ITGC Audit Field Guide

The book to keep open during fieldwork.

Written for staff and senior IT auditors, internal audit teams and SOX compliance managers, this field guide turns IT general controls testing into a repeatable process - from scoping and walkthroughs to sample selection, workpapers and deficiency evaluation.

• Eleven practical chapters: what ITGCs are, scoping in-scope applications, the four ITGC domains, risk and key controls, walkthroughs and design testing, operating effectiveness testing, IPE and system reports, SOC 1 reliance, deficiency evaluation, documentation that survives review, and cloud/DevOps environments
• A 37-control library with the risk each control addresses and how to test design and operating effectiveness
• Eight test programs (new users, terminations, access reviews, privileged access, change management, emergency changes, job monitoring, backups) with attributes, fill-in workpapers and worked examples
• Sample size guidance and a repeatable systematic selection method
• PBC request lists, a walkthrough question bank and common ITGC deficiencies with typical fixes
• Worksheets for scoping, risk mapping, IPE testing, SOC 1 review, exception evaluation and deficiency aggregation

Independent publication; not affiliated with the PCAOB, AICPA, COSO, ISACA or the IIA. Always follow your firm's methodology.