no unauthorized changes have been made. Manual controls performed periodically — such as quarterly access reviews — require sample sizes that reflect the number of times the control operated during the year.

ITGC SAMPLE SIZE LOGIC (SIMPLIFIED)
Automated ITGC → Test once + verify no unauthorized changes Manual ITGC (annual) → Test 1 occurrence Manual ITGC (quarterly) → Test 2 of 4 occurrences Manual ITGC (monthly) → Test 2–4 of 12 occurrences Manual ITGC (daily) → Test 25–40 occurrences
Sample sizes are illustrative and follow common audit methodology guidance. The key principle is that higher frequency controls require larger samples because there are more instances over which the control could fail. Automated controls require minimal reperformance because their consistent execution is inherent in the software logic.

Phase 4 — Evaluating Deficiencies

When an ITGC deficiency is identified — for example, a programmer was found to have the ability to migrate code to production without independent approval — the auditor must assess the severity of the deficiency. The assessment considers two dimensions: the likelihood that a misstatement could result from the deficiency and the magnitude of the potential misstatement. The deficiency may be classified as a control deficiency, a significant deficiency, or a material weakness. Because ITGCs are pervasive, a material weakness in an ITGC often means that the auditor cannot rely on automated application controls for the affected systems and must expand substantive testing significantly.

Detailed Breakdown of ITGC Domains

A deeper examination of each ITGC domain reveals the specific control objectives, typical control activities, and common deficiency patterns that auditors encounter. Understanding these details is essential for the CPA examination, which frequently tests the ability to identify control weaknesses within scenario-based questions and to reason about their downstream impact on financial reporting reliability.

This flowchart traces each of the three most commonly tested ITGC domains from control activities (top) through typical audit testing procedures (middle) and common deficiency patterns (bottom). All deficiency paths converge on the Audit Impact Assessment box, where the auditor classifies the severity and determines the effect on the audit strategy.
ITGC Domains, Objectives, and Key Risks
ITGC DomainControl ObjectiveKey Risk if Absent
Logical AccessEnsure only authorized personnel access systems and data at an appropriate level of privilege.Unauthorized individuals could initiate, modify, or delete transactions, leading to fraud or errors in financial records.
Change ManagementEnsure program changes are authorized, tested, and properly deployed to production.Untested or unauthorized code could corrupt transaction processing logic, causing systematic misstatements.
Computer OperationsEnsure systems process transactions completely and accurately, and that errors are detected and corrected promptly.Undetected batch failures or unresolved processing errors could result in incomplete or inaccurate financial data.
Program DevelopmentEnsure new systems are properly designed, tested, and validated before deployment.Poorly designed systems may contain logic errors that produce incorrect calculations from inception.
Backup & RecoveryEnsure data can be recovered in the event of system failure, corruption, or disaster.Permanent data loss could make it impossible to reconstruct financial records or restore operations.

Worked Example — Evaluating Access Controls at a Mid-Size Company

Consider a scenario in which you are an auditor evaluating the ITGCs for Meridian Manufacturing, Inc., a publicly traded mid-size company that uses an ERP system for its financial reporting. The company has 800 employees, 250 of whom have some level of ERP access. The quarterly access review is one of the key ITGCs identified during the scoping phase. You will walk through the evaluation from design assessment through deficiency classification.

