IT General Controls, or ITGC, are the controls in place for a IT system to make sure the IT systems are appropriately accessed and managed. The ITGCs allow us to place reliance on the output of systems. ITGC audits usually review the controls in place for IT systems that have an affect on financial statements. So what makes a good IT general control?
Below we share some of the aspects we believe make for a good ITGC.
Formally defined - A control should be formally defined and have management commitment to ensure the control is enforceable and effective. If the control is not well defined and does not have management backing, most likely the control will not be successful and the risk that a threat will realize will greatly increase.
Documented - The ITGC should be documented in either a policy or procedure document that is published and available to the persons to which it applies in the organisation. If the people do not know about the control or cannot reference it, they will not follow or adhere to it!
Effective - The ITGC should be operating and effective! This seems straight forward, but often organisations implement controls just for the sake of implementing controls or a control that used to be effective is not effective any more due to change in the environment. Ineffective controls are just a waste of time and money and serves no benefit to the organisation.
Evidenced - A ITGC that is implemented and operating effectively should be tracked and evidenced to show that the control is effective. This will help when the control is audited by auditors (internal or external auditors.
Measured - To be able to track the effectiveness of a ITGC, it should be measurable. This is not always easy for some controls as not all controls' output can be stated numerically. For such controls we would recommend measuring the testing of operating effectiveness on a periodic basis - daily or weekly or monthly, where the successful testing of the control each period would indicate effectiveness.
Reviewed - Controls must be reviewed regularly to ensure that the controls are still operating effectively and to identify potential improvements.
Audited - Independent auditors should audit controls on a regular basis to provide assurance that controls are defined, implemented and operating effectively. This will give management the assurance that the control environment is appropriate, implemented as designed and operating effectively.
Conclusion
Effective ITGC makes sure the IT systems required to run the organisation efficiently and has a financial effect are secure and appropriate.
And finally, if you want to know more about ITGC or how to test ITGC please check out IS Risk Academy at http://www.isriskacademy.com/
Use and distribution of this article is subject to our Publisher Guidelineswhereby the original author's information and copyright must be included.
