05. The Nature and Evaluation of IT General Controls

This chapter reviews IT General Controls (ITGCs), laying the foundation for understanding their role and scope within an organization. ITGCs are fundamental to information systems’ security, integrity, and efficiency, encompassing various practices and procedures that ensure proper functioning and reliability. We will explore the risks and threats that ITGCs are designed to mitigate. We will also focus on how these controls safeguard an organization’s information assets. Moreover, weak ITGCs can lead to significant risks, including data breaches, compliance issues, and operational inefficiencies. In this context, we will highlight the importance of robust ITGCs in maintaining the effectiveness of information systems.

In the subsequent sections, we will explore the primary categories of ITGCs by reviewing the nature of those categories, the key risks involved, and the commonly used ITGCs used by organizations to address those risks. In discussing “IS Acquisition & Development,” we will delve into the controls related to the acquisition and development of information systems and the need for proper control mechanisms during the acquisition process. It includes evaluating third-party vendor controls, ensuring secure software development practices, and considering data privacy in IS development. “IS Change Management Controls,” the next part, highlights the importance of change management in an organization, which is crucial for the smooth operation and evolution of information systems. We will explore the ITGCs associated with change management, including evaluating these controls to ensure they adequately manage risks related to changes in IT environments.

In “User Access Administration,” we address the critical area of controlling and monitoring access to IS. The section will discuss role-based access control and user access provisioning.We also cover the evaluation of user access administration ITGCs. This ensures that only authorized personnel have access to sensitive information, maintaining the confidentiality and integrity of data. The “IS Security Management” section will be dedicated to IS security management principles and objectives. Here, we discuss the primary general controls in IS security, including evaluating the design and implementation of these controls. The section also covers threat detection and incident response aspects, which are vital for maintaining a secure and resilient IT environment.

We will then move to “Computer Operations Management,” which covers data backup and restoration, monitoring system performance, and compliance reporting. We will provide insights into the auditing techniques for computer operations management as they are crucial for ensuring the smooth and secure operation of IT systems. The next segment, “Business Continuity & Disaster Recovery Preparedness,” focuses on the strategies and plans for business continuity and disaster recovery. We will discuss the development and testing of disaster recovery plans. The focus will be on evaluating the resilience of IT systems and auditing the preparedness for business continuity and disaster recovery.

In “Data Governance, Management, & Security,” we will look deeper into the role of data governance within IT general controls. We will cover data classification, handling policies, encryption, and privacy controls. The section will emphasize assessing data security and compliance and auditing data management and governance practices. The “IS Project Auditing” section will address auditing IS project lifecycle phases, including evaluating project management controls, assessing project risks, and ensuring the alignment of IS projects with organizational goals. Finally, “Auditing Cloud Computing and Mobile Computing” will focus on emerging areas in IT auditing, including cloud service provider assessment, data security in the cloud, and the Bring Your Device (BYOD) process. The section will also highlight the unique challenges of mobile device and application management.

Learning Objectives

By the end of this chapter, you should be able to

• Understand the nature, role, and scope of ITGCs in IS.
• Identify and assess the risks and threats mitigated by ITGCs.
• Evaluate the impact of weak ITGCs on an organization’s information systems security and integrity.
• Assess the design and operating effectiveness of the various categories of ITGCs.
• Outline the IS auditor’s role in an organization’s systems development, access and security management, IS operations management, and disaster recovery planning.