IT General Controls (ITGC): Categories, Examples And Audit Checklist

IT General Controls (ITGC) are the policies, procedures, and activities that organizations use to protect and manage their IT environment. They cover key areas from daily operations to system changes, ensuring that information stays secure, accurate, and available.

Why do ITGC matter? Because they reduce risks like fraud, errors, and unauthorized access. They also give companies and auditors confidence that business information can be trusted.

In this article, we’ll define ITGC, show examples for each category, explain how they connect to the Sarbanes-Oxley Act (SOX) and audits, and share an ITGC audit checklist to strengthen them in your organization.

What are IT General Controls (ITGC)?

IT General Controls (ITGC) are the company-wide policies, procedures, and recurring activities that govern who can access systems and data, how changes reach production, how new systems are built, and how daily IT operations such as backups run, so the information those systems produce stays secure, accurate, and available. Because they are documented and performed on a schedule, auditors can test whether they work.

They are usually grouped into four key categories. Each one is developed with examples in the next section:

• Access controls: making sure only authorized people can use systems and data.
• Change Management: reviewing and approving modifications before they go live.
• System development: setting standards for acquiring, building, or implementing systems.
• IT operations: daily processes like monitoring, backups, and recovery.

For example, in access controls, an ITGC could require manager approval and multi-factor authentication before activating a new user account.

Modern standards also highlight the role of ITGC in safeguarding data integrity, confidentiality, and availability. That’s why you’ll often see data backup, recovery, and protection explicitly mentioned as part of ITGC. These fall under IT operations but get special attention because data is the core of both business processes and audits.

These categories appear in almost every organization, but how they are implemented depends on the company’s size, industry, and regulatory requirements.

General IT controls vs. application controls

The main difference between ITGC and application controls is their scope.

• ITGC cover the entire IT environment. They ensure that systems overall are secure, reliable, and well-managed. Examples include access management, change approval processes, and backup policies.
  
  
• Application controls apply to a specific system or process. They validate that the data handled by that application is correct. For example, an accounting system may block journal entries that don’t balance, or a payroll system may prevent payments with negative values.

Both types of controls work together: ITGC create a trusted foundation, and application controls ensure accuracy inside each application.

The 4 categories of IT General Controls, with examples

Each category covers a different way an IT environment can fail and the controls that prevent it. The U.S. Securities and Exchange Commission (SEC) names the same four areas in its guidance for management on internal control over financial reporting: program development, program changes, computer operations, and access to programs and data.

Access controls

Access controls decide who can sign in to each system and what each person can do once inside. They cover the whole account lifecycle, from granting access to adjusting it when someone changes roles and removing it when someone leaves, with extra protection for privileged and administrator accounts.

• User access reviews: regularly checking that only active employees have access to critical systems, with the reviewer’s sign-off on what stays and what gets removed.
• Access removal at offboarding: disabling every account of a departing employee on their last day, starting from the exit date recorded by human resources (HR), so no access outlives the job.

Change Management

Change Management controls cover every modification to systems already in production: code, patches, configuration, and infrastructure. Each change is requested, tested, approved, and recorded before it goes live, so nobody can alter a system that feeds business data without leaving a trace.

• Change approval process: requiring documented testing and manager sign-off before new code, patches, or system changes go live.
• Segregation of duties for deployments: the developer who writes a change can’t move it to production, and emergency changes are reviewed and approved right after they’re applied.

System development

System development controls apply when the company acquires, builds, or implements a new system, or replaces a major one. They make sure security and data requirements are defined from the start and that nothing reaches production without testing and the business owner’s approval.

• Testing and user acceptance sign-off: a documented test plan and the business owner’s formal acceptance before a new system goes live.
• Data migration checks: reconciling record counts and balances between the old and the new system, with a sign-off that the data moved completely and accurately.

IT operations

IT operations controls keep systems running and data recoverable day to day. They cover scheduled jobs and monitoring, backups and recovery, incident handling, and the physical protection of the places where systems run.

• Data backup and recovery: scheduling daily backups and testing recovery procedures to ensure business continuity in case of an incident.
• Incident management: logging every incident that affects in-scope systems with its priority, owner, and resolution, so recurring failures surface and get fixed.

