IS Audit & ITGC Review India: The Process, Start to Finish
The mechanics of IS Audit & ITGC Review India are what clients ask about once they have decided to proceed. The questions below are the ones raised most often in practice; the full scope of the service is on the IS Audit & ITGC Review India page.
What are IT General Controls (ITGCs), specifically?
ITGCs are the foundational controls over the IT environment that all application-level and automated financial controls depend on. They fall into four domains: access management (how user access is granted, changed, and revoked), change management (how changes to programs and configuration are tested and approved before going live), IT operations (batch jobs, interfaces, backups, incident management), and physical/environmental security (data centre and server room controls).
In practice: Think of ITGCs as the foundation of a building. A perfectly configured approval workflow in your ERP (an application control) is worthless if someone with unrevoked access can bypass it entirely at the database level — that is an ITGC failure undermining an application control.
Why do ITGCs matter for financial reporting specifically?
Under Section 134(5)(e) of the Companies Act 2013, the directors of a listed company must state that internal financial controls are adequate and operating effectively; for other companies the auditor reports on internal financial controls under Section 143(3)(i), subject to exemptions for small companies, one person companies and certain private companies. Most modern financial controls — automated postings, system-calculated tax, approval-workflow-enforced payment authorisation — depend entirely on the IT environment underneath them. A weak ITGC (an exited employee's access left active, an unauthorised production change) can silently undermine every application control built on top of it, which is why statutory auditors test ITGCs as part of Internal Financial Controls over Financial Reporting (IFC-FR) assessment.
In practice: Companies can invest heavily in application-level controls — sophisticated approval matrices, tolerance limits — while the ITGC layer beneath remains untested. It is the equivalent of installing an expensive lock on a door while leaving a window open.
How is an ITGC Review different from a cybersecurity audit or VAPT?
A VAPT (Vulnerability Assessment and Penetration Testing) engagement tests whether your network and applications can be technically exploited from outside or inside the perimeter — it is an attack-simulation exercise. An ITGC review tests whether your governance controls around access, change, and operations are properly designed and consistently followed — it is a control-assurance exercise, closer in nature to a financial controls audit than to ethical hacking. The two are complementary: a VAPT can find a technical vulnerability, while an ITGC review finds the governance gap (weak access recertification, unmonitored privileged accounts) that made the vulnerability exploitable or the breach undetected for longer.
In practice: Organisations sometimes commission a VAPT expecting it to also validate their access management and change control discipline. It does not — the two engagements test fundamentally different things, and we recommend both where budget allows, scoped clearly to avoid overlap and gaps.
How is this different from an ERP or application controls audit?
An ERP/application controls audit goes deep into a single application's configuration — segregation of duties within specific modules, approval workflow settings, tolerance limits, three-way matching. An ITGC review sits at a broader, foundational layer — access and change management across all in-scope systems (which may include the ERP, but also databases, operating systems, and network infrastructure), IT operations, and physical security. ITGCs are, in effect, the control environment that application-level controls rely on for their own integrity.
In practice: It often makes sense to start with an ITGC review before commissioning a deep ERP application audit — a weak ITGC environment can undermine confidence in application-level findings, so establishing the foundation first produces a more reliable overall assurance picture.
We are entirely cloud-hosted (SaaS applications, cloud infrastructure). Is an ITGC review still relevant?
Yes — cloud hosting shifts some control responsibilities to the cloud provider under a shared-responsibility model, but the organisation retains responsibility for access management within the applications, user provisioning and de-provisioning, configuration of security settings, and oversight of the cloud provider's own control attestations. We review the cloud provider's SOC 2 report or ISO 27001 certificate as evidence of infrastructure-level controls, and focus our direct testing on the layers the organisation itself controls — user access, application configuration, and data governance.
In practice: A common misconception is that moving to the cloud transfers all IT control responsibility to the provider. It does not — access management within your SaaS applications remains entirely your organisation's responsibility, and it is the area we find the most unaddressed gaps in cloud-native companies.
How does the ITGC review interact with our statutory auditor's work?
A well-scoped ITGC review can directly support and reduce duplication in the statutory auditor's IFC-FR testing — evidence gathered and findings validated in the ITGC review can be shared with (or independently relied upon by) the statutory auditor, subject to their own professional judgement on the extent of reliance permitted under the Standards on Auditing. This typically results in a smoother year-end audit with fewer surprises and can reduce incremental statutory audit fees for IT-control testing.
In practice: We coordinate timing with the statutory audit cycle wherever the CA firm is different from PNPC, so that our ITGC review evidence is available and relevant when the statutory auditor performs IFC-FR testing — rather than the two exercises running on unrelated timelines and duplicating effort.
How does PNPC rate findings, and what do the severity levels mean?
Findings are rated Critical, High, Medium, or Low based on the combination of the likelihood of the control failing and the potential financial or operational impact if it does. Critical findings represent immediate, material exposure (active access for terminated employees with financial system privileges, unauthorised production changes with no approval trail) and are escalated to management as soon as identified during fieldwork, not held for the final report. High and Medium findings are documented with clear remediation recommendations and realistic timelines; Low findings are typically process-hygiene observations that strengthen the control environment without representing immediate risk.
In practice: We resist the temptation to inflate minor observations to High or Critical to make the report look more thorough — an over-rated report loses management's trust and makes it harder to get attention for the findings that genuinely matter.
How often should we repeat an IS Audit / ITGC Review?
Annual is the typical cadence for organisations with an ongoing IFC-FR certification obligation, regulatory IT governance requirement, or customer SOC reporting need — aligning with the statutory audit and Board certification cycle. Organisations without a recurring formal obligation may commission it periodically, or trigger an interim review after a major system change, security incident, or before a significant transaction (fundraise, acquisition) where IT control assurance will be scrutinised.
In practice: We advise against treating this as a one-time exercise regardless of your regulatory obligation. Access grants drift, staff turnover continues, and new systems get added — an environment reviewed once and never again reverts to an unreviewed state within a year or two.
What if management disagrees with a finding — how is that handled?
Every finding is shared in draft with the relevant process owner for factual accuracy review before the report is finalised — if management believes a finding is factually incorrect (for example, evidence exists that we did not receive during fieldwork), we review the additional evidence and revise the finding if warranted. Where management disagrees with our assessment of risk or the recommended remediation despite the facts being accurate, that disagreement — and management's stated rationale — is documented transparently in the final report rather than silently omitted.
In practice: We do not water down or remove a finding simply because management is uncomfortable with it. Our obligation is to the Audit Committee and Board who commissioned independent assurance — a report edited to avoid disagreement stops being independent assurance.
Where this sits in the wider engagement
IS Audit & ITGC Review India rarely arrives on its own. The statutory basis and the current requirements are set out on the IS Audit & ITGC Review India service page, and the related services are grouped under Business Transformation.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On IS Audit & ITGC Review India we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.