IS Audit & ITGC Review India: Who Needs It and Who Does Not
Whether IS Audit & ITGC Review India applies to a given business is the first thing worth settling, and it is where most of the early questions land. The questions below are the ones raised most often in practice; the full scope of the service is on the IS Audit & ITGC Review India page.
Is an IS Audit / ITGC review mandatory for all companies?
There is no single blanket statutory mandate requiring every company to commission a standalone IS Audit. However, the underlying obligation — adequate and effective internal financial controls — runs through the Companies Act 2013: directors of listed companies must confirm it in the directors' responsibility statement under Section 134(5)(e), every company's Board report must address the adequacy of internal financial controls with reference to the financial statements (Section 134(3)(q) read with Rule 8(5)(viii) of the Companies (Accounts) Rules 2014), and the statutory auditor must report on internal financial controls over financial reporting under Section 143(3)(i), subject to the exemptions notified for certain private companies (G.S.R. 583(E), 13 June 2017). A dedicated ITGC review is a practical way to demonstrate and evidence that obligation. Regulated entities — banks, NBFCs, insurers — face additional sector-specific IT governance and outsourcing circular requirements from RBI or IRDAI that may mandate periodic independent IS audit.
In practice: Even where not strictly mandated, growth-stage and PE/VC-backed companies may commission an ITGC review voluntarily — because the alternative is discovering the gaps during investor or lender due diligence, at a far less convenient moment.
What is the typical timeline for a first IS Audit / ITGC Review?
For a mid-sized single-location organisation with a defined systems landscape, the timeline from kickoff to Board presentation depends on scope and the case; confirm the current timeline at scoping. The work covers scoping, testing across all four ITGC domains, findings validation, and reporting. Multi-entity organisations, regulated BFSI entities, and organisations with significant outsourced IT operations typically require a longer first cycle because of the additional evidence-gathering and coordination involved.
In practice: The first cycle is always the slowest — largely because baseline documentation (access lists, change logs in a usable format) often does not exist in a ready state. Once that baseline is established, subsequent annual cycles are noticeably faster.
Who typically commissions an IS Audit / ITGC Review — the Board, Audit Committee, or CFO?
It can be commissioned by any of the three, and often is a joint decision. Audit Committees commission it as part of their governance oversight responsibility. CFOs commission it to support the IFC-FR certification and to pre-empt statutory audit management letter points. Internal Audit functions commission it because most internal audit teams lack the specialist skills to test access logs, change tickets, and system configuration evidence to the depth required.
In practice: We recommend the engagement letter name a specific sponsor — usually the Audit Committee Chair or CFO — so that findings have a clear escalation path and remediation accountability from day one.
What does change management testing actually look like in practice?
We pull the change log or ticketing system record for the audit period, select a sample of changes (weighted towards higher-risk changes — configuration changes affecting financial postings, tax calculation logic, or access controls themselves), and trace each sampled change to a documented business justification, evidence of testing or UAT sign-off, and appropriate authorisation before it was deployed to the production environment. We also test whether development, testing, and production environments are properly segregated, and who holds the ability to move changes between them.
In practice: A frequent finding: developers holding direct production access 'for emergencies,' with no compensating control such as logged and reviewed emergency-change procedures. This defeats the purpose of environment segregation entirely and is a red flag statutory auditors specifically look for.
What is the difference between IT General Controls and IT Application Controls?
IT General Controls (ITGCs) are pervasive controls that apply across an entire IT environment — access management, change management, IT operations, physical security — and support the reliability of every system running within that environment. IT Application Controls are specific, automated controls built into a particular application — a mandatory three-way match before payment, a system-enforced approval limit, a validation rule preventing negative inventory. Application controls can only be relied upon if the ITGC environment beneath them is sound; a weak ITGC environment (someone with unauthorised database access) can bypass even a well-designed application control.
In practice: We explain this distinction to Audit Committees using a simple analogy: ITGCs are the building's structural integrity and security system; application controls are the individual locks on individual office doors. A strong lock on a weak door frame is not real security.
Can a smaller company with a lean IT team still commission this review, or is it only for large enterprises?
Yes, though the scope and depth should be proportionate. A smaller company with a single ERP, limited applications, and a lean team can still commission a scoped ITGC review — often focused primarily on access management and change management, the two domains that carry the highest risk-to-effort ratio — without the full multi-system, multi-location scope a large enterprise would require. PNPC scopes the engagement to the organisation's actual risk profile and size rather than applying a one-size-fits-all enterprise checklist.
In practice: This engagement can be right-sized for growth-stage companies preparing for their first institutional fundraise — a focused access-and-change-management review, rather than the full enterprise scope, may be what due diligence requires at that stage.
Where this sits in the wider engagement
IS Audit & ITGC Review India rarely arrives on its own. The statutory basis and the current requirements are set out on the IS Audit & ITGC Review India service page, and the related services are grouped under Business Transformation.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On IS Audit & ITGC Review India we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.