Auditing IT general controls (ITGC)
You test access, change, IT operations and development controls, extract populations from systems, select samples, evaluate exceptions and write conclusions that financial audits can rely on.
Level 301 · 16 lessons · 15 practice labs
Lessons
Framework
- What ITGCs are and why financial audits rely on them
- Four domains: access, change, operations, development
- In-scope systems and layers
- Quick task: a scoping memo
Access
- Testing joiners and leavers
- Testing privileged access
- Testing periodic access reviews
- Segregation of duties conflicts
- Quick task: find leavers whose accounts are still active
Change and operations
- Testing change management
- Direct database changes
- Batch job monitoring and failure handling
- Testing backup controls
- Quick task: extract the change population and reconcile it
Conclusion
- Evaluating deficiencies: significance and compensating controls
- Capstone: an ITGC audit of an ERP system
Practice labs
- Place controls in the four domains: Place sixteen controls in the access, change, operations or development domain.
- Identify in-scope systems and layers: From a financial reporting flow, derive the in-scope application, database and operating system layers.
- Write a scoping memo: Write a scoping memo for Karaçam Mobilya's ERP environment with the systems, the exclusions and the reasons.
- Find leavers whose accounts are still active: Compare the HR leavers list with the system user export and list the accounts still active.
- Test new user approvals: Select twenty-five accounts created in the period and verify a dated, authorised approval for each in the request records.
- Assess the impact of late removals: Check in the lab server logs whether late-removed accounts logged in after the leaving date and write the conclusion.
- List the privileged accounts: List the accounts with administrator rights at the application, database and operating system layers in the lab.
- Test the periodic access review: In a quarterly review record, verify completeness, the suitability of the reviewer and that requested changes were made.
- Extract the segregation of duties conflicts: Join the user–role export with the conflict rule table and report conflicting users and the compensating control.
- Find the missing evidence in change tickets: Mark which of approval, testing and deployment evidence is missing in ten change tickets.
- Extract the change population and reconcile it: Extract deployed changes from the repository history and reconcile them with the ticketing system export.
- Catch direct database changes: From the database audit log, find data changes made outside the application and match them to approved tickets.
- Track the batch job failures: From a month of scheduled job logs, list the failed runs and those with no resolution record.
- Test the backup control: Review the backup job records and the last restore test on the lab server and evidence your conclusion on the control.
- Evaluate the significance of deficiencies: Evaluate five deficiencies by likelihood, magnitude and compensating controls and justify the severity of each.
About this course
You test access, change, IT operations and development controls, extract populations from systems, select samples, evaluate exceptions and write conclusions that financial audits can rely on.
What you will learn
- Framework
- Access
- Change and operations
- Conclusion
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.