Governance, Risk & Compliance
IT general controls audit services sit at an unusual intersection: the audience is often the financial audit team rather than the security team. If your ITGCs fail, your external auditor cannot rely on any system-generated figure, and the substantive testing that replaces that reliance is slow, expensive and unwelcome.
ITGCs are the foundational controls over the IT environment supporting financial reporting: who can access the systems and the data, how changes reach production, how the operations that keep them running are managed, and how the data is protected. Application controls sit on top and only work if these hold.
We test them the way an auditor does (sampling evidence, walking through transactions, checking that the control operated on the date it was supposed to) and report deficiencies with their impact on control reliance. The same testing supports SOC 2 and ISO 27001:2022 evidence, so it is rarely worth running these separately.
Why you need it
01 / 06If access and change controls cannot be relied upon, no report produced by the system can be relied upon either. The auditor then has to test underlying transactions substantively, which costs more, takes longer and involves far more of your finance team's time.
In small IT teams the same person frequently develops, approves and deploys, and holds administrative access to production. It is operationally sensible and it is a control deficiency, and it needs either a compensating control or an explicit, documented acceptance.
Emergency fixes deployed without a ticket, approvals given verbally, and developers with standing production access are the three findings that appear in nearly every first ITGC audit.
Access provisioning and review, change approval and backup testing are tested by ITGC, SOC 2, ISO 27001:2022 and most regulatory reviews. Testing once and re-presenting is materially cheaper than four separate exercises.
Instrument
02 / 06Access, change and operations controls are tested by nearly every framework. The overlap is work you only have to do once.
What we deliver
03 / 06Provisioning and deprovisioning against joiner-mover-leaver evidence, privileged and administrative access, periodic user access reviews with revocation actually performed, password and authentication configuration, and segregation of duties across the roles that matter for financial reporting.
Change request, approval, testing and deployment evidenced per change; segregation between development, test and production; emergency change handling with retrospective approval that actually happens; and whether developers hold standing production access.
Controls over new systems and major implementations: requirements and approval, testing and user acceptance, data conversion and validation, and post-implementation review, the area where control breaks most often during a migration.
Job scheduling and failure handling, backup execution and (the part usually missing) evidence of tested restoration, incident and problem management, physical and environmental controls, and third-party operational dependencies.
Encryption of financially relevant data in transit and at rest, database-level access control, audit logging and its review, and the segregation between production data and non-production environments.
Deficiencies rated by their effect on control reliance, with practical remediation, including compensating controls where segregation is genuinely impossible in a small team, and re-testing to confirm closure before the external audit.
How we run it
04 / 06Which systems are in scope, established by tracing back from the financial statements to the applications, databases, operating systems and infrastructure that produce them. Scoping by IT inventory rather than by financial relevance is the standard mistake.
Weeks 1-2Risk rating per system and per control domain, so testing effort concentrates where a failure would actually affect reporting reliability.
Week 2The documented control environment: policies, procedures, role definitions and approval matrices, assessed for whether they describe a control that could work as written.
Weeks 2-3Design effectiveness through walkthroughs, then operating effectiveness through sampling across the period. We test what happened, not what was intended: pulling actual tickets, actual approvals, actual access review records.
Weeks 3-6Deficiencies documented with evidence and rated by impact on control reliance, distinguishing a deficiency from a significant deficiency from a material weakness, because the three have very different consequences.
Weeks 6-7A report suitable to hand to your external auditor and your audit committee, with practical remediation, owners and dates, and a re-test of anything corrected before the year-end audit.
Week 8Key benefits
05 / 06Reliable ITGCs let the auditor rely on system-generated data, which reduces substantive testing and the demands it makes on your finance team.
Finding a change management deficiency in an internal review leaves a quarter to fix it. Finding it during the year-end audit does not.
Access, change and operations evidence is reused for SOC 2, ISO 27001:2022 and regulatory reviews instead of being gathered separately each time.
Tools we use
06 / 06No “latest tech tools”. These are the ones your report will cite, alongside the manual work that a tool cannot do for you.
Frameworks
Access testing
Change testing
Operations testing
Technical validation
Why Aphelion
SharedDarshap Nayak, formerly of KPMG, holds a master’s degree in cybersecurity and more than seven years in security operations. Jaimin Somani brings fifteen-plus years of academic and hands-on VAPT. Hemang Desai is an ICT network specialist from Australia. You will meet them, not a logo.
Meet the teamEvery finding arrives with the reproduction steps, the affected asset and the fix, ranked by what it actually reaches in your environment, not by a CVSS number copied from a scanner. You get the report and the raw output, not a summary of a summary.
See how we testAhmedabad and Sharjah, working the same methodology on the same tooling. Indian data-residency requirements and UAE delivery are both ordinary here, and the AphelioNYX AD Pen-Test module runs entirely inside your perimeter when regulation says it must.
The platformInvent a statistic to make a slide land. Publish your name as a client without written permission. Print an award badge nobody awarded. Founded in 2024. We say so, and we attribute experience to the people who have it.
Ask us anythingAcross the globe, and across eight industries. We name a client only with their written permission.
AphelioNYX is SOC 2, ISO and GDPR compliant; attestations are available on request under NDA. We would rather hand you the report than print a badge.
Questions
FAQNext door
RelatedA personalised walkthrough and a free readiness assessment against the frameworks you are actually being asked for. Pick a time that suits you, or write to us. We reply within one business day.