Understanding IT General Controls and Application Controls

IT control questions test whether system-generated information can be trusted for audit purposes. IT general controls support the environment in which applications operate. Application controls operate inside specific systems to process transactions completely, accurately, and validly.

For AUD, the key judgment is reliance. If access, change management, and IT operations controls are weak, the auditor may not be able to rely on automated application controls or system reports without additional testing.

IT General Controls

IT general controls (ITGCs) operate across systems, applications, databases, networks, and infrastructure. They do not usually test one transaction directly. Instead, they support whether automated processing and reports remain reliable over time.

Weak ITGCs can have a pervasive effect. A payroll application control may be well designed, but if developers can move untested code into production, the auditor should question whether that automated control operated consistently.

Application Controls

Application controls are embedded in a specific application or process. They usually address transaction-level completeness, accuracy, authorization, validity, and cutoff.

The auditor should identify which assertion the application control supports. A sequential invoice control may support completeness. A three-way match may support occurrence, authorization, and accuracy of purchases. A credit-limit check may support collectibility and authorization.

Relationship Between ITGCs and Application Controls

    flowchart LR
	    A["IT general controls"] --> B["Stable and restricted IT environment"]
	    B --> C["Application controls"]
	    C --> D["Reliable transaction processing"]
	    D --> E["System-generated reports and audit evidence"]

The audit issue is dependency. Automated application controls are only as reliable as the environment that protects them. If change management, access, or operations controls are ineffective, the auditor may need to test the application control more directly, validate reports independently, or expand substantive procedures.

System-Generated Reports

Auditors frequently use reports produced by client systems: aging reports, exception reports, inventory listings, payroll registers, sales reports, user access listings, and journal-entry populations. Before relying on a report, the auditor should consider whether it is complete and accurate.

Common report-reliability procedures include:

• Agreeing report totals to the general ledger or subledger.
• Testing report parameters and filters.
• Inspecting evidence that the report came from the system of record.
• Testing user access to report-generation functions.
• Reperforming selected calculations or report logic.
• Involving IT specialists when report logic or extraction is complex.

This is a common AUD trap. A report generated by a system is not automatically reliable audit evidence.

How IT Control Findings Affect the Audit Plan

The auditor does not automatically abandon all system evidence when one ITGC weakness exists. The response depends on which systems, controls, accounts, and assertions are affected.

Example: Automated Three-Way Match

A company uses an ERP system to match purchase orders, receiving reports, and vendor invoices before recording a payable. The application control appears strong because mismatches are blocked or routed for review.

Before relying on it, the auditor should ask:

• Who can change matching tolerances?
• Are changes tested and approved?
• Can users override blocked invoices?
• Are exception reports reviewed?
• Are vendor master-file changes restricted?
• Are interface failures between receiving and accounts payable resolved?

If ITGCs and exception-review controls are effective, the auditor may be able to place more reliance on the automated match. If not, the auditor may need more detailed substantive testing of payables and expenses.

Common Exam Traps

• Assuming application controls are reliable when ITGCs are weak.
• Confusing access-security controls with transaction authorization controls.
• Treating a system-generated report as reliable without testing completeness and accuracy.
• Ignoring interface controls when data moves between systems.
• Assuming automation eliminates management override or configuration error.
• Choosing IT specialists as a replacement for audit judgment rather than as support for technical IT work.

Key Takeaways

• ITGCs support the reliability of systems and automated controls.
• Application controls operate within specific transaction processes.
• Automated controls depend on access, change management, and IT operations.
• System-generated reports require completeness and accuracy evaluation before reliance.
• IT findings affect the nature, timing, and extent of audit procedures.

IT General Controls and Application Controls Quiz