We test whether your IT controls are designed appropriately and operate effectively, and give you clear, prioritized findings before external auditors or regulators raise them.
Executive overview
Independent reviews of IT general controls, access, change management and resilience, providing management and audit committees with reliable assurance.
Financial reporting, operations and compliance all depend on IT systems behaving as intended. IT general controls over access, change, operations and backup underpin the reliability of the data that management and auditors rely on. When these controls are weak or poorly evidenced, the consequences surface as audit findings, extended testing and reduced confidence in reported figures.
We perform IT audits as an independent reviewer, as a co-sourced extension of your internal audit function, or as a pre-audit readiness exercise. Our work follows a documented test approach covering design and operating effectiveness, and results in findings that are specific, evidenced and paired with practical remediation.
Business challenges addressed
- 01
Recurring external audit findings
The same ITGC deficiencies reappear each year because root causes in process or ownership are not addressed.
- 02
Excessive or unreviewed access
Privileged accounts, leavers’ access and segregation of duties conflicts persist in key applications and infrastructure.
- 03
Uncontrolled changes to production
Changes reach production without documented approval, testing or separation between development and deployment.
- 04
Untested recovery capability
Backups run, but restores and disaster recovery plans are rarely tested against agreed recovery objectives.
Services and solutions
- 01
IT general controls reviews
Test the design and operating effectiveness of ITGCs across access to programs and data, program change, computer operations and program development for in-scope systems.
- 02
IT governance audits
Review how IT strategy, investment, risk and performance are steered, including the roles of the IT steering committee and the alignment of IT with business priorities.
- 03
Access management reviews
Assess joiners-movers-leavers processes, periodic access recertification and the timeliness of access removal across key applications and directories.
- 04
Identity and access control assessments
Examine privileged access management, authentication strength, service accounts and segregation of duties, and recommend proportionate improvements.
- 05
Change management reviews
Verify that changes to applications, databases and infrastructure are requested, tested, approved and deployed with appropriate segregation and traceability.
- 06
Backup and disaster recovery assessments
Review backup coverage, restore testing and disaster recovery plans against defined recovery time and recovery point objectives (RTO and RPO).
- 07
Infrastructure and application control reviews
Assess configuration, patching, logging and monitoring on key platforms, and test automated application controls and interfaces that support business processes.
- 08
IT compliance assessments
Assess IT practices against applicable contractual, regulatory or framework requirements, working with your legal advisers where legal interpretation is needed.
Typical engagement approach
- 01
Scope
Agree in-scope systems, control objectives, test periods and reporting expectations with management and audit stakeholders.
- 02
Walk through
Document processes and controls through walkthroughs, and assess whether each control is designed to address its risk.
- 03
Test
Perform sample-based testing of operating effectiveness and validate findings with control owners.
- 04
Report
Deliver rated findings, root causes and agreed remediation actions, and support follow-up where required.
Expected deliverables
- Audit scope, control matrix and test plan
- Walkthrough documentation and design assessment
- Test workpapers with supporting evidence
- Audit report with rated findings and root causes
- Agreed remediation plan with owners and deadlines
- Executive summary for management and the audit committee
Outcomes you can target
- 01
Reliable assurance over the IT controls that support financial reporting and operations
- 02
Fewer surprises during external audits
- 03
Access and change processes that are controlled and evidenced
- 04
Recovery capability aligned with business expectations
Related expertise
More in Cybersecurity & IT Audit
- Cybersecurity GovernanceDefine how security risk is owned, decided and reported, with a strategy, policy set and control framework proportionate to your organization.
- Security Improvement ProgramsTurn assessment findings into a prioritized, funded and governed program covering architecture, third parties, resilience and the management system.
- ISO/IEC 27001 ReadinessDesign and implement an information security management system aligned with ISO/IEC 27001:2022 and prepare your organization for an accredited certification audit.
Frequently asked questions
Can you support our internal audit function rather than replace it?
Yes. We frequently work in co-sourcing, bringing IT audit expertise to your audit plan while following your methodology, rating scales and reporting format.
Is an ITGC review the same as the work of our statutory auditors?
No. Your statutory auditors perform their own procedures and reach their own conclusions. Our review helps you identify and correct weaknesses beforehand and strengthens the evidence you can present to them.
Do your IT audits include penetration testing?
Our audits focus on control design and effectiveness. Where technical testing is needed, we help scope it, coordinate a specialist provider and integrate the results into the overall assessment.
Talk to an expert about IT Audit & Assurance
Tell us where you are today and what you need to achieve. We will propose the right scope for a first engagement.