IT General controls when implemented by the management provide reasonable assurance to support the functioning of application and IT dependant manual controls. These controls span over the IT environment, computer operations, program access and data as well as program changes. There are three control objectives defined for the purpose of evaluation of ITGCs. These are Manage Changes, Logical Access Management (LAM), and Other ITGCs (including IT Operations).
The procedures to be implemented for the same are as follows:
- To ensure that all changes to applications are properly requested, authorized, tested, and approved before they are implemented to ensure intended functionality. (Manage Changes)
- To determine only authorized persons and applications have access to data and transactions, and that too only to perform their specifically authorized functions and no extra access has been granted to person or application. (Logical Access)
- Job scheduling, performing back-up and recovery, monitoring processing deviations, and performing problem and incident reporting monitoring. (Other ITGCs)
We perform tests of ITGCs on which we are relying to obtain evidence that they are operating effectively. However, there may be situations in which we would not perform some or all of the tests of ITGCs. When relying on ITGCs, it is essential to document how the ITGC objectives were met if we determine not to perform the primary control procedures some of which are listed as follows:
Manage Changes:
- Segregation of incompatible duties exists within the manage change environment
Logical Access:
- General system security settings are appropriate
- Password settings are appropriate
- Access to privileged IT functions is limited to appropriate individuals
- Access to system resources and utilities is limited to appropriate individuals
- User access is authorized and appropriately established
- Physical access to computer hardware is limited to appropriate individuals
- Logical access process is monitored
- Segregation of incompatible duties exists within the logical access environment
Other ITGCs:
- Financial data has been backed-up and is recoverable
- Deviations from scheduled processing are identified and resolved
- IT operations problems or incidents are identified, resolved, reviewed, and analyzed in a timely manner
Conclusion:
IT General controls affect almost all financial audits because of their significance and ubiquity. These areas could apply to any financial audit client and should be assessed as to their level of applicable risk to audit objectives in all financial audits.
Be the first to rate this post
- Currently 0/5 Stars.
- 1
- 2
- 3
- 4
- 5