IT general controls

IT general controls are the foundational policies and procedures that ensure an organization's information systems operate reliably and securely. They apply across the entire IT environment rather than to a specific business process or single application. These controls provide the necessary baseline of trust required for automated application controls to function effectively.

In practice

An auditor verifies these by reviewing evidence of quarterly user access reviews, checking that code changes were formally approved before being moved to production, and confirming that system backups are completed successfully.