Why do you need ITGC?

IT General Controls matter because they keep a company’s IT environment secure, reliable, and under control. They reduce the chance of errors, fraud, and disruptions, while making sure that technology consistently supports business operations.

They also help organizations protect sensitive data, comply with regulations, and build trust with customers and partners. Strong ITGC make audits smoother and give leadership confidence that systems and information can be trusted.

Benefits of strong ITGC

• Protect sensitive data: safeguard consumer, financial, and healthcare information.
• Prevent breaches and fraud: minimize the risk of internal or external attacks.
• Support compliance: align with SOX, the Health Insurance Portability and Accountability Act (HIPAA), ISO 27001, and other regulations and standards.
• Ensure data reliability: improve the accuracy of financial reporting and business information.
• Maintain operational continuity: keep backups, monitoring, and recovery processes in place.
• Build trust and reputation: show customers and partners that systems are secure.

ITGC and SOX compliance

Section 404 of SOX requires every company that files annual reports with the SEC to report on its internal control over financial reporting (ICFR). Under Section 404(a), management assesses every year whether that internal control is effective. Under Section 404(b), the external auditor also reports on it, a requirement that applies to accelerated and large accelerated filers and leaves out smaller reporting companies with annual revenues under $100 million.

ITGC come into the picture because financial data is created, calculated, and stored in IT systems. Under Auditing Standard (AS) 2201, the standard of the Public Company Accounting Oversight Board (PCAOB), the auditor’s objective is to express an opinion on the effectiveness of ICFR, and the standard points to general controls over program changes, access to programs, and computer operations as the base that automated controls rely on. In practice, auditors test the ITGC around the applications, databases, operating systems, and infrastructure that support financial reporting, so the scope is narrower than the whole IT environment.

IT General Controls compliance frameworks

When people talk about ITGC frameworks, they usually mean broader IT or security frameworks that include IT General Controls as part of their structure.

There isn’t a single framework created only for ITGC. Instead, organizations use established frameworks (like COBIT, COSO, ISO 27001, NIST, or ITIL) and adapt their ITGC to align with those requirements. In practice, this means:

• Frameworks set the rules and expectations (for example, requiring proper access management or change controls).
• ITGC are the policies, procedures, and activities companies implement to meet those expectations in their IT environment.

That’s why ITGC are often described as the building blocks of compliance. They map directly to framework requirements and give auditors measurable evidence that controls are in place and working.

#1: COBIT

COBIT (Control Objectives for Information and Related Technologies) is one of the most widely used frameworks for IT Management and controls. 

It provides detailed objectives for how IT processes should support business goals while keeping systems secure and compliant. Companies often map their ITGC directly to COBIT requirements, especially in regulated industries.

#2: COSO

The COSO framework (Committee of Sponsoring Organizations of the Treadway Commission) is broader, covering internal controls across the entire organization. 

It defines components like control environment, risk assessment, and monitoring. For organizations in heavily regulated or complex environments, implementing COSO often involves working with enterprise risk management consulting partners who can map existing controls against the framework and identify gaps before an audit. ITGC align with COSO by showing how technology risks are managed within the overall internal control system.

#3: ISO 27001

ISO 27001 is an international standard for information security. It sets requirements for an Information Security Management System (ISMS), including Access Management, system updates, and data protection. Many ITGC, like backups, authentication, and Change Management, are directly tied to ISO 27001 controls.

#4: NIST

The NIST Cybersecurity Framework (CSF) offers guidelines to govern cybersecurity risk and to identify, protect against, detect, respond to, and recover from cyber threats. Version 2.0, released in February 2024, added Govern as its sixth function.

ITGC help organizations meet NIST requirements by implementing practical controls such as intrusion detection, access restrictions, and recovery procedures. 

#5: ITIL

ITIL (formerly known as Information Technology Infrastructure Library) focuses on best practices for IT Service Management. 

While not a compliance framework, it guides how IT operations, Change Management, and service delivery should work. ITGC often align with ITIL processes to ensure consistency and control across the IT environment.

