Today every core business activity is backed by information technology (IT), and as we move toward the future, businesses are only expected to become more tech-driven. However, the extensive dependence on IT exposes organizations to several threats like data theft, technical faults, integrations risks, and more. Hence, to tackle and prevent such scenarios, IT General Controls (ITGC) and IT Application Controls (ITAC) were brought in place. But before we understand these are why we need them, let’s look at a simpler case.

Assume you manufacture luxury cars worth millions of dollars and store them in a garage. However, you do not bother to lock the gates, let alone set up a security system. Therefore, you are inviting burglars to steal your assets and jeopardize organizational well-being. Now, this whole scenario sounds dumb because you would not let that happen. You would take adequate measures or controls to safe keep the assets by installing cameras, anti-theft alarms, etc.

Similarly, ITGC and ITAC are controls that are introduced in an organization to protect and monitor its IT-related assets.

What are IT General Controls and IT Application Controls?

IT General Controls:

ITGC is a type of internal control and a set of policies that lay down a blueprint for effective implementation and usage of IT-related products and services all over the company. These policies guide the organization on how to deploy software, ensure the safety of the software and hardware, govern security protocols, and monitors how technology is acquired and integrated. Large organizations are required to reveal their ITGC audits under the Sarbanes-Oxley Act. ITGC can be implemented for backup and recovery, incident management, logical security, information security, and more.

IT Application Controls:

ITAC is more objective in nature and governs only data and transactions pertaining to a specific type of software. They are distinctive from one another and concentrate on IPO functions – input, process, and output. ITAC guarantees the accuracy, completeness, and integrity of the data throughout its lifecycle.

What do I need – ITGC or ITAC?

There is often an air of ambiguity when deciding which controls to choose – ITGC or ITAC. With years of experience, the dilemma can be resolved. However, if you are looking for a quicker way out, then understanding the purpose of the controls and aligning them with your need is essential.

Although both are equally important for organizations that heavily rely on IT, ITGC has a broader scope spread throughout the company. It applies to all types of hardware and software. On the other hand, ITAC has a narrower scope since each control caters to a specific type of software. The control used for sales management software will differ from that of payroll management software. When you want to safe keep data from one particular software as opposed to the whole of the organization’s system then ITAC is your guy.

Nonetheless, whichever controls you choose, we must remember that these play an important role in risk management and compliance and therefore demand undivided attention from each unit of the organization. To start, you must opt for a holistic framework like the COSO framework or the COBIT framework that encompasses standard IT risks and potential controls.

How important is monitoring IT General Controls and IT Application Controls?

If you have read this far into the article, then you already know why IT General Controls and IT Application Controls are essential for an organization. Additionally, you are also aware of the importance of the said controls. Now, let’s answer a question we all have thought about at least once – how important is monitoring ITGC and ITAC? Well, the simplest answer is very important, but we would like to probe furthermore into the matter. Hence, we need to look at a few things that can go wrong if ITGC and ITAC are not monitored.

1.  Insufficient software controls: In this case, it will be a cakewalk for anyone within the organization to access sensitive information and make unauthorized changes to the software or transactional data.
2. Unsupervised user account creation: Employees at different levels of the organization can create multiple unsanctioned accounts, like salary accounts, payment accounts, etc.
3. Substandard audit processes: If ITGC and ITAC are not monitored, then during the audit investigation, the chances of identifying missing links and other relevant data pertaining to a case becomes an arduous task. There can be instances where the correct information cannot be traced at all.
4. Faulty configuration management: This exposes your systems to hackers and can be easily exploited.

The four points above are only a smaller fragment of a larger chaotic picture that you do not want to see. Depending upon the nature of your business and industry, there can be wider risks that can go easily unnoticed until it takes place. Nevertheless, all this can be avoided when IT General Controls and IT Application Controls are systematically and regularly checked. Hence, to answer the question, monitoring these controls is imperative for the effective and efficient functioning of a tech-fuelled organization.

Automation of IT general controls and IT application controls is very critical because it can mitigate human error. Every big organization should automate their IT general controls and IT application controls, that is why iRM came up with the idea of automating these controls with great accuracy and keeping data secure. iRM has a connection to all financial applications where ITGC applies like Oracle, SAP, NetSuite, Workday, and many more.