IT General Controls (ITGCs)
IT general controls are foundational to the ISC section of the CPA exam. ITGCs are policies and procedures that apply broadly to information systems and support the effective functioning of application controls. Weak ITGCs can undermine all application-level controls.
The Four Categories of ITGCs
| Category | Purpose | Key Controls |
|---|
| Access Controls | Restrict access to systems and data to authorized users | User authentication (passwords, MFA); authorization (role-based access); physical access controls (server rooms); privileged access management; periodic access reviews |
| Change Management | Ensure modifications to systems are properly authorized, tested, and implemented | Change request documentation; impact analysis; separation of duties (dev/test/prod); testing and approval; emergency change procedures; post-implementation review |
| Program Development | Ensure new systems are properly designed, developed, and tested | SDLC methodology; requirements documentation; design reviews; code reviews; testing phases (unit, integration, UAT); go-live approval |
| Computer Operations | Ensure systems operate reliably and continuously | Job scheduling and monitoring; backup and recovery; incident management; problem management; capacity planning; business continuity/disaster recovery |
Access Control Principles
| Principle | Description | Implementation |
|---|
| Least Privilege | Users receive only the minimum access necessary for their job | Role-based access, need-to-know basis |
| Segregation of Duties | No single person can authorize, record, and maintain custody | Separate developer access from production access; separate system admin from security admin |
| Defense in Depth | Multiple layers of security controls | Firewalls + IDS + encryption + access controls + monitoring |
| Need to Know | Access limited to information required for specific duties | Data classification and access restrictions by sensitivity level |
Authentication Methods
| Factor | Type | Examples |
|---|
| Something you know | Knowledge factor | Password, PIN, security questions |
| Something you have | Possession factor | Smart card, hardware token, mobile authenticator app |
| Something you are | Biometric factor | Fingerprint, facial recognition, iris scan, voice recognition |
Multi-factor authentication (MFA) requires two or more different factors. Using two passwords is NOT MFA (both are knowledge factors).
Change Management Process Flow
- Change request submitted with business justification
- Impact analysis and risk assessment performed
- Change reviewed and approved by change advisory board (CAB)
- Change developed and unit tested in development environment
- Integration and regression testing in QA/staging environment
- User acceptance testing (UAT) completed and signed off
- Deployment plan and rollback plan documented
- Migration to production approved and executed
- Post-implementation review confirms change works as intended
Backup and Recovery
| Backup Type | What is Backed Up | Restore Speed | Storage Required |
|---|
| Full backup | All data | Fastest restore | Most storage |
| Incremental backup | Data changed since last backup of any type | Slowest restore (need full + all incrementals) | Least storage |
| Differential backup | Data changed since last full backup | Moderate restore (need full + latest differential) | Moderate storage |
Test your ITGC knowledge with ISC mini exams and review with CPA flashcards. Sign up free to track your progress.