Information Technology General Controls (ITGCs)

Information technology general controls (ITGCs) — 4 domains

• Logical access: unique user identifiers, multi-factor authentication (MFA), least privilege, provisioning approval, prompt termination, access reviews, privileged account monitoring.
• Change management: request, test, user acceptance, approve, migrate by someone other than the developer; emergency change review.
• Development and acquisition: governance, testing, data conversion controls.
• Operations: job scheduling, backups with restore testing, incident management, data center controls.

Segregation

Development ≠ operations ≠ database administration ≠ security ≠ users. Developers: no production access.

Why ITGCs matter

Weak ITGCs → can't rely on automated controls or system reports.

Testing

Sample new users, terminations, changes, access reviews; confirm populations are complete; consider compensating controls.

Frameworks

Control Objectives for Information and Related Technologies (COBIT) 2019 · Committee of Sponsoring Organizations of the Treadway Commission (COSO) principle 11 · National Institute of Standards and Technology (NIST) 800-53.

Exam traps

• Test removal of leavers against human resources termination dates, not the date access removal was requested.
• An access review only works if the user list is complete and reviewers judge whether access is appropriate — not just sign off.
• Shared or generic accounts defeat accountability: actions can't be traced to a person.