Definition
IT general controls (ITGCs) are policies and procedures that relate to many applications and support their effective operation. They usually cover logical access, program change management, and IT operations such as backups and job scheduling. Some also cover program development for new systems.
Why it matters in an audit or review
Under AU-C 315 as revised by SAS 145, the auditor identifies the IT applications and other IT aspects relevant to controls the auditor plans to rely on and to certain other risks, identifies the risks arising from IT, and identifies the general IT controls that address those risks. The auditor evaluates their design and implementation, and tests operating effectiveness if relying on the related controls. If ITGCs fail, automated controls and system-generated reports lose their support.
Example
Illustrative: a client's billing system calculates invoice tax automatically, and the auditor wants to rely on it. The auditor tests who can change tax tables (access), that a change to the tax rate was approved and tested before release (change management), and that nightly backups ran (operations). If a developer could change rates in production with no review, the team stops relying on the automated calculation and tests invoices substantively.
Common mistakes
Testing an automated control once and relying on it without any ITGC testing. A one-time test is only meaningful if nothing could have changed.
Sources
- AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (as revised by SAS No. 145), including the application material on IT environment and general IT controls
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error