Auditing IT General Controls (ITGC) Training Course

Summary

The Auditing IT General Controls Training Course provides a structured corporate framework for professionals responsible for evaluating the effectiveness, reliability, security, and governance of information technology controls within organisations. IT general controls auditing is an essential component of modern internal audit, information security assurance, technology risk management, compliance review, and corporate governance. Effective IT general controls provide the foundation for reliable systems, secure information, controlled technology changes, appropriate user access, and dependable business processes.

Delivered by the Geneva Institute of Business Management under the Review and Audit Training Courses category, this course focuses on the practical requirements involved in reviewing and assessing IT general controls across corporate technology environments. It addresses how auditors can examine control design, evaluate operating effectiveness, identify weaknesses, document audit evidence, assess technology risks, and communicate findings to management and relevant governance functions.

The course covers the principal areas associated with ITGC, including logical and physical access, user administration, privileged access, authentication, segregation of duties, change control, IT operations, backup and recovery, incident management, system development, information security, and technology governance. It also examines how these controls support financial reporting reliability, regulatory compliance, operational continuity, cybersecurity, and broader enterprise risk management.

A significant component of the programme is access controls testing. Organisations rely on controlled access to protect sensitive information and prevent unauthorised activities. Auditors therefore need structured methods for reviewing user provisioning, access modification, termination procedures, privileged accounts, role-based access, periodic access reviews, and segregation of duties. The course provides a corporate perspective on assessing whether access controls are appropriately designed and consistently operated.

Change management review is another central area. Uncontrolled changes to applications, infrastructure, databases, configurations, and production environments can introduce operational, security, compliance, and financial risks. The course examines how auditors assess change requests, approvals, testing evidence, emergency changes, deployment controls, segregation of duties, and post-implementation review processes.

The programme also addresses system security audits as part of a broader IT control environment. Professionals examine how security-related controls interact with access management, infrastructure administration, incident handling, vulnerability management, monitoring, logging, and organisational policies. This creates a more integrated approach to IT audit rather than treating individual controls as isolated activities.

The Geneva Institute of Business Management structures the course around corporate audit requirements, evidence-based assessment, control evaluation, risk identification, audit documentation, and professional reporting. The approach is suitable for organisations seeking stronger technology governance and for professionals whose responsibilities involve internal audit, IT risk, compliance, information security, technology assurance, or control assessment.

Objectives

The Auditing IT General Controls Training Course is designed to establish a comprehensive understanding of how IT general controls are structured, implemented, assessed, and monitored within corporate environments.

Establish a Strong ITGC Audit Framework

Participants will develop a structured approach to IT general controls auditing covering audit planning, risk assessment, control identification, testing, evidence collection, evaluation, documentation, and reporting. The framework supports consistent reviews across different technology environments and organisational structures.

Evaluate IT Control Design and Effectiveness

The course focuses on distinguishing between controls that are appropriately designed and controls that operate effectively in practice. Auditors will consider control objectives, ownership, frequency, evidence, consistency, exceptions, and risk exposure when evaluating control performance.

Strengthen Access Controls Testing

The programme develops practical knowledge of access-related audit procedures. This includes evaluating account creation, modification, removal, privileged access, authentication mechanisms, role assignments, periodic access reviews, inactive accounts, and segregation of duties.

The objective is to establish a systematic process for determining whether users receive appropriate access based on business requirements and whether access is removed or modified when circumstances change.

Conduct Effective Change Management Review

Participants will examine the control environment surrounding technology changes. This includes reviewing change requests, approval processes, testing procedures, implementation records, emergency changes, deployment authorisation, and evidence supporting successful implementation.

The objective is to help auditors identify whether changes are adequately controlled and whether weaknesses could expose systems to operational disruption, security incidents, inaccurate processing, or compliance issues.

Support System Security Audits

The course develops an integrated perspective on security-related controls. Participants will review controls associated with system access, administrative privileges, monitoring, logging, incident management, security policies, infrastructure protection, and other areas relevant to technology assurance.

