IT General Controls for the CPA BAR Exam
Understand IT general controls tested on the CPA BAR section. Covers access controls, change management, computer operations, system development, and network security.
What Are IT General Controls?
IT general controls (ITGCs) are policies and procedures that apply broadly to all information systems within an organization. They support the effective functioning of application controls by ensuring the integrity of the IT environment in which those applications operate. If IT general controls are weak, application controls cannot be relied upon even if they are well-designed.
On the CPA BAR exam, IT general controls are tested as part of the information technology and data analytics content area. You should understand the major categories of ITGCs, their purpose, and how weaknesses in these controls can affect financial reporting and business operations.
Categories of IT General Controls
Logical Access Controls
Logical access controls restrict who can access computer systems, applications, and data. Key controls include user authentication (passwords, multi-factor authentication, biometrics), authorization (ensuring users have access only to the data and functions they need for their jobs), and user access administration (procedures for granting, modifying, and revoking access).
The principle of least privilege states that users should be granted only the minimum access necessary to perform their job functions. Role-based access control (RBAC) assigns permissions based on job roles rather than to individual users, simplifying administration and reducing the risk of excessive access. Regular access reviews verify that user access remains appropriate as roles change.
Change Management Controls
Change management controls ensure that changes to IT systems, applications, and infrastructure are authorized, tested, and implemented in a controlled manner. Key elements include formal change request and approval procedures, separation of development, testing, and production environments, testing in a non-production environment before deployment, documentation of changes and approvals, and post-implementation review.
Without effective change management, unauthorized or untested changes could introduce errors or security vulnerabilities into production systems. Emergency changes should follow an abbreviated process with after-the-fact documentation and approval.
Computer Operations Controls
Computer operations controls ensure that systems operate as intended and that data is properly processed and stored. Key controls include job scheduling and monitoring (ensuring batch processes run correctly and on time), backup and recovery procedures (regular backups, offsite storage, and tested recovery plans), incident management (procedures for identifying, reporting, and resolving operational incidents), and capacity planning (ensuring systems have adequate resources to handle current and future workloads).
System Development Life Cycle (SDLC) Controls
SDLC controls govern the process of developing and implementing new systems or making major modifications to existing ones. The typical phases include planning, requirements analysis, design, development, testing, implementation, and maintenance. Controls at each phase include formal approvals to proceed, involvement of end users and management, adequate testing (unit testing, integration testing, user acceptance testing), and documentation.
Physical Security Controls
Physical security controls protect IT hardware and infrastructure from unauthorized physical access, theft, and environmental hazards. These include locked server rooms, environmental controls (temperature, humidity, fire suppression), uninterruptible power supplies, visitor logging, and surveillance systems.
Network Security Controls
Network security controls protect data as it travels across networks and prevent unauthorized access to network resources. Key controls include firewalls (filtering traffic between trusted and untrusted networks), intrusion detection and prevention systems (monitoring for suspicious activity), encryption (protecting data in transit and at rest), virtual private networks (secure remote access), and network segmentation (isolating sensitive systems from the general network).
Segregation of Duties in IT
Proper segregation of duties in the IT environment ensures that no single individual can both create and implement changes to production systems, or both initiate and authorize transactions. Key segregations include separating system development from computer operations, separating database administration from application development, and separating security administration from other IT functions.
When segregation of duties is not feasible due to limited staff, compensating controls such as management review, audit trails, and supervisory monitoring become essential.
Impact of ITGC Weaknesses
Weaknesses in IT general controls can undermine the reliability of financial reporting. If access controls are inadequate, unauthorized users might modify financial data. If change management is weak, untested program changes might introduce processing errors. If backup procedures are inadequate, data loss could affect the completeness and accuracy of financial records. Auditors evaluate ITGCs before testing application controls because the effectiveness of application controls depends on the IT environment.
Exam Preparation Tips
- Know the major categories of IT general controls and examples of specific controls within each category.
- Understand the principle of least privilege and role-based access control.
- Be familiar with the phases of the system development life cycle and the controls at each phase.
- Know why IT general controls must be effective before application controls can be relied upon.
- Understand key segregation of duties requirements in the IT environment.
Practice What You Learned
Study with 1,200+ flashcards and 140 practice exams across all 4 CPA sections.