Information Systems Audit (IS Audit) & ITGC Review

An IS Audit is an independent examination of the governance, security, and operational controls around an organisation's IT environment — the applications, databases, operating systems, networks, and data centres that support business processes and financial reporting. It assesses whether the organisation's IT controls are properly designed and are actually operating as intended, rather than merely documented in a policy.

ITGCs are the foundational controls over the IT environment that all application-level and automated financial controls depend on. They fall into four domains: access management (how user access is granted, changed, and revoked), change management (how changes to programs and configuration are tested and approved before going live), IT operations (batch jobs, interfaces, backups, incident management), and physical/environmental security (data centre and server room controls).

Under Section 134(5)(e) of the Companies Act 2013, the Board must certify that internal financial controls are adequate and operating effectively. Most modern financial controls — automated postings, system-calculated tax, approval-workflow-enforced payment authorisation — depend entirely on the IT environment underneath them. A weak ITGC (an exited employee's access left active, an unauthorised production change) can silently undermine every application control built on top of it, which is why statutory auditors test ITGCs as part of Internal Financial Controls over Financial Reporting (IFC-FR) assessment.

There is no single blanket statutory mandate requiring every company to commission a standalone IS Audit. However, the underlying obligation — adequate and effective internal financial controls — is mandatory for listed companies and prescribed classes of unlisted companies under Section 134(5)(e), and the statutory auditor is required to test and report on IFC-FR under CARO for applicable companies. In practice, most such companies find that a dedicated ITGC review is the most reliable way to demonstrate and evidence that obligation. Regulated entities — banks, NBFCs, insurers — face additional sector-specific IT governance and outsourcing circular requirements from RBI or IRDAI that may mandate periodic independent IS audit.

A VAPT (Vulnerability Assessment and Penetration Testing) engagement tests whether your network and applications can be technically exploited from outside or inside the perimeter — it is an attack-simulation exercise. An ITGC review tests whether your governance controls around access, change, and operations are properly designed and consistently followed — it is a control-assurance exercise, closer in nature to a financial controls audit than to ethical hacking. The two are complementary: a VAPT can find a technical vulnerability, while an ITGC review finds the governance gap (weak access recertification, unmonitored privileged accounts) that made the vulnerability exploitable or the breach undetected for longer.

An ERP/application controls audit goes deep into a single application's configuration — segregation of duties within specific modules, approval workflow settings, tolerance limits, three-way matching. An ITGC review sits at a broader, foundational layer — access and change management across all in-scope systems (which may include the ERP, but also databases, operating systems, and network infrastructure), IT operations, and physical security. ITGCs are, in effect, the control environment that application-level controls rely on for their own integrity.

For a mid-sized single-location organisation with a defined systems landscape, a realistic timeline from kickoff to Board presentation is 7–9 weeks, covering scoping, testing across all four ITGC domains, findings validation, and reporting. Multi-entity organisations, regulated BFSI entities, and organisations with significant outsourced IT operations typically require a longer first cycle because of the additional evidence-gathering and coordination involved.

Fees depend on the number of in-scope systems, locations, whether infrastructure is on-premise, cloud, or hybrid, and whether the engagement is a standalone review or coordinated with statutory audit IFC testing. PNPC agrees a fixed, written scope and fee before any fieldwork begins — there are no open-ended time-and-material surprises. We are transparent that a properly resourced ITGC review, conducted by CAs with IT audit training rather than a generic checklist provider, costs more than a template-driven review — and consistently delivers findings that a template approach misses.

It can be commissioned by any of the three, and often is a joint decision. Audit Committees commission it as part of their governance oversight responsibility. CFOs commission it to support the IFC-FR certification and to pre-empt statutory audit management letter points. Internal Audit functions commission it because most internal audit teams lack the specialist skills to test access logs, change tickets, and system configuration evidence to the depth required.

A Critical rating means the control gap creates a material and immediate risk — for example, several exited employees with active privileged access to the financial system, or evidence of unauthorised changes made directly to production without any approval trail. Critical findings are escalated to the Audit Committee or Board immediately upon identification during fieldwork, rather than held back for the final report, and PNPC recommends an interim validation check (rather than waiting for the next full annual cycle) to confirm remediation before it becomes a statutory audit issue.

