{"id":3555,"date":"2026-10-21T09:00:00","date_gmt":"2026-10-21T09:00:00","guid":{"rendered":"https:\/\/auragroup.lt\/?p=3555"},"modified":"2026-10-30T07:01:32","modified_gmt":"2026-10-30T07:01:32","slug":"itgc-auditas-ka-tikrina-it-auditorius","status":"publish","type":"post","link":"https:\/\/auragroup.lt\/en\/itgc-auditas-ka-tikrina-it-auditorius\/","title":{"rendered":"IT Audit (ITGC): What IT Systems Auditors Check"},"content":{"rendered":"

Financial statement auditors increasingly ask not only about the numbers, but also about the systems in which those numbers are produced. If ERP, accounting or banking systems are poorly managed, the auditor cannot rely on their data. This is where an IT audit<\/a> comes in \u2013 more precisely, an audit of IT General Controls (ITGC).<\/p>\n

What is ITGC?<\/h2>\n

ITGC are the core controls that ensure systems relevant to financial data operate reliably and that data is complete, accurate and protected from unauthorised changes. They apply to all key systems, whether they run on your own servers or in the cloud.<\/p>\n

Four areas the auditor checks<\/h2>\n
    \n
  1. Access management<\/strong> \u2013 who grants rights, whether they are approved, whether they are revoked on time for leavers, how administrator accounts are managed and whether rights are reviewed periodically.<\/li>\n
  2. Change management<\/strong> \u2013 whether system changes are logged, tested and approved before deployment, and whether development and production environments are separated.<\/li>\n
  3. IT operations<\/strong> \u2013 backups and restore tests, monitoring of scheduled jobs, incident logging.<\/li>\n
  4. System development and acquisition<\/strong> \u2013 how new systems are selected, implemented and accepted, and whether data migration has been verified.<\/li>\n<\/ol>\n

    IT audit, IT systems audit and ITGC: what is the difference?<\/h2>\n

    \u201cIT audit\u201d is a broad term: it can cover IT governance, cybersecurity and compliance with NIS2 or DORA requirements. An IT systems audit usually assesses whether a specific system (ERP, accounting, CRM) operates reliably and securely. An ITGC audit is part of these, focused on controls relevant to financial reporting. In practice they are often performed together, and an internal IT audit helps you prepare for the external auditor in advance. If security gaps are your main concern, consider a cybersecurity audit<\/a>.<\/p>\n

    Most common findings<\/h2>\n