Improve IT Audit Evidence and Documentation

Effective auditing requires sufficient and reliable evidence. The course therefore addresses evidence collection, sampling considerations, audit workpapers, control testing documentation, exception recording, supporting evidence, and traceability.

Identify and Assess IT Control Deficiencies

Participants will develop methods for identifying control gaps and assessing their potential business implications. The emphasis is on connecting technical weaknesses with operational, financial, compliance, security, and governance risks.

Improve Audit Reporting

The programme addresses how IT audit observations can be communicated clearly to management. Participants will examine the relationship between audit criteria, condition, cause, effect, risk, evidence, and management action plans.

Strengthen Technology Governance

The course connects IT general controls with wider corporate governance requirements. Strong ITGC frameworks can support accountability, system reliability, information security, regulatory compliance, business continuity, and confidence in technology-dependent processes.

Target Audience

The Auditing IT General Controls Training Course is designed for professionals whose responsibilities involve technology controls, internal audit, compliance, risk, information security, governance, or technology assurance.

Internal Auditors

Internal audit professionals can use the programme to strengthen their approach to technology-related audit assignments. The course supports the development of structured ITGC testing procedures and documentation practices.

IT Auditors

IT auditors can deepen their understanding of control evaluation across access management, change management, IT operations, security, system development, and technology governance.

Risk and Compliance Professionals

Risk and compliance teams can use the course to assess technology-related risks and understand how IT controls contribute to broader organisational compliance frameworks.

Information Security Professionals

Security professionals involved in assurance, governance, control testing, or audit coordination can benefit from understanding how security controls are assessed from an independent audit perspective.

IT Managers and Technology Leaders

IT managers can gain a clearer understanding of the evidence, control ownership, governance requirements, and audit expectations associated with technology environments.

Governance and Control Professionals

Professionals responsible for corporate governance, internal control, assurance, or control frameworks can apply the course concepts when assessing technology-dependent business processes.

Compliance and Regulatory Teams

Professionals supporting regulatory reviews can use ITGC principles to strengthen control documentation, evidence management, access governance, change oversight, and technology assurance activities.

External Auditors and Assurance Professionals

External assurance professionals can benefit from a stronger understanding of IT general controls and their relationship with system reliability, technology risk, financial processes, and control environments.

Professionals Moving into IT Audit

The course is also relevant to professionals transitioning from internal audit, accounting, risk, compliance, cybersecurity, or IT operations into technology assurance and IT audit responsibilities.

Modules

Module 1: Foundations of IT General Controls Auditing

This module establishes the structure of IT general controls and their role within corporate control environments. It examines the relationship between ITGC, internal control, technology risk, business processes, governance, compliance, and assurance.

Key areas include:

• IT general controls frameworks
• IT control objectives
• Control design and operating effectiveness
• IT audit scope and boundaries
• Technology risk identification
• Control ownership and accountability
• Audit criteria and evidence requirements
• Relationship between ITGC and business controls

Module 2: IT Audit Planning and Risk Assessment

This module focuses on developing a risk-based approach to IT audit planning. It examines how auditors determine audit scope, identify significant systems, understand technology dependencies, assess inherent risks, and establish appropriate testing priorities.

Key areas include:

• Risk-based IT audit planning
• System and application inventories
• Technology risk assessment
• Critical systems identification
• Audit scope definition
• Control mapping
• Risk and control matrices
• Audit procedures and testing strategies

Module 3: Access Controls and User Administration

This module examines controls designed to ensure that system access is authorised, appropriate, monitored, and removed when no longer required.

Key areas include:

• User provisioning
• User access requests
• Access approval
• Role-based access
• User modifications
• Termination controls
• Dormant and inactive accounts
• Privileged access
• Administrative accounts
• Authentication controls
• Segregation of duties
• Periodic access certification

Module 4: Access Controls Testing

This module provides a structured approach to access controls testing. It focuses on how auditors select evidence, review user populations, assess access rights, identify exceptions, and determine whether controls operate according to documented requirements.

