Auditing IT General Controls

Introduction

Almost every financial and operational process now runs on information systems. If the underlying IT environment is poorly controlled, application controls and system reports cannot be relied upon, and errors or fraud may go undetected. IT general controls therefore sit at the heart of both internal and external audit work.

This Auditing IT General Controls training course gives auditors a practical understanding of how to plan, test and report on the core IT control domains: access management, change management, IT operations and system development. Participants learn what good controls look like, how to obtain and analyse evidence, and how to evaluate deficiencies and their impact.

The course is designed for both IT and non-IT auditors, explaining technical concepts in clear language while providing the depth needed to perform credible, evidence-based audit work.

Course Objectives

By the end of this training course, participants will be able to:

• Explain the purpose of IT general controls and their link to financial reporting
• Scope an IT general controls review based on risk
• Assess the design of logical access and user management controls
• Test change management controls for applications and infrastructure
• Evaluate IT operations controls including backup and job scheduling
• Review system development and acquisition controls
• Obtain, analyse and document reliable IT audit evidence
• Evaluate and report control deficiencies effectively

Target Audience

This training course is suitable for a wide range of professionals, including:

• Internal auditors and audit managers
• IT auditors and IT risk professionals
• External auditors involved in IT reviews
• Information security and compliance staff
• IT managers preparing for audits
• Finance professionals relying on system controls

Training Methodology

The course is practical and evidence-focused. Participants work through sample system reports, user access listings, change tickets and backup logs, performing tests as they would in a real audit. Short technical explanations are followed by exercises, walkthrough simulations and the drafting of audit findings.

Target Competencies

• IT audit scoping
• Access control testing
• Change management review
• IT operations assessment
• IT audit evidence analysis
• Deficiency evaluation and reporting

Day One: IT General Controls and Audit Planning

• The relationship between IT general controls and application controls
• IT risks to data integrity, availability and confidentiality
• Common control frameworks used in IT audit
• Understanding the IT environment: systems, databases and infrastructure
• Risk-based scoping of an IT general controls review
• Working with IT teams and planning walkthroughs
• Exercise: scoping an ITGC review for a finance system

Day Two: Logical Access and User Management

• User provisioning, modification and removal processes
• Privileged and administrator access controls
• Password policies, authentication and single sign-on
• Segregation of duties in systems and how to test it
• Periodic user access reviews and their effectiveness
• Analysing user listings against HR leaver data
• Exercise: testing access controls with sample data

Day Three: Change Management Controls

• Why uncontrolled changes threaten system reliability
• Change request, approval, testing and implementation steps
• Segregation between development and production environments
• Emergency changes and how they should be controlled
• Database and infrastructure change controls
• Selecting samples and testing change tickets
• Exercise: evaluating a set of change records

Day Four: IT Operations and System Development

• Job scheduling, monitoring and incident management
• Backup, restoration testing and data retention
• Physical and environmental controls over data centres
• Controls over cloud and outsourced IT services
• System development life cycle and project controls
• Data migration and go-live controls
• Exercise: reviewing backup and incident evidence

Day Five: Evidence, Evaluation and Reporting

• Sufficient and appropriate IT audit evidence
• Using data analytics and system reports reliably
• Evaluating the severity of IT control deficiencies
• Compensating controls and their limitations
• Writing clear IT audit findings for non-technical readers
• Agreeing remediation and follow-up with IT management
• Personal action plan for IT general controls auditing