What is ITGC?
ITGC, short for information technology general controls (IT general controls), are the controls over the IT environment that auditors test before relying on systems for financial reporting. No single body publishes ITGC as a standard; auditors start from suggested sets such as the one in ISA 315 (Revised 2019). They apply to organisations whose reporting depends on IT.
ITGC has no version, effective date or revision cycle of its own. The edition that matters is the auditing standard your auditor applies. ISA 315 comes from the IAASB, and its appendix 6 covers the data-security IT general controls (ISACA Journal, 2022).
The list is a starting point, not a fixed checklist. The auditor performs a risk assessment and uses professional judgement to decide which controls matter, so the set differs from one IT environment to the next.
A copied control list from last year's audit file is not a risk assessment.
Why it matters
An ITGC audit usually reaches you as a request list. The auditor wants evidence of who can access the finance system, who approved the last change to it, and what monitors it. If nobody can produce that evidence, the year-end timetable slips.
The reason is reliance. Auditors use ITGCs to decide whether they can rely on the information systems that produce the numbers. Weak ITGCs make that reliance hard to justify, and the questions move from the controls to the figures themselves.
There is a live argument about how far the familiar list reaches. ISACA's author contends that ITGC guidance is dated, and that frameworks such as the Trust Services Criteria, the Cloud Controls Matrix and ISO/IEC 27002 have grown up to fill the gap.
ITGCs test whether the systems behave. They do not test whether the business is sound.
Who it applies to
ITGC applies to any organisation whose financial reporting runs through information systems, which today is almost every company with an auditor. It matters most to listed companies, their subsidiaries and the service providers that host or process financial data. A business whose reporting does not depend on information systems has little reason to meet it.
The obligation is indirect. ITGC is not a law or a certifiable standard, so nothing makes it mandatory as such. It becomes binding through an external audit, a regime that requires internal control over financial reporting, or a customer or group auditor that asks for evidence. For most firms that is an audit-driven or contractual duty, not a statutory one.
The nearest framework most readers hold is ISO 27001. It overlaps with ITGC most closely on access and on change management (A.8.32), but ISACA notes that ISO/IEC 27001 and 27002 are not often used to give assurance over financial reporting, so an auditor still decides what is in scope. A SOC 2 report draws on the AICPA Trust Services Criteria, which contain more controls than the familiar ITGCs.
The UK position
No UK law is called ITGC, but two regimes lead UK firms to it:
| Regime | Who it affects | What it asks |
|---|---|---|
| UK Corporate Governance Code 2024, Provision 29 (FRC) | Companies in the commercial companies and closed-ended investment funds listing categories, for financial years beginning on or after 1 January 2026, on a comply-or-explain basis | A board declaration on the effectiveness of material internal controls. The Code does not name ITGC, but IT general controls are likely to be among the controls boards assess |
| US Sarbanes-Oxley Section 404(b) and PCAOB AS 2201 | UK firms that are SEC registrants, or subsidiaries of US issuers reporting into group ICFR | Auditors test ITGCs as part of the audit of internal control over financial reporting |
For a UK firm of 25 to 250 people, the first encounter is rarely a regulator. It is the external auditor's request list, or a group auditor's.
Key requirements
ITGC has no single set of clauses. The sourced grouping, from ISACA's reading of ISA 315, has three areas:
- Access management. Authentication, authorisation, provisioning and deprovisioning, privileged access, user access reviews, security configuration and physical access.
- Change management. Controls over how changes to systems are authorised, tested and released, including data conversion controls.
- IT operations management. Controls over the running of the environment, including intrusion detection.
You will often see ITGC described as four domains. That split is common shorthand in audit guidance. The three areas above are the grouping ISACA draws from ISA 315, so treat them as the sourced position.
Choosing the controls in scope
An ITGC controls list is only useful once the auditor has tied it to your systems. The auditor identifies the IT applications and infrastructure that matter for financial reporting, assesses the risks arising from their use, and picks the controls that address those risks.
Two companies with the same ERP can end up with different ITGC scopes because their environments differ. A cloud-hosted finance system pushes some controls to the provider, which is where SOC reports and the Cloud Controls Matrix come in.
The controls you hold for ISO 27001 or SOC 2 are often the evidence for the access and operations items. The change management evidence tends to be the gap, because delivery teams ship faster than approvals get recorded.
Frequently asked questions
In audit, ITGC means information technology general controls: the controls over the IT environment that let an auditor rely on information systems for financial reporting. ITGC is not a single published standard. Auditors pick the controls to test through risk assessment and professional judgement, starting from suggested sets such as the one in ISA 315 (Revised 2019).
SOX is a US regime, while ITGC are the IT controls tested under it. For SEC registrants, and subsidiaries of US issuers reporting into group ICFR, auditors test ITGCs under Section 404(b) and PCAOB AS 2201. ITGC itself is not a law, so the same controls can matter with no SOX obligation at all.
ITGC has no single primary-source list of four domains. The four-part split people quote is common shorthand. The sourced groupings in ISACA's guidance are access management, change management and IT operations management. Your auditor's scoping under ISA 315 decides which of those controls are in scope for your environment.
There is no ITGC certification, because ITGC is not a single published standard with a scheme behind it. Assurance comes from auditors testing the controls. If a customer wants a certificate, ISO 27001 is the certifiable management system, and SOC 2 is a report against the AICPA Trust Services Criteria.
ISO 27001 does not replace ITGC testing. Its access and change controls overlap with ITGC, but ISO 27001 is built for security management and is rarely used to give assurance over financial reporting. A firm with ISO 27001 often holds much of the evidence an auditor asks for, but the auditor still decides what ITGC testing covers.