It changes the evidence sources but not the underlying control objectives — the organisation remains accountable for the effectiveness of controls even when IT operations are outsourced. We review the managed service provider's contractual obligations around access control, change management, and incident notification, request relevant third-party attestations (SOC 2 report, ISO 27001 certificate) where available, and test the organisation's own oversight controls over the outsourced arrangement — because 'we outsourced it' is not itself a control.

Yes — cloud hosting shifts some control responsibilities to the cloud provider under a shared-responsibility model, but the organisation retains responsibility for access management within the applications, user provisioning and de-provisioning, configuration of security settings, and oversight of the cloud provider's own control attestations. We review the cloud provider's SOC 2 report or ISO 27001 certificate as evidence of infrastructure-level controls, and focus our direct testing on the layers the organisation itself controls — user access, application configuration, and data governance.

Operating effectiveness — meaning we test actual evidence (access logs, change tickets, approval records, backup restore logs) over the audit period, not just whether a policy document exists. A documented access management policy that is not actually followed provides no real assurance, and testing only the existence of policy would give a false sense of comfort to the Board.

A well-scoped ITGC review can directly support and reduce duplication in the statutory auditor's IFC-FR testing — evidence gathered and findings validated in the ITGC review can be shared with (or independently relied upon by) the statutory auditor, subject to their own professional judgement on the extent of reliance permitted under the Standards on Auditing. This typically results in a smoother year-end audit with fewer surprises and can reduce incremental statutory audit fees for IT-control testing.

SOC 1 and SOC 2 are formal, structured assurance reports (aligned to AICPA SSAE 18 / ISAE 3402-type standards) that a service organisation commissions specifically to give its own customers' auditors independent assurance over its controls — SOC 1 focused on controls relevant to customers' financial reporting, SOC 2 focused on the Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy). An internal ITGC review, by contrast, is commissioned for the organisation's own Board and Audit Committee. Many organisations use an internal ITGC review as preparation before pursuing a formal SOC 1/SOC 2 engagement, since the underlying control domains substantially overlap.

We obtain the full current user access listing for each in-scope system, cross-reference it against HR's exit report for the audit period, and identify any exited employee whose system access was not revoked (or not revoked within a reasonable timeframe). We also sample new-joiner and role-change requests to confirm access was granted only after proper approval, and review whether privileged/administrator accounts are subject to periodic recertification. This is consistently one of the highest-finding-rate test areas in first-time reviews.

We pull the change log or ticketing system record for the audit period, select a sample of changes (weighted towards higher-risk changes — configuration changes affecting financial postings, tax calculation logic, or access controls themselves), and trace each sampled change to a documented business justification, evidence of testing or UAT sign-off, and appropriate authorisation before it was deployed to the production environment. We also test whether development, testing, and production environments are properly segregated, and who holds the ability to move changes between them.

We specifically look for evidence of periodic restore or recovery testing — an untested backup provides no real assurance of recoverability and is, in practical terms, not yet a proven control. We review the backup schedule and retention policy, and separately request evidence (a restore test log, a DR drill report) confirming that a backup was actually restored successfully within the audit period.

Our methodology draws on COBIT (Control Objectives for Information and Related Technologies) for the control domain structure, ISO 27001-aligned practice for information security control benchmarks, and the ICAI Guidance Note on Audit of Internal Financial Controls for the linkage to Section 134(5)(e) and CARO reporting requirements. For regulated BFSI clients, we additionally incorporate the relevant RBI or IRDAI IT governance and outsourcing circular requirements into scope.

Findings are rated Critical, High, Medium, or Low based on the combination of the likelihood of the control failing and the potential financial or operational impact if it does. Critical findings represent immediate, material exposure (active access for terminated employees with financial system privileges, unauthorised production changes with no approval trail) and are escalated to management as soon as identified during fieldwork, not held for the final report. High and Medium findings are documented with clear remediation recommendations and realistic timelines; Low findings are typically process-hygiene observations that strengthen the control environment without representing immediate risk.

