IT General Controls

What are IT General Controls (ITGC)?

• A. IT General Controls are controls that apply to all systems components, processes and data for an organisation

• B. IT General Controls are controls that only apply to the logical access of a system for an organisation

• C. IT General Controls are controls only performed centrally for all applications

What are the objectives of IT General Controls?

• A. To ensure compliance with our Auditing Standards

• B. To ensure the proper development and implementation of applications as well as the integrity of programs data files and computer operations

• C. To ensure the proper development and implementation of applications as well as the integrity of programs data files and computer operations

What is the scope of IT General Controls?

• A. Segregation of Duties, Physical Security, Logical access controls, Change controls, Backup & continuity, IT operations

• B. Physical Security, Logical access controls, Change controls, Backup & continuity, IT operations

• C. Application mapping and data flows

• D. Physical Security, Logical access controls, Change controls, Backup & continuity, IT operations, SOC reports

Examples of risk mitigation are:

• A. Identification of compensating controls

• B. New sampling

• C. Increase of tests, i.e. Journal entry testing

What are the consequences of an unmitigated deficiency having a potential impact on the Financial Statement?

• A. No reliance on the IT Environment

• B. No reliance on the IT Application Controls

• C. Not able to perform Data Analytics

What is a SOC report?

• A. A Service Organisation Control Report

• B. A Service Operations Control Report

• C.A Specific Operation Centre Report

According to the MAM, what is the scope of IT General Controls for Backup & Continuity?

• A. There is no specific scope

• B. ​Out of a total of five tests in the Backup & Continuity area, the first test regarding the Backup Strategy is mandatory whatever the Client sector. The 4 other tests are mandatory for Financial services and Retail activities when the risk profile is high.

• C. Full tests of the Backup & Continuity area is mandatory whatever the sector and the risk assessment

Why is the Understanding the IT Environment and IT Specialist Involvement document crucial for IT General Controls?

• A. To describe the IT Environment and share the information with the rest of the Audit team

• B. To define the scope of applications relevant to the IT General Controls

• C. To understand the capability and fraud sensitivity of the IT employees of the organisation

Physical Security measures are:

• A. In place to protect employees and assets

• B. In place to prevent, detect and mitigate risks relating to theft, temperature, fire, smoke, water, vibration, terror, vandalism, power outages, chemicals or explosives

• C. In place to protect premises and buildings to determine that these are structurally well designed

Physical security control activities cover:

• A. Access restricted to authorised staff

• B. Access granted upon completion of a specific request form

• C. A regular review of the list of staff authorised to access the server rooms