Considerations for Understanding GeneralConsiderations for Understanding General IT Controls

Considerations for Understanding General IT Controls

This appendix provides further matters that the auditor may consider in understanding general IT controls.

1. The nature of the general IT controls typically implemented for each of the aspects of the IT environment:
   1. Applications

General IT controls at the IT application layer will correlate to the nature and extent of application functionality and the access paths allowed in the technology. For example, more controls will be relevant for highly-integrated IT applications with complex security options than a legacy IT application supporting a small number of account balances with access methods only through transactions.

1. Database

General IT controls at the database layer typically address risks arising from the use of IT related to unauthorised updates to financial reporting information in the database through direct database access or execution of a script or program.

1. Operating system

General IT controls at the operating system layer typically address risks arising from the use of IT related to administrative access, which can facilitate the override of other controls. This includes actions such as compromising other user’s credentials, adding new, unauthorised users, loading malware or executing scripts or other unauthorised programs.

1. Network

General IT controls at the network layer typically address risks arising from the use of IT related to network segmentation, remote access, and authentication. Network controls may be relevant when an entity has web-facing applications used in financial reporting. Network controls are also may be relevant when the entity has significant business partner relationships or third-party outsourcing, which may increase data transmissions and the need for remote access.

1. Examples of general IT controls that may exist, organised by IT process include:

   1. Process to manage access:
   • Authentication

Controls that ensure a user accessing the IT application or other aspect of the IT environment is using the user’s own log-in credentials (i.e., the user is not using another user’s credentials).

• Authorisation

Controls that allow users to access the information necessary for their job responsibilities and nothing further, which facilitates appropriate segregation of duties.

• Provisioning

Controls to authorise new users and modifications to existing users’ access privileges.