Key areas include:

• Access population analysis
• Sample selection
• User entitlement testing
• Privileged account testing
• Joiner, mover, and leaver controls
• Segregation of duties testing
• Access recertification
• Exception analysis
• Audit evidence documentation
• Remediation verification

Module 5: Change Management Review

This module examines controls governing modifications to applications, databases, infrastructure, configurations, and production systems.

Key areas include:

• Change request initiation
• Change classification
• Risk assessment
• Approval controls
• Development and testing
• User acceptance procedures
• Production deployment
• Emergency changes
• Segregation of development and production responsibilities
• Change documentation
• Post-implementation review

Module 6: IT Operations and System Reliability Controls

This module covers operational controls that support stable, reliable, and continuously available technology services.

Key areas include:

• Batch processing controls
• Job scheduling
• System monitoring
• Incident management
• Problem management
• Backup procedures
• Recovery processes
• Data retention
• Operational logs
• Capacity monitoring
• Service availability controls

Module 7: System Security Audits

This module examines the audit perspective on system security and technology protection. It considers how auditors assess security controls and connect security weaknesses with business risk.

Key areas include:

• Security governance
• System security policies
• Authentication controls
• Privileged access management
• Security monitoring
• Logging and audit trails
• Security incident controls
• Vulnerability management
• Configuration controls
• Security exception management

Module 8: IT Infrastructure and Physical Controls

This module considers controls surrounding technology infrastructure and physical environments. It addresses how auditors evaluate safeguards supporting critical systems and technology assets.

Key areas include:

• Data centre controls
• Physical access
• Environmental controls
• Infrastructure administration
• Network controls
• Hardware protection
• Media management
• Backup infrastructure
• Infrastructure monitoring
• Physical security evidence

Module 9: System Development and Implementation Controls

This module reviews controls supporting system development, acquisition, testing, implementation, and modification.

Key areas include:

• Development governance
• Requirements management
• Testing controls
• Quality assurance
• User acceptance
• Deployment approval
• System implementation
• Data migration controls
• Development environment controls
• Production environment segregation

Module 10: ITGC Testing Methodology and Audit Evidence

This module brings together the practical elements of IT general controls auditing by examining how control tests are planned, executed, documented, and reviewed.

Key areas include:

• Control testing procedures
• Evidence sufficiency
• Evidence reliability
• Sampling
• Walkthroughs
• Inspection
• Observation
• Re-performance
• Exception documentation
• Workpaper quality
• Testing conclusions

Module 11: Control Deficiencies and Risk Evaluation

This module focuses on analysing control weaknesses and determining their significance within the wider business environment.

Key areas include:

• Control deficiencies
• Root cause analysis
• Risk impact assessment
• Likelihood and consequence
• Compensating controls
• Management responses
• Remediation plans
• Follow-up testing
• Issue closure

Module 12: IT Audit Reporting and Management Communication

The final module focuses on communicating IT audit results in a clear and professionally structured format.

Key areas include:

• Audit findings
• Evidence-based observations
• Control criteria
• Identified conditions
• Risk implications
• Root causes
• Recommendations
• Management responses
• Action plans
• Reporting to senior management
• Audit committee communication
• Follow-up and remediation tracking

FAQs

1. What does IT general controls auditing cover?

IT general controls auditing covers the assessment of technology controls supporting system security, access management, change management, IT operations, system development, infrastructure, backup, recovery, and technology governance.

2. Why is access controls testing important in an IT audit?

Access controls testing helps determine whether users have appropriate system permissions and whether access is properly authorised, monitored, modified, and removed. It can also identify excessive privileges, inappropriate access, inactive accounts, and segregation of duties concerns.

3. What is included in a change management review?

A change management review typically examines change requests, risk assessments, approvals, testing, implementation evidence, emergency changes, segregation of duties, and post-implementation procedures.

4. How do system security audits relate to IT general controls?

System security audits can assess security-related controls that form part of the wider IT general control environment. These may include authentication, privileged access, monitoring, logging, security governance, incident management, and configuration controls.

5. Who can benefit from this ITGC training course?

The course is relevant to internal auditors, IT auditors, risk professionals, compliance specialists, information security professionals, IT managers, governance professionals, external auditors, and other professionals involved in technology control assurance.