IT general controls — access management, change management, IT operations and program development — are the foundation statutory and internal auditors rely on.
We test the design and operating effectiveness of your ITGCs across key applications, databases and infrastructure.
Objectives
- Test logical access and privileged access management
- Evaluate change and release management
- Review backup, job scheduling and IT operations
- Assess program development and vendor controls
Methodology
01
Planning
- Define scope, applicable requirements and critical systems
- Agree audit plan, sampling approach and timelines
02
Fieldwork
- Review of policies, procedures and governance
- Testing of technical and operational controls
- Interviews with process owners and evidence verification
03
Technical testing
- Vulnerability assessment and penetration testing where in scope
- Configuration review of servers, databases and network devices
04
Reporting
- Observations rated by risk with recommendations
- Management responses and follow-up review
Deliverables
Audit plan and scope
Audit report with risk-rated observations
VAPT report where in scope
Remediation plan and follow-up review