An ITGC internal audit programme tests user access, privileged access, segregation of duties, change management, backup and recovery, interfaces, batch jobs, audit logs, report logic and IT operations controls.
Business-cycle testing often relies on ERP reports. ITGC gives the auditor confidence that access, changes, interfaces and reports did not undermine the evidence population.
Objective: Access is approved, appropriate and removed promptly.
User list, HR list, access tickets, recertification, leaver report.
All privileged users, all leavers, risk-based access changes.
Objective: Powerful roles and conflicting rights are controlled.
Role matrix, admin list, activity logs, SoD report, review sign-off.
All admins and high-risk SoD conflicts.
Objective: System changes are requested, tested, approved and deployed safely.
Change tickets, UAT, approvals, deployment logs, rollback evidence.
Changes in audit period, all emergency changes.
Objective: Reports and data flows used by audit are reliable.
Backup logs, DR test, interface logs, job monitor, report specification.
Key audit reports/interfaces and failed jobs.
ICAI IASB lists the Compendium of Standards on Internal Audit as on February 2026 as applicable from 1 April 2026. Use this page as a practical workpaper starter, then verify the latest standard, law, regulation, ERP report and client fact pattern before concluding.
It should cover user access, privileged access, SoD, change management, backup and recovery, interfaces, batch jobs, report reliance, audit logs and IT operations.
No. It is a fieldwork starter. The internal auditor must tailor it to the approved scope, ERP, delegation matrix, locations, volumes, materiality, prior findings and current legal position.
Yes. Use the linked CORAA workbook for the cycle. It contains editable RCM, testing, evidence and monitoring sheets that can be used as a fieldwork base.
