ITGC Audit
That Gives Finance
and Auditors Confidence
IT general controls audit
Reliable IT Controls Behind Reliable Financial Reporting
Your financial statements are only as reliable as the systems that produce them. iSpyCyber audits IT general controls across access management, change management, IT operations and the SDLC for your financially significant applications, supporting SOX, Ind AS reporting and Internal Financial Controls (IFC) requirements under the Companies Act, 2013.
Why organisations choose iSpyCyber
Financial reporting focus
Scope is driven by the applications and data that feed your financial statements, not by generic IT checklists.
Full technology stack
Controls tested at the application, database, operating system and cloud layers that support each key system.
Auditor-ready workpapers
Evidence and workpapers structured so statutory and internal auditors can review and rely on them efficiently.
Security-grade depth
Our offensive security background brings sharper testing of privileged access, service accounts and segregation of duties.
Early issue detection
Interim testing surfaces deficiencies early enough to remediate and retest before year-end.
Sustainable controls
Practical recommendations and control design support help reduce repeat findings year after year.
Coverage
IT General Controls We Test
Coverage spans the four core ITGC domains and the supporting controls auditors rely on for automated controls and system-generated reports.
User provisioning and removal
Access requests, approvals, timely removal of leavers and handling of movers.
Privileged and generic accounts
Administrator, database, service and shared accounts, and monitoring of their use.
Access reviews and segregation of duties
Periodic user access reviews, SoD rule sets and conflict resolution.
Authentication and password controls
Password parameters, MFA, SSO and session settings across applications and databases.
Change management
Change requests, testing, user acceptance, approval and segregation between development and production.
SDLC and new implementations
Project governance, data migration, testing and go-live approvals for new systems.
IT operations and job scheduling
Batch jobs, interfaces, job failure monitoring and resolution.
Backup and recovery
Backup schedules, monitoring, restoration testing and retention.
Incident and problem management
Logging, escalation and resolution of IT incidents affecting financial systems.
Methodology
A Structured Six-Phase ITGC Audit Methodology
Aligned to COSO 2013, COBIT 2019, PCAOB guidance for SOX and the ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting.
- COSO 2013
- COBIT 2019
- SOX 404
- ICAI IFC Guidance Note
- Companies Act, 2013
4–6
weeks for a typical ITGC cycle
6
structured audit phases
100%
exceptions evidenced
01
- Week 1
Scope and risk assessment
Financially significant applications, databases and infrastructure identified with your finance and audit teams.
Key activities
- Identify in-scope applications and supporting layers
- Map ITGCs to financial reporting risks
- Agree testing period and sample sizes
- Output: ITGC scoping memo
02
- Weeks 1–2
Walkthroughs
Each ITGC process walked through end to end with control owners to confirm understanding.
Key activities
- Walk through access, change and operations processes
- Document key controls and control owners
- Identify key reports and system-generated evidence
- Output: Process narratives and control matrix
03
- Weeks 2–3
Design testing
Controls assessed for whether they are designed to prevent or detect errors in financial data.
Key activities
- Assess control design against risk
- Validate completeness and accuracy of key reports
- Identify design deficiencies early
- Output: Design effectiveness results
04
- Weeks 3–5
Operating effectiveness testing
Sample-based testing across the period confirms controls operated as designed.
Key activities
- Test user provisioning, removal and access reviews
- Test change approvals, testing and deployment
- Test backups, job monitoring and incident handling
- Output: Evidenced test workpapers
05
- Weeks 5–6
Evaluate and report
Exceptions evaluated for severity, compensating controls and impact on financial reporting.
Key activities
- Classify deficiencies by severity
- Assess compensating and mitigating controls
- Present results to finance and audit committee
- Output: ITGC audit report
06
- Before year-end
Remediate and retest
Deficiencies remediated early enough to be retested before the financial year closes.
Key activities
- Agree remediation actions and owners
- Retest remediated controls over a sufficient period
- Update the deficiency log and conclusions
- Output: Remediation retest results
Effort distribution
Where the audit time goes
Most of the effort goes into sample-based testing of how controls operated across the period. Percentages are indicative for a typical annual ITGC cycle.
Quality built into every phase
Complete and accurate evidence
System reports are validated before samples are drawn from them.
Consistent severity
Deficiencies classified using a clear, documented framework.
Reviewed workpapers
Every workpaper is reviewed before it is shared with auditors.
Timed for year-end
Testing planned so remediation can be retested in time.
Engagement options
Choose the ITGC Support That Fits Your Year
Every option follows the same testing approach, so work can be relied on as your programme matures.
ITGC readiness assessment
Design review and walkthroughs to identify gaps before statutory or SOX testing begins. Best for first-year SOX, IPO readiness and new ERP implementations.
Full ITGC audit
Design and operating effectiveness testing with auditor-ready workpapers. Best for annual IFC and SOX management testing.
Co-sourced internal audit
Quarterly or rolling ITGC testing delivered as part of your internal audit function. Best for groups with multiple entities and ERP instances.
Not sure which option you need?
Our specialists will recommend an approach based on your systems, reporting framework and audit timeline.
Deliverables
Outputs for Finance, Internal Audit and Statutory Auditors
Clear conclusions for management and structured evidence your auditors can review and rely on.
Executive summary
Overall ITGC conclusion, deficiency summary and financial reporting impact for the CFO and audit committee.
Risk and control matrix
Documented ITGCs mapped to risks, systems, owners and test procedures.
Test workpapers
Sampled evidence, test steps and results organised for auditor review.
Deficiency log and remediation plan
Classified deficiencies, compensating controls, actions, owners and retest results.
Supports your compliance and assurance requirements
- SOX 404
- Internal Financial Controls
- Companies Act, 2013
- Ind AS reporting
- COSO 2013
- COBIT 2019
- ISO/IEC 27001
- SOC 1
- SOC 2
- SEBI LODR
iSpyCyber provides independent ITGC testing and readiness support. Statutory audit opinions on financial statements and internal financial controls are issued by the company’s appointed statutory auditors.
ITGC audits for every industry
The basics
What are IT general controls?
IT general controls are the foundational controls over access, change management, IT operations and system development that support the reliability of applications and data, particularly those used for financial reporting.
Why do ITGCs matter for financial reporting?
Auditors rely on automated controls and system-generated reports. If ITGCs are weak, that reliance is undermined, which can increase audit effort or lead to reported deficiencies.
Do you support SOX and IFC requirements?
Yes. We test ITGCs in line with SOX 404 and the Internal Financial Controls requirements of the Companies Act, 2013, and prepare workpapers that management and auditors can use.
Working with us
Can our statutory auditor rely on your work?
Reliance is decided by your statutory auditor. We structure scope, sampling and workpapers so that reliance is practical, and can agree the approach with them upfront.
Which systems do you cover?
We cover ERPs such as SAP, Oracle and Microsoft Dynamics, plus other financially significant applications and their supporting databases, operating systems and cloud platforms.
When should ITGC testing start?
Ideally mid-year. Interim testing gives time to remediate and retest deficiencies before the financial year closes.
Get started
Trusted Systems.
Trusted Numbers.
Talk to our specialists about an ITGC audit scoped to your financial systems and reporting timeline.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries