"IT audit" is the umbrella term for reviewing technology and its controls. An ITGC audit tests the general controls that make systems trustworthy, such as access, change management and operations. A cybersecurity audit tests how well the organisation prevents, detects and responds to attacks. They overlap, but each answers a different question, so ask for the right one.
Last reviewed: 17 October 2026. Facts checked. The scope of each term follows common practice and our existing ITGC guide; no primary standard was opened. We did not check specific regulator rules (RBI, SEBI, CERT-In) or any framework version numbers, so confirm those for your sector.
The short version
| IT audit | ITGC audit | Cybersecurity audit | |
|---|---|---|---|
| Scope | Any technology review | General controls over systems | Security posture and defences |
| Main question | Is technology well governed and controlled? | Can we trust the systems that produce our data? | Can we resist and respond to attack? |
| Typical trigger | Annual IT plan, new system | Financial reporting reliance | Threat concern, regulator, customer demand |
| Main user | Audit committee, CIO | Statutory and internal auditors | CISO, board risk committee |
IT audit: the umbrella
IT audit can cover many things:
- IT governance and strategy,
- general controls,
- application controls inside a system,
- project and implementation reviews,
- data privacy and vendor management,
- disaster recovery,
- cybersecurity.
Because it is so broad, the scope document matters most. State exactly which systems and which questions are in.
ITGC audit
ITGCs are the controls that apply across systems rather than inside one. They usually fall into four groups:
- Access: who can log in and do what, and how access is added and removed.
- Change management: how changes to programs and configurations are approved, tested and moved to live.
- IT operations: backups, job scheduling, incident handling.
- Program development: how new systems are built or bought.
Why does this matter to auditors? If these controls are weak, you cannot rely on the reports or automated controls the system produces. The statutory auditor looks at them to decide how much to rely on system data, as part of understanding the entity and its controls under SA 315. Internal auditors test them for the same reason.
For a full walkthrough see the ITGC audit guide and the ITGC audit workbook.
Cybersecurity audit
A cybersecurity audit asks if the organisation can protect its information and systems against attack. Typical areas:
- asset and vulnerability management,
- network and endpoint protection,
- identity and privileged access,
- monitoring and incident response,
- staff awareness,
- third-party security.
It often relies on a recognised framework chosen by the organisation. It may include technical testing such as vulnerability scans or penetration tests, which need specialist skills.
Cybersecurity and ITGC overlap on access control. The difference is purpose. ITGC access testing asks whether data used in financial reporting can be trusted. Cybersecurity asks whether an attacker could get in.
Which one should you ask for?
| Situation | Best fit |
|---|---|
| Auditors need to rely on system reports for the financial statements | ITGC audit |
| New ERP going live | IT audit (project and application controls), then ITGC after go-live |
| Board worried about ransomware or data theft | Cybersecurity audit |
| Customer or regulator asks for security assurance | Cybersecurity audit, scoped to the request |
| Annual IT review across the estate | IT audit with a risk-based plan |
| Handling of personal data | IT audit with a data privacy scope |
Many organisations run all three over a multi-year cycle. Do not use one as a substitute for another. A clean ITGC report says nothing about whether you can resist an attack.
Who should do the work
General internal audit teams can usually handle ITGC reviews with training. Technical security testing needs specialists. If you use outside help, define the scope in writing and keep a named owner inside the company.
Common mistakes
- Asking for "an IT audit" without a scope.
- Treating an ITGC pass as proof of security.
- Reporting findings without a risk rating or an owner.
- Testing access once a year, when changes happen daily.
Frequently Asked Questions
What is the difference between IT audit and ITGC audit?
IT audit is the broad category. ITGC audit is one kind, focused on the general controls over systems.
Is a cybersecurity audit the same as a penetration test?
No. A penetration test is one technique inside a cybersecurity review. The audit also covers governance, processes and people.
Do small firms need ITGC testing?
If the client uses accounting software and you rely on its reports, you still decide how much to rely on it. Scale the work to the system and the risk.
How often should IT audits happen?
Set the frequency from a risk assessment in the annual plan. Higher-risk systems need more frequent review.
Can AI systems be audited?
Yes, as a technology and governance review. See how to audit AI agents.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error