Essentials of IT General Controls: Governance, Security & Risk

1. Overview of IT General Controls (ITGC)

• Definition: Controls surrounding the information systems environment, including policies, procedures, organizational structure, and infrastructure.
• Purpose: Provide a secure, reliable foundation for application-specific controls.
• Scope: Encompasses administrative, physical, and logical controls, infrastructure management, and operational processes.

---

2. Key Areas of IT General Controls

2.1 Infrastructure and Environmental Controls

• Objective: Protect IT assets from physical and environmental risks.
• Key Controls:
  • Adequate air conditioning (temperature, humidity).
  • Reliable power supply (UPS, generators).
  • Smoke detectors and fire suppression systems.
  • Flood protection and clean environments.
  • Neat and identifiable cabling systems.

Example: Regular maintenance and testing of UPS and fire alarms ensure system availability during power failures.

---

2.2 Physical Access Controls

• Objective: Restrict unauthorized physical access to critical IT resources.
• Key Controls:
  • Locked server rooms.
  • Biometric access devices.
  • Access swipe cards.
  • Security personnel and visitor logs.
  • Employee ID badges.

Example: Biometric authentication limits server room access to authorized personnel only.

---

2.3 Logical Access Controls

• Objective: Safeguard systems, data, and applications from unauthorized digital access.
• Key Controls:
  • User authentication (password policies, multi-factor authentication).
  • Role-based access control (RBAC).
  • Regular access reviews.
  • Intrusion detection systems (IDS) and firewalls.

Example: Strong password policies prevent unauthorized logins.

---

2.4 Change Management Controls

• Objective: Ensure proper authorization and documentation of changes in systems and applications.
• Key Controls:
  • Change request approvals.
  • Version control systems.
  • Testing changes before deployment.
  • Rollback plans for failed updates.

Example: Approval and testing of software patches before rolling them out system-wide.

---

2.5 Backup and Recovery Procedures

• Objective: Ensure data availability in case of data loss, corruption, or disaster.
• Key Controls:
  • Regular data backups.
  • Offsite backup storage.
  • Periodic testing of data recovery plans.
  • Documentation of backup schedules.

Example: Weekly offsite backups ensure data availability during cyber incidents.

---

3. Organizational Controls

• Definition: Controls focusing on defining responsibilities and objectives in IS management.
• Key Areas:
  • Responsibilities and Objectives: Clearly defined roles for IS teams.
  • Policies and Procedures: Rules for IS operations (e.g., physical security, system changes).
  • Job Descriptions: Clearly documented roles and expectations.
  • Segregation of Duties: Prevent unauthorized activity through distributed responsibilities.

Example: A system developer cannot deploy code into production without approval from a system administrator.

---

4. Segregation of Duties (SoD)

• Objective: Prevent fraud and errors by separating incompatible job roles.
• Key Principles:
  • Maker-Checker Principle: Person creating data should not validate it.
  • Separation of Data Access and Processing: Different individuals manage data entry and processing.
  • Access Control: Separate access rights for different roles.

Examples:

• System developer ≠ System tester
• Database administrator ≠ Data entry personnel

---

5. Management Controls

• Objective: Align IT controls with business objectives and ensure strategic alignment.
• Key Controls:
  • Senior Management Responsibility: Strategic oversight.
  • IT Steering Committee: Cross-functional oversight for IT projects.
  • High-level IT Policies: Governance policies for IT operations.

Example: IT Steering Committee approves all major IT investments and ensures alignment with company goals.

---

6. Financial Controls

• Objective: Ensure integrity and accuracy in financial transactions processed through IT systems.
• Key Controls:
  • Authorization: Approval for financial transactions.
  • Budgets: Financial resource planning and tracking.
  • Dual Control: Two-person access for critical transactions.
  • Sequential Numbering: Unique document numbers to detect fraud.

Example: Dual control ensures two bank staff verify vault access together.

---

7. Data Management Controls

• Objective: Ensure data security, availability, and integrity.
• Key Controls:
  • Access Controls: Prevent unauthorized access to sensitive data.
  • Backup Controls: Regular backups and testing recovery processes.

Example: Daily database backups prevent loss during accidental deletion.

---

8. System Development Controls

• Objective: Ensure secure and efficient system development processes.
• Key Phases:
  • System Authorization: Proper approvals for development.
  • User Specification: User requirements documentation.
  • Program Testing: Rigorous pre-deployment testing.
  • User Acceptance Testing (UAT): Verification by end-users.

Example: New ERP implementation passes through multiple UAT cycles before launch.

---

9. Business Continuity Planning Controls (BCP)

• Objective: Minimize IT service disruptions during disasters.
• Key Elements:
  • Risk Assessment: Identify critical operations.
  • Recovery Plans: Detailed disaster recovery plans.
  • Testing and Drills: Simulated disaster recovery exercises.

Example: A cloud backup ensures data availability during a hardware failure.

---

10. Audit Trails

• Objective: Record activities for transparency and accountability.
• Types:
  • System-Level Logs: Record login/logout details.
  • Application Logs: Track user activities.
  • Database Logs: Monitor changes to sensitive data.

Example: Audit logs record failed login attempts for security investigations.

---

11. Internet and Intranet Controls

• Objective: Protect networks and online communication from threats.
• Key Controls:
  • Firewalls and IDS/IPS
  • Encryption for Data Transmission
  • Patch Management

Example: Regular updates and patches prevent exploitation of system vulnerabilities.

---

12. Summary of Key Principles:

1. Ensure physical and logical access controls are robust.
2. Implement segregation of duties for fraud prevention.
3. Maintain clear policies, standards, and procedures.
4. Regularly test backup and recovery procedures.
5. Monitor and review audit trails for anomalies.
6. Involve management in IT governance and risk management.

---

These notes provide a structured overview of IT General Controls and related areas. Let me know if you’d like this converted into a presentation format or need further clarification! 🚀📚