Why ITGCs matter
Application controls (e.g., a three-way match in the AP system) are only as reliable as the IT environment they run in. IT General Controls (ITGCs) are the foundation that makes it safe to rely on automated controls at all — if ITGCs are weak, auditors generally can't rely on any automated control in that system, no matter how well-designed it looks on paper.
Four ITGC categories
| Category | What it covers |
|---|---|
| Access controls | Who can get into the system and what they can do once inside (authentication, authorization, segregation of duties enforced by role-based access) |
| Change management | How changes to programs/configurations are requested, tested, approved, and moved to production |
| Program development / SDLC | Controls over building and implementing new systems |
| IT operations | Job scheduling, backup and recovery, incident management |
IMPORTANT: Access controls are typically the highest-risk ITGC category on the exam — questions often describe excessive or unreviewed access (e.g., a developer with production database write access) as the control gap to identify.
EXAMPLE: A company's IT department can push code changes directly to production without independent testing or approval. This is a change management deficiency — it creates risk that unauthorized or untested changes (including changes that manipulate financial data) reach the live system.
EXAM TIP: "General" controls support the whole IT environment; "application" controls are specific to one system/process (e.g., a three-way match, an edit check on a data-entry field). If ITGCs fail, don't assume the specific application control still works as designed.