Evaluating the Quarterly User Access Review ITGC
1
Step 1 — Understand the Control DesignThrough inquiry and inspection of the IT policy manual, you learn that the IT Security Manager generates a complete listing of ERP user accounts and their assigned roles at the end of each quarter. This listing is distributed to each department head, who reviews the access rights for their team members, confirms appropriateness, and flags any accounts that should be modified or removed. The department head signs an attestation form and returns it to IT Security within 10 business days. IT Security then processes any requested changes and retains the signed attestation as documentation.
Design assessment: The control is suitably designed to detect and remediate inappropriate access on a periodic basis.
2
Step 2 — Determine the Population and Sample SizeThe control operates quarterly, so there are four occurrences during the audit period (Q1 through Q4). Following standard audit methodology for a quarterly control, you select two of the four quarters for testing — in this case, Q2 and Q4 — ensuring coverage of both an interim and a year-end period.
Sample: 2 of 4 quarterly reviews selected for testing.
3
Step 3 — Test Operating Effectiveness (Q2 Review)For the Q2 review, you obtain the signed attestation form and the corresponding user access listing. You verify that the listing was comprehensive (all 250 users were included), that each department head reviewed and signed the attestation within the 10-day window, and that three accounts flagged for removal were actually deactivated by IT Security. All evidence is satisfactory — the Q2 control instance operated effectively.
Q2 result: Control operated effectively; no exceptions noted.
4
Step 4 — Test Operating Effectiveness (Q4 Review)For the Q4 review, you discover a problem. While the access listing was generated and distributed, the Sales department head did not return the signed attestation form. IT Security followed up via email but ultimately processed no changes for the Sales department. You identify 45 Sales department users whose access was not reviewed during Q4. Additionally, you cross-reference the HR termination report and find that two Sales employees who left the company during Q4 still have active ERP accounts as of year-end.
Q4 result: Exception identified — 45 users not reviewed; 2 terminated employees retained active access.
5
Step 5 — Evaluate the DeficiencyYou must now assess severity. The two terminated employees had access to the Sales order entry module, which is directly linked to revenue recognition — a significant account. Although there is no evidence that these accounts were actually used after termination (which you can verify through access logs), the possibility of unauthorized transactions is what matters for the severity assessment. Given the linkage to revenue — a financial statement line item with a high risk of material misstatement — and the fact that the failure covered an entire quarter, you conclude that this deficiency is at least a significant deficiency. Depending on whether compensating controls exist (such as independent review of sales orders or detective analytics over revenue), it could potentially rise to a material weakness.
Deficiency classification: Significant deficiency at minimum; evaluate compensating controls before final determination.

Strengths & Limitations of ITGC Evaluation

Understanding the strengths and limitations of the ITGC evaluation process helps auditors and future CPAs calibrate their professional judgment. An ITGC evaluation, when performed rigorously, provides a powerful foundation for audit efficiency and reliability, but it is not without constraints that must be acknowledged and managed.

Strengths and Limitations of ITGC Evaluation
StrengthsLimitations
Enables reliance on automated controls: When ITGCs are effective, the auditor can rely on automated application controls and system-generated reports, reducing the need for extensive manual substantive testing.Binary cascading effect: A single ITGC failure can undermine reliance on all application controls across the affected system, potentially requiring a complete overhaul of the audit approach.
Pervasive coverage: Testing a relatively small number of ITGCs provides assurance over a large volume of transactions processed by the in-scope systems throughout the year.Point-in-time evidence: Some ITGC tests reflect a snapshot rather than continuous assurance — for example, testing a password policy configuration at a single date does not confirm it was in place all year without additional evidence.
Efficient for automated controls: Because automated controls operate identically each time (assuming no unauthorized changes), ITGCs support a test-once strategy that saves significant audit hours.Complexity of modern IT environments: Cloud computing, SaaS applications, and third-party service organizations add layers of complexity that can make ITGC evaluation scope and boundary decisions challenging.
Early identification of risk: ITGC evaluation is typically performed early in the audit cycle, allowing the team to adjust the audit plan proactively if deficiencies are found.Dependency on management representations: Much of the initial understanding is gathered through inquiry, which is the weakest form of audit evidence. Corroboration through inspection and reperformance is essential.
KEY TAKEAWAY
ITGC evaluation functions much like a structural inspection of a bridge. A single compromised support beam (an ITGC failure) does not necessarily mean the bridge will collapse, but it shifts the burden to other structural elements (compensating controls) and demands a thorough engineering assessment (expanded substantive procedures). The auditor's goal is not to guarantee perfection but to assess whether the overall structural integrity is sufficient to support the weight of financial reporting reliability placed upon it.

Connection to Advanced Theory — SOC Reports, Cloud ITGCs & Emerging Risks

As organizations increasingly migrate financial systems to cloud-hosted platforms and rely on third-party service organizations, the traditional approach to ITGC evaluation must evolve. When a company outsources its ERP hosting to a cloud provider, the ITGCs over the physical data center, network security, and certain logical access layers are no longer under the company's direct control. In these situations, auditors turn to SOC reports — specifically SOC 1 Type II reports prepared in accordance with SSAE 18 (AT-C 320) — which provide an independent auditor's opinion on the design and operating effectiveness of the service organization's controls relevant to user entities' internal controls over financial reporting.

