IT General Controls (ITGCs): Access, Change Management and Operations
By SimplyCPA · 11 October 2026
On this page (6)
- Definition: ITGCs are controls over the IT environment that support the continued, proper operation of applications and the integrity of data.
- Logical access: User provisioning and removal, periodic access reviews, privileged access restrictions and authentication (passwords, MFA).
- Change management: Changes to programs and configurations are requested, tested, approved and segregated from developers before going live.
- Computer operations: Job scheduling and monitoring, backups and recovery, and incident and problem management.
- Why auditors care: Ineffective ITGCs undermine reliance on automated controls and system reports for the whole period.
Why ITGCs matter
Application controls — a three-way match, an approval limit, an automated calculation — only stay reliable if nobody can change the program or bypass it. IT general controls (ITGCs) provide that assurance across all applications that run on the same infrastructure. They're central to both the ISC Discipline and the AUD section, and to integrated audits under PCAOB AS 2201.
The four domains with examples
| Domain | Risk | Example controls |
|---|---|---|
| Logical access | Unauthorised users change data or programs | Access granted only with documented approval; leavers removed promptly; quarterly user access reviews by business owners; privileged (admin) accounts restricted and monitored; MFA; password policies |
| Program change management | Untested or unauthorised changes alter how applications process data | Change requests approved; testing and user acceptance sign-off; developers can't move their own code to production; emergency changes reviewed after the fact |
| Computer operations | Processing fails or data is lost | Batch job monitoring and error resolution; backups performed and restoration tested; incident management |
| Program development and acquisition | New systems don't work as intended | Project governance; testing and data conversion validation before go-live |
Segregation of duties in IT
Key incompatible roles include developer vs production migrator, security administrator vs end user, and database administrator vs application user with posting rights. Small IT teams often can't segregate fully, so they rely on compensating detective controls such as logging and independent review of changes.
How auditors test ITGCs
- Access: select new hires and confirm approval; select leavers and confirm timely removal; inspect evidence of the periodic review; list privileged users and evaluate appropriateness.
- Change: obtain a system-generated list of changes (and test its completeness), select a sample, and inspect approvals and testing evidence; check that developers lack production access.
- Operations: inspect job failure logs and resolution; inspect evidence of backups and restoration tests.
When ITGCs fail
If, for example, change management was ineffective for part of the year, the auditor can't assume an automated control worked consistently. Options include testing the automated control at multiple points, testing compensating controls, comparing program versions to show no change occurred, or increasing substantive testing. The deficiency is evaluated for severity — see COSO deficiency levels.
Exam trap: An ITGC deficiency doesn't automatically mean the financial statements are misstated. It means the auditor must obtain other evidence that the dependent application controls and reports worked.
Next: application controls vs ITGCs and testing automated controls. Study the topic in ISC IT general controls.