All 18 Internal Controls Evaluation questions
More in Internal Controls Evaluation
When does the auditor decide to test controls versus take a fully substantive approach? How do you document the understanding of internal controls? What are compensating controls and how do they affect the audit? What is the difference between a deficiency, a significant deficiency, and a material weakness? How does management override of controls create risk, and how do auditors address it? How do you evaluate controls in a system that uses a service organization (SOC reports)? What is the auditor's responsibility for reporting internal control deficiencies?
Advertisement
Back to results for “Internal Controls Evaluation”
Auditing & Assurance › Internal Controls Evaluation

What are IT general controls (ITGCs) and why do they matter?

Advanced

Answer

ITGCs are controls over the IT environment that support reliable functioning of application controls—covering access security, change management, program development, and computer operations. If ITGCs are weak (e.g., poor access controls), automated application controls and system-generated data can't be relied upon, increasing risk and required substantive work.
Real-world example Weak access controls mean the auditor can't rely on the system's automated three-way match, so more substantive testing is needed.

Common follow-ups: What areas do ITGCs cover? | How do weak ITGCs affect application controls?

Audit Evidence & Procedures Audit Risk & Materiality Internal Controls Evaluation
All 18 Internal Controls Evaluation questions