IT general controls audit
An independent test of the controls that keep your systems and data reliable: who has access, how changes are made and whether day-to-day operations run as described.
Suited to: Growing organisations, finance teams and external audit preparation
Why it matters
Financial reporting, customer data and day-to-day decisions all depend on systems behaving as expected. IT general controls give you, your auditors and your customers grounds to trust that they do. Weaknesses in this area are among the most common findings in external audits and customer due diligence, and most are straightforward to resolve once they have been clearly identified.
When you might need it
- Your external auditor or a major customer asks for evidence of IT controls
- You are replacing a core system or moving services to the cloud
- Rapid growth has outpaced your processes
- Recurring incidents suggest that controls are not operating as intended
What we review
- User access: joiners, movers and leavers
- Privileged and administrator accounts
- Change and release management
- Backup, recovery and scheduled job monitoring
- Cloud and SaaS administration
- Logging and monitoring
What you receive
- One-page executive summary
- Findings ranked by risk, each supported by evidence
- Practical, proportionate remediation plan
- Optional re-test to confirm remediation
Timescale and fees
Typically 5–10 working days of fieldwork over two to four weeks, depending on the number of systems in scope. Each engagement is quoted at a fixed price for an agreed scope, and the timetable is confirmed in your proposal before any work begins.
Ways to engage
- Single review: One focused engagement with a fixed scope and price.
- Multi-area assurance: Several related areas reviewed together, with one consolidated report.
- Support for your audit team: Specialist IT audit capacity for an existing internal audit function.
- Annual assurance programme: A planned cycle of reviews that builds year-on-year evidence.
Independence
We never audit systems or services that we have designed, implemented or operated. Any existing relationship, including with our sister services, is declared in writing before work begins.
Questions
What are IT general controls?
IT general controls are the foundational controls over access, change and operations on which every key system relies. If they are weak, the reliability of the data and reports those systems produce cannot be assumed.
How long does an IT general controls audit take?
For most small and medium-sized organisations, fieldwork takes five to ten working days, spread over two to four weeks, depending on the number of systems in scope. We confirm the timetable and a fixed price before any work begins.
Next step
The initial consultation is free and without obligation. We reply within one working day with a suggested scope.