Information Systems Audit (IS Audit) & ITGC Review: What It Actually Involves
Every Board resolution, every financial close, every regulatory filing your organisation makes today rests on IT systems that many managements have never had independently examined. PNPC Global's Information Systems Audit (IS Audit) and IT General Controls (ITGC) Review tests whether the access management, change management, backup/recovery, and IT operations controls around your core systems are actually working — not just documented in a policy manual. We combine the Chartered Accountant's grounding in financial control objectives with structured IT audit methodology to give the Board, Audit Committee, and statutory auditor independent assurance that the technology layer supporting your financial statements, data, and operations is under control.
What You're Really Buying
An Information Systems Audit (IS Audit) is an independent examination of an organisation's IT environment — covering the governance, security, and operational controls around the hardware, software, networks, and data that support business processes and financial reporting. IT General Controls (ITGC) Review is the specific, most commonly commissioned subset of an IS Audit that focuses on four control domains recognised globally under frameworks such as COBIT and ISO 27001, and referenced by the Institute of Chartered Accountants of India (ICAI) in its Guidance Note on Audit of Internal Financial Controls: (1) access management — how user accounts are provisioned, modified, and revoked across applications, databases, operating systems, and network devices; (2) change management — how changes to programs, system configuration, and infrastructure are requested, tested, approved, and moved into production; (3) IT operations — how batch jobs, interfaces, backups, and incident/problem management are run and monitored; and (4) physical and environmental security over data centres and server rooms.
In the Indian regulatory context, ITGCs are not an optional technical nicety — they are the foundation on which application-level and financial reporting controls rest.
For the full scope, current process and what PNPC includes, see the dedicated Information Systems Audit (IS Audit) & ITGC Review service page.
Signs This Applies to You
- Your statutory auditor has flagged IFC-FR deficiencies, audit trail (edit log) observations, or management letter observations relating to IT access controls, change management, or system-generated report reliability
- You are preparing for an IPO, a PE/VC fundraise, or an acquisition, and need independent evidence that IT controls will withstand due diligence and post-transaction governance scrutiny
- A customer, lender, or regulator has requested SOC 1/SOC 2-type assurance or an independent ITGC report as a precondition to a contract, credit facility, or licence renewal
- The organisation has grown its IT footprint — new applications, cloud migration, outsourced IT operations, or multiple data centres/hosting providers — faster than its access and change control discipline has kept pace
Before You Assume You Need This
- You need to know whether your network and applications can be technically breached from outside — a VAPT/penetration testing engagement, not an ITGC review, is the correct scope for exploitability testing
- Your primary concern is segregation of duties and automated control configuration within a single ERP module (approval matrices, tolerance limits, three-way match) — a dedicated ERP/application controls audit goes deeper into that specific layer
- You are selecting or evaluating a new ERP or core system vendor — that is a systems selection/advisory engagement, distinct from an audit of an existing live environment
Quick Answers
What exactly is an Information Systems Audit (IS Audit)?
An IS Audit is an independent examination of the governance, security, and operational controls around an organisation's IT environment — the applications, databases, operating systems, networks, and data centres that support business processes and financial reporting. It assesses whether the organisation's IT controls are properly designed and are actually operating as intended, rather than merely documented in a policy.
What are IT General Controls (ITGCs), specifically?
ITGCs are the foundational controls over the IT environment that all application-level and automated financial controls depend on. They fall into four domains: access management (how user access is granted, changed, and revoked), change management (how changes to programs and configuration are tested and approved before going live), IT operations (batch jobs, interfaces, backups, incident management), and physical/environmental security (data centre and server room controls).
Why do ITGCs matter for financial reporting specifically?
For listed companies, the directors' responsibility statement under Section 134(5)(e) of the Companies Act 2013 must state that internal financial controls are adequate and operating effectively, and the statutory auditor reports on internal financial controls over financial reporting under Section 143(3)(i) where that reporting applies. Most modern financial controls — automated postings, system-calculated tax, approval-workflow-enforced payment authorisation — depend entirely on the IT environment underneath them. A weak ITGC (an exited employee's access left active, an unauthorised production change) can silently undermine every application control built on top of it, which is why statutory auditors test ITGCs as part of Internal Financial Controls over Financial Reporting (IFC-FR) assessment.
Working With PNPC Global
Speak directly with a PNPC Chartered Accountant who understands both IT audit methodology and the financial reporting obligations your Board actually needs to satisfy — not a generic checklist provider, and not a large-firm account manager. A practising CA who will present findings your Audit Committee can act on, and who will still be reviewing your systems next cycle to confirm the fixes actually held.
PNPC Global has advised Chennai, Bangalore and Hyderabad businesses since 1986. Explore the full Transformation & Tech practice for related services, or go straight to the Information Systems Audit (IS Audit) & ITGC Review page for specifics.
Specific rates, fees, thresholds and deadlines are set by the relevant authority and change over time — this article deliberately does not quote figures that could go stale. Confirm current numbers directly with PNPC or the official source before you act.