CORAA
Log inRun your first audit free
Topic hub · Technology assurance

IT and cyber audit: controls, VAPT and system reviews

IT and cyber audit tests whether the systems behind the numbers are controlled: who has access, how changes are approved, whether data is backed up, and whether weaknesses are found and fixed. It sits beside financial audit and internal audit rather than replacing them.

This hub collects CORAA's guides on ITGC, VAPT, information security audit scope, ERP audits and audit trails in Tally, with working forms and free tools.

Each guide states what its facts rest on and what we could not verify. Standards and laws change, so confirm dates and wording against the primary source before relying on them.

Guides

The essential guides: start here.

Internal Audit · 10 Oct 2026
ITGC Audit in India: Information Technology General Controls Testing Guide for CAs
ITGC audit explained for Indian CAs: four domains, tests and evidence per domain, link to SA 315 and SA 330, Rule 11(g) audit trail, IFC under 143(3)(i) and when to use an IT specialist.
Audit Technology · 14 Oct 2026
VAPT Explained: Vulnerability Assessment, Penetration Testing and How Auditors Use the Reports
VAPT combines a vulnerability assessment with penetration testing. What each does, what a report holds, and how an auditor reads it as evidence.
Audit Technology · 14 Oct 2026
Cyber Security Audit vs VAPT vs ISO 27001 Audit: How They Differ
A cyber security audit is the broad review, VAPT is a technical test, and ISO 27001 is a management system audit. How they differ and which one you need.
Internal Audit · 15 Oct 2026
Information Security Audit: Scope, Evidence and a Short Checklist
What an information security audit covers, how to set the scope, what evidence to collect and a short checklist you can use before the auditor arrives.
Audit Technology · 15 Oct 2026
ERP and SAP Audit: What Auditors Test and What Access They Need
What an ERP or SAP audit tests, from user access to change control and master data, and the read-only access an auditor should ask for.
Compliance · 14 Oct 2026
Tally Edit Log and Audit Trail: What It Records, How It Is Enabled and How Auditors Review It
What the TallyPrime edit log records, how it is switched on, and how an auditor reviews edited and deleted entries. Includes a short test checklist.
All guides on this topic
Free templates and tools

Ready-to-use working papers, no sign-up to look around.

Word template
IT General Controls (ITGC) Checklist
A risk-and-control checklist covering access management, change management, segregation of duties, backup/recovery and authentication — the IT-environment controls SIA 520 and the ICFR framework both rely on.
Word template
VAPT Scope and Retest Tracker
Define the scope and rules of engagement for a penetration test and track findings through fix and retest.
Word template
Cybersecurity Internal Audit Checklist
Broader than ITGC — vulnerability management, incident response readiness, security awareness and third-party access, alongside the financial-reporting-relevant IT controls ITGC already covers.
Word template
SOX ITGC Test Plan
Plan testing of access, change and operations controls for the systems behind financial reporting.
Word template
Digital Evidence Collection Checklist
Check authority, method, integrity and custody when collecting electronic records.
Free tool
Journal entry test filter
Flag unusual entries in a pasted journal listing.
Free tool
Vendor master data test
Find missing or shared vendor identifiers.
Frequently asked questions

IT and cyber audit: in plain words.

ITGC are the controls over the environment in which applications run, usually grouped as access management, change management, and operations such as backup and job monitoring. Auditors test them to decide how far they can rely on system-generated information. Read more: ITGC audit guide.
VAPT combines vulnerability assessment, which looks for known weaknesses, with penetration testing, where a tester tries to exploit them under agreed rules. It is done by qualified testers with written authorisation. Read more: VAPT explained.
A cyber security audit reviews policies, controls and evidence against a framework or standard, while VAPT tests systems technically. An ISO 27001 audit assesses an information security management system against that standard. Read more: How they differ.
Companies using accounting software must use software that records an edit log of changes that cannot be disabled, and auditors report on it. Check the current rule text and the effective dates before relying on any summary. Read more: Audit trail rules.