Traditional vs. Cloud/Outsourced ITGC Evaluation
Traditional ITGC EvaluationCloud / Outsourced ITGC Evaluation
All ITGC domains are directly tested by the auditor at the company's premises or within company-managed systems.Some ITGC domains (e.g., physical security, network controls) are covered by the SOC 1 report from the service organization; the auditor reviews this report rather than testing directly.
Scope boundaries are relatively clear — the company owns and manages its entire technology stack.Scope requires understanding the shared responsibility model: which controls belong to the service provider and which remain the user entity's responsibility (complementary user entity controls, or CUECs).
Compensating controls reside within the same organization and can be tested alongside primary ITGCs.If the SOC report reveals a deficiency at the service organization, the auditor must assess whether the user entity's CUECs adequately compensate or whether additional procedures are necessary.
Cybersecurity concerns are addressed through the access controls and operations domains.Cybersecurity risk is amplified by data transit across networks, shared infrastructure, and API integrations — requiring evaluation of encryption, API authentication, and data isolation controls.

Looking forward, emerging risks such as the proliferation of robotic process automation (RPA) bots, the integration of artificial intelligence into financial systems, and the expanding regulatory landscape around data privacy (GDPR, CCPA) are pushing the boundaries of traditional ITGC frameworks. CPA candidates should understand that ITGCs are not a static checklist but a living concept that must adapt as the technology environment evolves. The fundamental principles — controlling access, managing change, ensuring operational reliability, governing development, and protecting data — remain constant even as the specific control activities change.

Practice Problems

PROBLEM 1CONCEPTUAL
Explain why a deficiency in IT General Controls can undermine the auditor's reliance on automated application controls, even if the application controls themselves appear to be functioning correctly. In your answer, distinguish between ITGCs and application controls and articulate the concept of 'indirect but pervasive' impact.
PROBLEM 2BASIC CALCULATION
An auditor is evaluating ITGCs for a company that performs a monthly user access review (12 occurrences per year) and a continuous automated password complexity enforcement (automated control). How many sample items should the auditor plan to test for each control, and why do the sample sizes differ?
PROBLEM 3INTERMEDIATE
During ITGC testing of the change management domain, an auditor selects 25 program changes deployed to the production ERP system during the year. In 3 of 25 changes, the auditor finds that changes were migrated to production by the same developer who wrote the code, violating the company's segregation-of-duties policy. How should the auditor assess this finding, and what additional steps should be taken?
PROBLEM 4APPLIED
TechNova Corp. recently migrated its financial reporting ERP from an on-premises server to a cloud-hosted SaaS platform managed by CloudFirst Services. The auditor of TechNova receives a SOC 1 Type II report from CloudFirst that covers the period January 1 through September 30, while TechNova's fiscal year ends December 31. The SOC report contains one exception: a failure to revoke a former CloudFirst employee's administrative access for 45 days after termination. Describe the auditor's evaluation process, including how to address the report's coverage gap and the noted exception.
PROBLEM 5CRITICAL THINKING
A colleague argues that ITGC evaluation will become obsolete as artificial intelligence and continuous auditing technologies enable real-time transaction-level testing of 100% of transactions, eliminating the need for indirect assurance through infrastructure controls. Critically evaluate this argument, considering both its merits and its flaws, and explain whether you agree or disagree.

Lesson Summary

IT General Controls (ITGCs) are the foundational infrastructure-level controls that ensure the reliability of the IT environment supporting financial reporting systems. They span five key domains: logical access and security, change management, computer operations, program development (SDLC), and backup and recovery. Unlike application controls that directly validate individual transactions, ITGCs operate indirectly and pervasively — a single ITGC failure can undermine confidence in every automated control on the affected system.

The ITGC evaluation process follows a structured methodology: scoping the IT environment, assessing design effectiveness, testing operating effectiveness through appropriately sized samples, and evaluating deficiencies on a severity spectrum from control deficiency to significant deficiency to material weakness. In modern cloud-centric environments, auditors increasingly rely on SOC 1 Type II reports and must navigate shared responsibility models and complementary user entity controls. The principles underlying ITGCs remain constant even as technology evolves — mastery of these concepts is essential for the CPA examination and for effective practice as an audit professional.

Varsity Tutors • CPA (ISC) • Evaluate IT General Controls (ITGCs)