How to implement IT General Controls

Implementing ITGC doesn’t have to be overwhelming. The key is to start small, focus on the most important risks, and build consistency. Here are the basic steps:

1. Define scope: identify which systems, processes, and data your ITGC need to cover.
2. Choose a framework: use standards like COBIT, COSO, or ISO 27001 to guide your control design.
3. Design controls: translate requirements into clear policies, procedures, and recurring activities.
4. Test and adjust: make sure each control works as intended, then refine it if needed.
5. Monitor continuously: review ITGC regularly to keep them effective as technology and risks evolve.

ITGC audit checklist

An ITGC audit checklist lists the evidence an auditor will ask for in each category, so it can be gathered before fieldwork starts. Auditors test samples drawn from complete populations (every change, every departure, every new account in the period), so each item below should come from a system of record and cover the whole audit period.

When access requests, changes, incidents, and inventory live in the tools where the work happens, most of this checklist becomes a report you pull at audit time. The rest comes down to keeping sign-offs dated and stored in one place.

How InvGate can strengthen your IT General Controls audit

An ITGC audit is a specific IT audit that checks whether the controls in place across your IT environment are properly designed and working as intended. Organizations perform these audits to reduce risk, prepare for compliance reviews, and give leadership and stakeholders confidence in their systems.

They can be done internally by the company’s own audit or compliance team, or externally by independent auditors for regulatory purposes. And you can use a specific IT audit software or combine an IT Asset Management tool with an IT Service Management software.

Either way, InvGate Asset Management and InvGate Service Management make the process faster and easier by providing clear evidence of your IT environment and documenting the policies and procedures that auditors expect to see. Two capabilities cover most of the checklist:

• Change approvals and records in InvGate Service Management. Every change runs through approval workflows built without code, whether sequential, parallel, or multilevel, and goes to the change advisory board (CAB) when its risk calls for it. Each change keeps its own record and audit trail, which is the evidence auditors sample for Change Management.
  
  
• Inventory and software control in InvGate Asset Management. The hardware and software inventory stays current through the Agent, network discovery, integrations, and CSV import, which gives auditors the list of in-scope systems. Authorization policies flag unauthorized software, and a filter shows which Windows computers have local administrator users, which supports the privileged access review.

Both products run in the cloud or on-premises. InvGate is ISO 27001:2022 certified and holds a System and Organization Controls (SOC) 2 Type II report, which helps when auditors review the tools that store your evidence.

How Grupo Gigante went from 11 audit observations to zero

In 2022, an internal audit at Grupo Gigante, a Mexican retail and real estate group, found 11 observations in its technology processes, including change and inventory processes with no formal structure. The IT team implemented InvGate Service Management and InvGate Asset Management, and the tools were live three months after the purchase order was signed.

Change Management in SAP was consolidated into a single record, and each device was linked to its assigned employee. As the Grupo Gigante case study reports, the audit observations went from 11 to zero within three months of implementation.

Conclusion

ITGC are the base every audit of your IT environment rests on: access, changes, system development, and IT operations, each with evidence an auditor can test. Knowing the four categories, how SOX applies, and what the audit checklist asks for turns audit season into a review of records you already keep.

Ready to strengthen your ITGC audits? Start a 30-day free trial of InvGate Service Management and InvGate Asset Management, or talk to Sales to see how they fit your compliance and risk management work.

Frequently asked questions

These are short answers to common questions about ITGC, their categories, and how they relate to SOX. Each answer stands on its own.

What does ITGC stand for?

ITGC stands for IT General Controls, also called information technology general controls. They are the company-wide controls over access, changes, system development, and IT operations that keep systems and the data they produce reliable.

What are the 4 categories of ITGC?

The four categories of ITGC are access controls, Change Management, system development, and IT operations. Backup and recovery belong to IT operations, and some frameworks list them as a separate area.

What is an example of an ITGC?

A periodic user access review is a common example of an ITGC: managers confirm that every account on a critical system belongs to an active employee who needs it, and sign off on the removals. Change approvals before production and tested backups are two other examples.

What is the difference between ITGC and SOX controls?

SOX controls are all the internal controls over financial reporting that a company maintains to comply with Section 404 of the Sarbanes-Oxley Act, from business process controls to application controls. ITGC are the subset that covers the IT environment underneath, and auditors test them because automated SOX controls rely on them to work.