Application Controls vs IT General Controls: Practical Examples
By SimplyCPA · 11 October 2026
On this page (5)
- Application controls: Operate within a specific application over individual transactions — input, processing and output controls.
- ITGCs: Operate across the IT environment and support all applications — access, change management, operations.
- Relationship: ITGCs are the foundation; application controls can only be relied on if the ITGCs over that application are effective.
- IT-dependent manual controls: A person acts on a system-generated report (e.g. reviewing an exception report) — test both the review and the report.
- Preventive vs detective: Edit checks and approvals prevent errors; reconciliations and exception reports detect them.
The core distinction
| Application controls | IT general controls | |
|---|---|---|
| Scope | A specific application or business process | The IT environment as a whole |
| Focus | Completeness, accuracy, validity and authorisation of transactions | Integrity of programs, data and operations |
| Examples | Credit limit check, three-way match, automated depreciation calculation | User access reviews, change approval, backup monitoring |
| Typical owner | Business process owner | IT |
Types of application controls
Input controls
- Field and format checks — dates must be valid; numeric fields reject letters.
- Validity checks — a vendor number must exist in the vendor master file.
- Limit and reasonableness checks — hours worked can't exceed 80 a week.
- Check digits — detect transposed account numbers.
- Completeness checks — required fields can't be left blank.
- Batch totals — record counts, financial totals and hash totals compared before and after input.
Processing controls
- Automated calculations (pricing, tax, depreciation).
- Run-to-run totals between processing stages.
- Duplicate detection (e.g. the same invoice number from the same vendor).
- Automated three-way match of purchase order, receiving report and invoice.
Output controls
- Reconciling output totals to input or control totals.
- Distributing reports only to authorised users.
- Exception reports reviewed by management.
Examples by business cycle
| Cycle | Application control | Assertion addressed |
|---|---|---|
| Order to cash | System blocks orders exceeding the customer's credit limit | Valuation of receivables |
| Order to cash | Invoice generated automatically from the shipping record | Completeness and occurrence of revenue |
| Purchase to pay | Payment released only after a three-way match within tolerance | Occurrence and accuracy of expenses |
| Payroll | Pay can't be processed for an employee not in the HR master file | Occurrence (no ghost employees) |
| Financial close | Journal entries above a threshold require system approval by a second person | Occurrence and accuracy |
IT-dependent manual controls
Many key controls combine a person and a report — a controller reviewing a system-generated list of credit memos, for instance. To rely on it, the auditor tests the manual review and the completeness and accuracy of the report it depends on.
Exam-style scenario: An automated three-way match is configured correctly and tested once with satisfactory results. However, during the year the IT team could push configuration changes without approval. Can the auditor rely on the match for the full year?
No — not without more work. The change management ITGC failed, so the configuration may have changed. The auditor needs evidence that it didn't (e.g. a review of configuration change logs) or must test the control at additional points in time.
See IT general controls explained and ISC business process automation.