What it is
Under AU-C 315 as revised by SAS 145, the auditor identifies the IT applications relevant to the financial statements, the risks that arise from IT, and the general IT controls that address them. This checklist covers the four common ITGC areas plus a separate section for the periodic user access review.
It is for financial statement audits. For SOX 404 engagements use the SOX ITGC test plan, and to test one access review use the user access review test worksheet. Sample sizes are left to the engagement team.
When to use it
- Documenting the IT environment and ITGC testing in a financial statement audit.
- Before relying on automated controls or system reports.
- When a client’s access review needs to be evaluated as evidence.
What’s inside
- Application scoping and the reliance decision
- Access to programs and data
- User access review reliability tests
- Change management and implementation
- Computer operations and ITGC conclusions
Standard cited
This template follows AU-C 315 (SAS 145) / AU-C 265. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use. See AU-C 315 explained, AU-C 265 explained.
Questions
Do I have to test ITGCs?
Only where you plan to rely on automated controls or on system-generated information through controls. You must still understand the IT environment and the risks arising from IT, and the response must be documented.
What makes a user access review reliable evidence?
A complete and accurate population generated by the system, a reviewer with knowledge of the roles, evidence of each decision and proof that the requested removals were made in the system.
What if ITGCs are ineffective?
You cannot rely on the automated controls and reports that depend on them. Revise the risk assessment and perform more substantive procedures, and consider communicating deficiencies under AU-C 265.
Related templates
Last updated 11/05/2026. All free templates.