What it is
IT general controls support reliance on automated controls and system-generated reports. This workbook lists the in-scope systems and tests controls in three domains: logical access, program change and computer operations. Each row records the control, frequency, population, calculated sample size, items tested, exceptions and the result.
A deficiency evaluation column follows AU-C 265, and a reliance column records whether the results support reliance on automated controls and reports. The sample guide holds illustrative starting sizes by control frequency: replace them with your firm’s methodology. The matrix is general rather than SOX-specific.
When to use it
- Testing ITGCs over applications that support the financial statements.
- Documenting the basis for relying on automated controls and reports.
- Evaluating exceptions and deficiencies in ITGCs.
What’s inside
- Systems tab with hosting and SOC report availability
- Sample guide by control frequency
- Matrix of access, change and operations controls with exception rate and result
- Deficiency evaluation, compensating controls, reliance and summary by domain
Standard cited
This template follows AU-C 315 / AU-C 265. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use. See AU-C 315 explained, AU-C 265 explained.
Questions
Are the sample sizes required?
No. They are illustrative starting values, not prescribed by AU-C 530 or any regulator. Replace them with the sample sizes in your firm’s methodology and keep the basis in the file.
How does this differ from the SOX ITGC test plan?
The SOX template plans ICFR testing for an issuer or SOX-style program. This matrix is a general working form for a financial statement audit of any entity and records sample, exceptions and reliance in one grid.
What if the system is hosted by a service organization?
A SOC 1 Type 2 report can support the test if its scope, period and user controls fit (AU-C 402). Record the report on the Systems tab and test the user controls separately.
Related templates
Last updated 11/05/2026. All free templates.