IT Examiner School eBook May 2025

Internal Use Only

IT General Controls (ITGC)

• Management, Board reporting, and governance • Logical access controls over infrastructure, applications and data • System development life cycle controls • Program change management controls • Data center physical controls • System and data back-up & recovery controls • Computer operation controls

ITGC:

ITGC engagements should be performed based on risk, which usually indicates annual performance.

Internal Use Only

Wire Transfer/ACH Audits These services are critical to many financial entities

• Particularly in small to medium community banks, CUs, and MTs Usually included in with ITGC audit • Could occur in financial entities with significant wire/ACH activity • Usually in large community financial entities Can be a separate audit