Information Technology General Controls (ITGCs)
The four domains of information technology general controls (ITGCs) and how they support reliance on automated controls.
By SimplyCPA · Updated 27 September 2026
Medium 55 minArea I: Information Systems and Data Management
Text size
On this page (8)
Why this topic matters
Information technology (IT) general controls (ITGCs) are the foundation for every automated control and system-generated report. Information Systems and Controls (ISC) tests the ITGC domains, how they are designed and tested, and the effect of ITGC weaknesses — from the perspective of management, a service organization, and an auditor.
What ITGCs do
ITGCs are policies and procedures that apply to many applications and support the effective functioning of application controls by keeping systems secure, stable, and properly changed. If ITGCs fail, the auditor or management can't assume automated controls kept working throughout the period.
The four ITGC domains
| Domain | Objective | Key controls |
|---|---|---|
| Logical access (access to programs and data) | Only authorized people can access systems and data, with only the access they need | Unique user identifiers; strong passwords and multi-factor authentication (MFA); role-based access and least privilege; formal provisioning with approval; timely removal of terminated users; periodic user access reviews; restricted and monitored privileged (administrator) accounts; segregation of incompatible duties |
| Change management (program changes) | Changes to applications, databases, and infrastructure are authorized, tested, approved, and implemented correctly | Documented change requests; impact analysis; testing in a separate environment; user acceptance testing; approval before migration; segregation between developers and production; emergency change procedures with after-the-fact review; version control |
| Program development and acquisition | New systems are designed, built or bought, tested, and implemented properly | Project governance; requirements sign-off; testing; data conversion controls; post-implementation review |
| Computer operations | Systems run reliably and data can be recovered | Job scheduling and monitoring; backup and recovery with restoration testing; incident and problem management; capacity and performance monitoring; physical and environmental controls in data centers |
Segregation of duties in information technology
- Separate systems development (programmers, developers), IT operations (operators, system administrators), data or database administration, security administration, and end users.
- Developers should not move their own code into production or have write access to production data.
- Security administrators should not also be business users who approve transactions.
- Where segregation isn't feasible (small IT teams), use compensating controls such as logging and independent review of changes and privileged activity.
Relationship to application controls
| ITGC deficiency | Effect on application controls and reports |
|---|---|
| Developers can change production code without approval | Automated calculations, edit checks, and report logic could have been altered — reliance on them is undermined |
| Terminated employees retain access | Risk of unauthorized transactions or data changes |
| No backup testing | Risk of data loss affecting completeness |
| Excessive privileged access | Controls can be bypassed or overridden |
Testing ITGCs
- Design and implementation: inquiry plus inspection of policies, system configurations (password settings, access roles), and walkthroughs.
- Operating effectiveness: samples over the period — for example, select new users and inspect approval; select terminations and confirm access was removed promptly; select changes and inspect testing and approval evidence; inspect access review sign-offs.
- Population completeness: obtain system-generated lists (all changes, all users) and verify they are complete before sampling.
- Deficiencies are evaluated for their effect on dependent application controls and whether compensating controls exist (for example, a detective review of all changes made).
Frameworks that organize IT controls
- Control Objectives for Information and Related Technologies (COBIT) 2019 — an Information Systems Audit and Control Association (ISACA) framework for governance and management of enterprise IT, separating governance objectives (Evaluate, Direct, and Monitor) from management objectives (Align, Plan, and Organize; Build, Acquire, and Implement; Deliver, Service, and Support; Monitor, Evaluate, and Assess).
- Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control — Integrated Framework, principle 11: the organization selects and develops general control activities over technology.
- National Institute of Standards and Technology (NIST) Special Publication 800-53 control catalog, and the NIST Cybersecurity Framework.
How it is tested
- Classify a control into an ITGC domain.
- Identify incompatible duties in an IT environment.
- Explain how an ITGC weakness affects reliance on automated controls.
- Choose an appropriate test of an ITGC.
EXAM TIP: If a question describes a well-designed automated control and a change-management or access weakness in the same system, the answer is almost always that reliance on the automated control is limited until the ITGC issue is addressed.