Do You Need Information Systems Audit (ISA) & IT General Controls (ITGC) Review? A Practical Starting Point
Every financial control in a modern business now runs through a system — an ERP posting rule, an access role, a batch job, an API integration. If the technology layer underneath is not independently tested, no amount of manual control testing tells the full story. At PNPC Global, we conduct Information Systems Audits and IT General Controls (ITGC) reviews that examine the access, change-management, and operations layer your financial reporting, statutory audit, and regulatory obligations quietly depend on.
Understanding the Service
An Information Systems Audit (IS Audit) is an independent examination of an organisation's IT environment — infrastructure, applications, data, and the processes that govern them — to assess whether information systems are adequately controlled, secure, and aligned to business and regulatory requirements. IT General Controls (ITGC) review is its most common form in a financial-reporting context: a focused assessment of the controls that operate across an entire IT environment rather than within a single application — principally access management, change management, IT operations (backup, batch processing, incident management), and, where relevant, program development controls. ITGC matters because financial statement controls (three-way match in procurement, automated revenue recognition, system-calculated depreciation, segregation of duties enforced through ERP roles) are only as reliable as the IT environment that executes them.
For the full scope, current process and what PNPC includes, see the dedicated Information Systems Audit (ISA) & IT General Controls (ITGC) Review service page.
When You'd Need This
- Your statutory auditor's IFC opinion under Section 143(3)(i) depends on placing reliance on ERP-driven controls, system-calculated figures, or automated three-way matches — a weak ITGC environment undermines that reliance and risks audit qualification
- You are a bank, NBFC, payment aggregator, or other RBI-regulated entity subject to periodic Information Systems Audit under the applicable RBI master direction or circular for your category of institution
- You are preparing for ISO/IEC 27001 certification, or need to demonstrate information security control maturity to an enterprise customer, investor, or regulator as part of a vendor security assessment
- Your organisation has grown from a manual or spreadsheet-based finance function into a full ERP (SAP, Oracle, Microsoft Dynamics, Tally Prime with multi-user access, Zoho Books/NetSuite, or similar) and access controls have not kept pace with headcount growth
Before You Assume You Need This
- Very early-stage business running on a single off-the-shelf accounting package with one or two users and no meaningful segregation-of-duties risk — a basic access-hygiene checklist within the accounting engagement is more proportionate than a formal ITGC engagement
- Organisation has not yet implemented any ERP or centralised system and finance runs substantially on spreadsheets — the priority should be system implementation and basic control design, not a formal audit of controls that do not yet exist
- You need a penetration test or vulnerability assessment of a specific application or network perimeter — that is a specialised cybersecurity/VAPT engagement with a different skill set and toolset than an ITGC review, though the two are complementary and often sequenced together
Common Questions
What is the difference between an Information Systems Audit and an IT General Controls (ITGC) review?
Information Systems Audit (IS Audit) is the broader term — an independent examination of an organisation's IT environment covering governance, security, applications, infrastructure, and data. ITGC review is typically the specific subset of an IS Audit that focuses on controls operating across the entire IT environment (access management, change management, IT operations) rather than within a single application — and is the form most directly relevant to financial-reporting reliance under Section 143(3)(i) of the Companies Act. In practice, an ITGC review is one component of a fuller IS Audit; the two terms are often used together because the scope substantially overlaps for most engagements.
Is ITGC review mandatory for our company, or is it only relevant for banks and NBFCs?
There is no standalone Companies Act section that makes ITGC review mandatory by name. It becomes effectively necessary wherever Section 143(3)(i) requires your statutory auditor to opine on the adequacy and operating effectiveness of internal financial controls, and your financial reporting relies on automated or IT-dependent manual controls — which is the case for the large majority of companies running any ERP today. Separately, it is directly mandatory (in the sense of being required under specific regulatory circulars) for RBI-regulated entities — banks, NBFCs, payment aggregators, and similar categories — under the applicable master direction for that category of institution.
We are a mid-sized private company using Tally or Zoho Books with a handful of users. Do we really need a formal ITGC review?
It depends on scale and reliance, not just the software name. A single-entity company with two or three users on a straightforward accounting package and no meaningful segregation-of-duties risk generally does not need a formal COBIT/ISO-referenced ITGC engagement — a lighter access-hygiene review within the regular audit or accounting engagement is proportionate. The calculus changes once you add multiple locations, multiple users with differentiated roles, integrations to e-commerce or payment systems, or investor/lender requirements for control assurance.
Getting This Right From the Start
Your financial controls are only as strong as the IT environment running underneath them — talk to PNPC before your statutory auditor, your regulator, or an attacker finds the gap first.
PNPC Global has advised Chennai, Bangalore and Hyderabad businesses since 1986. Explore the full Audit & Assurance practice for related services, or go straight to the Information Systems Audit (ISA) & IT General Controls (ITGC) Review page for specifics.
Rates, thresholds and filing dates are set by the relevant authority and revised periodically. Treat anything numeric here as "ask PNPC for the current figure," not as a quoted fact.