Information Technology (IT) Controls in the Audit
General and application controls, auditing around vs. through the computer, and using data analytics.
By SimplyCPA · Updated 27 September 2026
On this page (8)
Why this topic matters
Nearly every entity processes transactions through information technology (IT). Statement on Auditing Standards (SAS) No. 145 requires the auditor to understand the IT environment, identify risks arising from the use of IT, and evaluate the general IT controls that address them. Auditing and Attestation (AUD) tests the difference between application controls and IT general controls (ITGCs), their effect on reliance, and computer-assisted audit techniques.
Understanding the IT environment
- The IT applications and supporting infrastructure (networks, operating systems, databases) relevant to financial reporting.
- The IT processes: managing access, managing program changes, and managing IT operations.
- Whether the entity uses service organizations or cloud providers for processing.
- Risks arising from IT: unauthorized access to data (improper changes or fictitious transactions), unauthorized program changes, failure to apply necessary changes, inappropriate manual intervention, and loss of data.
Two layers of controls
| IT general controls | Application controls | |
|---|---|---|
| Scope | The IT environment as a whole — support the continued functioning of application controls and the integrity of data | Specific business processes and transactions |
| Examples | User access and password management; program change management; program development; computer operations (backups, job scheduling, incident management) | Edit and validation checks, three-way match, credit limit checks, batch totals, automated calculations, exception reports |
| Effect of weakness | Can undermine all application controls and system-generated reports that rely on the affected system | Affects the specific assertion the control addresses |
EXAMPLE: A company's automated three-way match (purchase order, receiving report, invoice) is well designed. However, application programmers have unrestricted access to change the production program. Because this weakness in change management means the program could be altered without detection, the auditor cannot rely on the automated control without other evidence.
IT general control categories
- Access to programs and data: authentication (passwords, multi-factor authentication), authorization based on least privilege, periodic user access reviews, prompt removal of terminated users, restricted privileged ("superuser") access.
- Program changes: changes are requested, authorized, tested (by users), approved, and migrated to production by someone other than the developer; emergency changes are reviewed after the fact.
- Program development and acquisition: new systems are tested and approved, and data conversion is controlled.
- Computer operations: job scheduling and monitoring, backup and recovery, and problem management.
Segregation of duties in IT
Separate systems development (programmers), IT operations (computer operators), and users. Programmers should not have access to production programs or live data; operators should not be able to change programs; database administration should be separate from application programming.
Application controls by stage
| Stage | Controls |
|---|---|
| Input | Field (format) check — correct data type; validity check — value on an approved list; limit (reasonableness) check — within a set range; check digit — detects transposed identification numbers; completeness check — required fields filled; closed-loop verification — displays the customer name for an entered number |
| Processing | Batch controls: record count, financial total (sum of amounts), hash total (sum of a meaningless field such as account numbers); run-to-run totals; sequence checks |
| Output | Reconciliation of output to input totals, review of exception reports, controlled distribution of reports |
Testing IT controls
- An automated control performs consistently unless the program changes. With effective ITGCs (especially change management), testing one instance, or a small number, may be sufficient.
- Benchmarking: if an automated control was tested in a prior year, has not changed, and ITGCs are effective, the auditor may rely on prior testing without fully retesting each year (verifying the control hasn't changed).
- If ITGCs are ineffective, the auditor may test the application controls more extensively, test compensating manual controls, or rely on substantive procedures.
- System-generated reports used as audit evidence (aging reports, inventory listings) require evidence about their accuracy and completeness — often by testing the report logic and related ITGCs.
Computer-assisted audit techniques
| Technique | How it works |
|---|---|
| Generalized audit software and data analytics | The auditor's software reads client data to recalculate, select samples, stratify, find duplicates or gaps, age balances, and test 100% of a population |
| Test data | The auditor runs fictitious transactions (valid and invalid) through the client's program to see if controls work — tests the program at a point in time |
| Parallel simulation | The auditor processes real client data through the auditor's own program and compares results with the client's |
| Integrated test facility | Fictitious transactions are processed alongside live data using a dummy entity in the client's system |
| Embedded audit modules | Code within the client's system that continuously captures transactions meeting audit criteria |
| Tagging and tracing | Marking transactions to follow them through processing |
Service organizations
When a client outsources processing (payroll, cloud hosting), the user auditor may use a System and Organization Controls (SOC) 1 report: a Type 1 report covers design at a point in time; a Type 2 report also covers operating effectiveness over a period and is needed to reduce control risk. The user auditor must also test complementary user entity controls and consider any gap between the report's period and the audit period.
How it is tested
- Classify a control as an ITGC or application control.
- Identify the effect of an ITGC deficiency on reliance.
- Match input and batch controls to the errors they prevent.
- Choose the right computer-assisted technique for an objective.
EXAM TIP: Test data uses fake data in the client's program; parallel simulation uses real data in the auditor's program. A hash total adds numbers that mean nothing financially (account numbers) — a financial total adds dollar amounts.