IT Audit (ITGC): What IT Systems Auditors Check

Financial statement auditors increasingly ask not only about the numbers, but also about the systems in which those numbers are produced. If ERP, accounting or banking systems are poorly managed, the auditor cannot rely on their data. This is where an IT audit comes in – more precisely, an audit of IT General Controls (ITGC).

What is ITGC?

ITGC are the core controls that ensure systems relevant to financial data operate reliably and that data is complete, accurate and protected from unauthorised changes. They apply to all key systems, whether they run on your own servers or in the cloud.

Four areas the auditor checks

1. Access management – who grants rights, whether they are approved, whether they are revoked on time for leavers, how administrator accounts are managed and whether rights are reviewed periodically.
2. Change management – whether system changes are logged, tested and approved before deployment, and whether development and production environments are separated.
3. IT operations – backups and restore tests, monitoring of scheduled jobs, incident logging.
4. System development and acquisition – how new systems are selected, implemented and accepted, and whether data migration has been verified.

IT audit, IT systems audit and ITGC: what is the difference?

“IT audit” is a broad term: it can cover IT governance, cybersecurity and compliance with NIS2 or DORA requirements. An IT systems audit usually assesses whether a specific system (ERP, accounting, CRM) operates reliably and securely. An ITGC audit is part of these, focused on controls relevant to financial reporting. In practice they are often performed together, and an internal IT audit helps you prepare for the external auditor in advance. If security gaps are your main concern, consider a cybersecurity audit.

Most common findings

• Shared administrator accounts.
• Active accounts of former employees.
• No evidence that access rights were reviewed.
• Changes deployed without approval or testing.
• Backups are made, but restores are never tested.
• Outsourced provider controls not verified – no SOC reports or contractual requirements.

How to prepare?

The golden rule: a control you cannot evidence does not exist for the auditor. Therefore:

• Make a list of key systems and name their owners.
• Introduce a simple access granting and review process (e.g. quarterly).
• Log changes and their approvals in one place.
• Test data restoration at least once a year and record the result.
• Carry out an internal review before the external audit.

In the financial sector, ITGC are closely linked to DORA requirements, so well-organised controls help on two fronts at once. AuraGroup performs independent ITGC and internal IT audits. More about IT audit and DORA or contact us.