Testing and Documenting IT General Controls for Access, Change, and Operations Reliance

IT general controls support the reliability of applications, automated controls, reports, interfaces, and data used in the audit. They are not tested as a checklist exercise. They are tested because weak access, change, or operations controls can undermine the evidence produced by financial reporting systems.

For AUD, the main task is to connect each ITGC test to control reliance. If the audit team relies on an automated three-way match, system-generated aging report, or automated revenue interface, it must consider whether the surrounding IT environment supports that reliance.

    flowchart TD
	    A["Audit team wants to rely on application control or report"] --> B["Identify supporting ITGCs"]
	    B --> C["Access controls"]
	    B --> D["Change-management controls"]
	    B --> E["IT operations and backup controls"]
	    C --> F["Test design and operating effectiveness"]
	    D --> F
	    E --> F
	    F --> G{"ITGCs effective?"}
	    G -- "Yes" --> H["Control reliance may be supportable"]
	    G -- "No" --> I["Revise audit response and obtain alternate evidence"]

Access Controls

Access controls restrict who can enter systems, approve transactions, change data, or administer applications. The audit risk is unauthorized access that could cause or conceal a material misstatement.

Inquiry alone is not sufficient. The auditor normally inspects system listings, HR records, tickets, approvals, and evidence of follow-up on exceptions.

Change Management

Change-management controls prevent unauthorized or untested changes from entering production systems. These controls are critical when the auditor relies on automated controls or system-generated reports.

The auditor commonly selects a sample of changes and traces each one from request through approval, testing, migration, and closure. Missing evidence in any step can affect reliance on the related application.

IT Operations and Backups

IT operations controls support ongoing processing, job completion, incident handling, and data recoverability.

The exam trap is treating a backup schedule as enough. A backup that has never been restored may not support an availability or recoverability conclusion.

Documentation Quality

ITGC documentation should show what control was tested, why it matters to the audit, what evidence was inspected, what period was covered, what exceptions were found, and what conclusion was reached.

Screenshots should be dated, traceable, and tied to the relevant system. A screenshot without context is weak evidence.

Testing Exceptions

When an ITGC exception is found, the auditor evaluates severity and audit effect.

Not every ITGC exception causes a material misstatement, but every relevant exception should be translated into a control-reliance or substantive-testing decision.

Exam Traps

• ITGCs support reliance on automated controls and system-generated information; they do not directly prove account balances.
• Developer access to production is a change-management and segregation-of-duties risk.
• Periodic access reviews are useful only if the population is complete and exceptions are resolved.
• Backup completion logs are weaker than restoration-test evidence.
• Flowcharts help documentation, but they do not prove operating effectiveness by themselves.
• Inquiry alone rarely supports operating effectiveness.
• ITGC exceptions require an audit response, not just an IT observation.

Quick Review

Use this sequence for ITGC questions:

1. Identify the application, report, or automated control the audit team wants to rely on.
2. Determine which ITGCs support that reliance.
3. Test access provisioning, termination, privileged access, and access reviews.
4. Test change requests, approvals, testing, and production migration.
5. Test operations controls such as job monitoring, interfaces, incidents, backups, and restoration.
6. Document population, sample, evidence, exceptions, and conclusion.
7. Translate exceptions into revised control reliance or additional substantive procedures.

Review Questions