What are IT general controls (ITGC)?
- Term
- IT general controls
- Meaning
- IT general controls are controls over the systems themselves, such as who can access them and how programs change, that automated financial controls rely on.
IT general controls (ITGC) are the controls over a company’s systems as a whole. They cover who can get into the systems, how programs change, how systems run day to day, and how new ones are built. The term comes up in audits under section 404 of the Sarbanes-Oxley Act (SOX). Many controls over financial reporting are automated, and whether they work often depends on how the systems they run on are controlled.
Where does the term come from?
Section 404(a) of SOX (15 U.S.C. 7262) has the SEC require an annual report from management on internal control over financial reporting. Under section 404(b), the company’s outside auditor attests to management’s assessment. Section 404(c) exempts companies that are neither large accelerated filers nor accelerated filers from the auditor’s part.
The statute doesn’t mention IT general controls. The SEC’s 2007 guidance for management (Release No. 33-8810) uses the term. So does the standard the auditor follows, Auditing Standard No. 5 of the Public Company Accounting Oversight Board (PCAOB). That standard was renumbered AS 2201 in a 2015 reorganization that took effect on December 31, 2016.
Why do auditors care about them?
Some controls are built into software. The SEC gives examples such as automated matching, error checking and edit checks. These are called application controls. The SEC guidance says the proper and consistent operation of such controls “often depends upon effective IT general controls.” If anyone can change the program or the data underneath, an automatic check proves little.
AS 2201 builds this into the auditor’s view of risk. Paragraph 47 says an automated control is generally lower risk if the related IT general controls are effective. Paragraph B29 lets the auditor rely on last year’s test of an automated control without repeating it. That holds only when the control hasn’t changed and “general controls over program changes, access to programs, and computer operations” are effective and still being tested.
What are the four areas?
The SEC guidance names four example areas:
- Program development: how new systems or major features are built and approved before use.
- Program changes: how changes to existing software are requested, tested and moved into use.
- Computer operations: how systems are run, such as scheduled jobs, backups and handling of failures.
- Access to programs and data: who can sign in to the systems and what each person can do there.
The SEC adds that these are examples, not a list that fits every company. Management needs to evaluate only the IT general controls that other financial reporting controls need in order to work. IT general controls that mainly concern the efficiency or effectiveness of operations, and don’t address financial reporting risk, can be left out.
Where does account access fit?
Access to programs and data is the area that reaches everyday staff. It covers giving people access when they start, removing it when they leave or change roles, reviewing who still has it, and controlling admin rights. With a shared login, a system’s log shows the account name, not the person who used it, so access can’t be tied to one person.
How an auditor tests ordinary user access is covered in How auditors test user access controls in a SOX audit. Admin accounts are covered in What a SOX audit asks about admin accounts, and which records to keep.
What happens when one fails?
AS 2201 calls it a deficiency when a control’s design or operation doesn’t let people prevent or detect misstatements on time. The auditor then judges how severe it is. The most serious level is a material weakness: a reasonable possibility that a material misstatement in the financial statements won’t be prevented or detected on time. The SEC’s rules under section 404 provide for public disclosure of material weaknesses.
Frequently asked questions
Does the Sarbanes-Oxley Act use the term IT general controls?
No. Section 404 speaks of internal control over financial reporting. The term appears in the SEC's 2007 guidance for management and in the PCAOB's audit standard, AS 2201.
What's the difference between IT general controls and application controls?
An application control runs inside one system, such as an automatic match or error check. IT general controls cover the system around it, such as access and program changes.
Does every company have to evaluate all four areas?
No. The SEC says management evaluates only the IT general controls that other financial reporting controls need in order to work, and that the four areas are examples.
Do private companies need IT general controls for SOX?
Section 404 works through the annual reports that companies file with the SEC. A company that doesn't file them isn't covered by section 404.
How Junify handles this
- Doing this by hand
- You map each requirement to how your team actually works. You keep a record an auditor can review: which accounts exist, who may use each one, and who used it. And you reread the rules each time they change.
- With Junify
- For the business systems you add to it, Junify keeps the list of who may sign in to each account and records each sign-in by person, even on a shared login. People verify on their own phone, and Junify fills in the password without showing it, so removing someone's access in Junify doesn't mean a new password for everyone else. The record exports as CSV.
Sources
- 15 U.S.C. 7262, Management assessment of internal controls (Sarbanes-Oxley Act section 404)
- SEC Release No. 33-8810, Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting (2007)
- PCAOB Auditing Standard No. 5 (now AS 2201), as filed with the SEC: Release No. 34-55876, 72 FR 32340 (June 12, 2007)
- SEC Release No. 34-75251, Notice of Filing of Proposed Rules to Implement the Reorganization of PCAOB Auditing Standards, 80 FR 36602 (June 25, 2015)
- SEC Release No. 34-75935, Order Granting Approval of Proposed Rules to Implement the Reorganization of PCAOB Auditing Standards (September 17, 2015)
-
What access logs need to show when you decide whether to report a breach
Logs show whether data was viewed, by whom, for how many people and since when. HIPAA presumes a breach unless you can show a low probability of compromise.
-
Password sharing and the federal anti-hacking law (CFAA)
The CFAA turns on whether the system's owner allowed the access. In Nosal, former employees using a current employee's login acted without authorization.
-
What CIS Controls 5 and 6 (v8.1) ask of your accounts
Control 5 asks for an account inventory, disabled dormant accounts and separate admin accounts. Control 6 covers granting and revoking access, and MFA.