Information Systems, IT General Controls and Cybersecurity
Core concepts
IT general controls (ITGCs) support the reliable functioning of applications and automated controls. The standard groupings are: access management (provisioning, de-provisioning, privileged access, periodic user access reviews, authentication), change management (authorisation, testing, segregation of development from production, emergency changes), IT operations (job scheduling, backup and restoration, incident management), and program development/acquisition. Frameworks include COBIT (governance of enterprise IT) and ITIL (service management).
Application controls operate within a process: input (validation, field checks, authorisation limits), processing (matching, recalculation, sequence checks) and output (reconciliation, distribution). Automated controls and IT-dependent manual controls (a human reviewing a system-generated exception report) both depend on ITGCs - if change management is weak, an automated control may have been altered without detection.
Cybersecurity rests on the CIA triad - confidentiality, integrity, availability. Know layered defence (perimeter, identity, endpoint, monitoring), least privilege, patching, phishing and ransomware exposure, incident response and the ISO 27001/NIST Cybersecurity Framework structures. In cloud arrangements, responsibility is shared: the provider secures the infrastructure, the customer secures configuration, identity and data.
Traps in questions
- Calling an application control an ITGC, or vice versa.
- Confusing RTO (maximum tolerable downtime) with RPO (maximum tolerable data loss).
- Assuming an automated control tested once needs no re-testing - configuration must still be verified and ITGCs relied upon.
Worked example
Management sets RTO = 4 hours and RPO = 15 minutes. The backup schedule must therefore run at least every 15 minutes (e.g. continuous log shipping), and a full restoration test must demonstrate recovery within 4 hours. Monthly backup-job success reports alone do not evidence either objective.
Rule of thumb: test the control and the general controls it depends on.