Yes — this is one of the most common reasons listed companies commission a dedicated ITGC review. The findings and remediated evidence directly support the Board's basis for its Section 134(5)(e) internal financial controls certification, and give the CFO and Audit Committee documented assurance ahead of the statutory auditor's own IFC-FR testing, reducing the risk of a late-discovered gap becoming a CARO qualification or audit management letter point at year-end.

Most internal audit teams, even well-resourced ones, are staffed primarily with finance and operations audit skills rather than IT audit specialists trained to independently test access logs, change tickets, database configuration, and system-level evidence. RBI's IT governance and outsourcing frameworks for regulated entities typically expect a level of specialist IT audit rigour that general internal audit resourcing does not always provide. A dedicated IS Audit/ITGC review, whether performed by PNPC directly or used to strengthen and train the internal audit function's approach, closes that specialist gap.

IT General Controls (ITGCs) are pervasive controls that apply across an entire IT environment — access management, change management, IT operations, physical security — and support the reliability of every system running within that environment. IT Application Controls are specific, automated controls built into a particular application — a mandatory three-way match before payment, a system-enforced approval limit, a validation rule preventing negative inventory. Application controls can only be relied upon if the ITGC environment beneath them is sound; a weak ITGC environment (someone with unauthorised database access) can bypass even a well-designed application control.

Access management and change management controls tested as part of an ITGC review directly support data protection objectives — since unauthorised access is the most common root cause of a personal data breach — but a full DPDP Act compliance assessment (consent management, data processing agreements, breach notification readiness, data localisation) is a distinct and broader engagement. Where relevant to the organisation's data processing footprint, we flag DPDP-related control gaps we observe during the ITGC review and recommend a dedicated compliance assessment where warranted.

Annual is the typical cadence for organisations with an ongoing IFC-FR certification obligation, regulatory IT governance requirement, or customer SOC reporting need — aligning with the statutory audit and Board certification cycle. Organisations without a recurring formal obligation often commission it every 18–24 months, or trigger an interim review after a major system change, security incident, or before a significant transaction (fundraise, acquisition) where IT control assurance will be scrutinised.

Yes, though the scope and depth should be proportionate. A smaller company with a single ERP, limited applications, and a lean team can still commission a scoped ITGC review — often focused primarily on access management and change management, the two domains that carry the highest risk-to-effort ratio — without the full multi-system, multi-location scope a large enterprise would require. PNPC scopes the engagement to the organisation's actual risk profile and size rather than applying a one-size-fits-all enterprise checklist.

A detailed findings report with each finding rated by severity, mapped to the relevant control domain and risk, accompanied by a specific recommendation; a management response and remediation roadmap document with named owners and timelines; and an executive summary presentation delivered directly to the Audit Committee or Board in plain-language terms. For engagements linked to statutory audit or regulatory submission, we also prepare a summary memo cross-referencing findings to the relevant CARO/IFC-FR or regulatory reporting requirement.

Every finding is shared in draft with the relevant process owner for factual accuracy review before the report is finalised — if management believes a finding is factually incorrect (for example, evidence exists that we did not receive during fieldwork), we review the additional evidence and revise the finding if warranted. Where management disagrees with our assessment of risk or the recommended remediation despite the facts being accurate, that disagreement — and management's stated rationale — is documented transparently in the final report rather than silently omitted.

The IS Audit / ITGC review itself is an independent assurance engagement — consistent with maintaining independence, PNPC does not implement the remediation for gaps we have audited, since doing so would create a self-review conflict for any subsequent assurance cycle. We do provide practical, specific, implementable recommendations for each finding, and can advise on remediation approach and best practice, but implementation is carried out by the organisation's own IT team or a separate implementation partner.

Yes. We scope multi-system, multi-entity landscapes explicitly at the outset — identifying which systems are material to financial reporting or the specific regulatory/customer assurance requirement, and prioritising testing depth accordingly rather than spreading effort thinly and evenly across every system regardless of materiality. Legacy systems with limited vendor support often carry elevated ITGC risk (unpatched vulnerabilities, informal change processes) and are specifically flagged for closer review.

Yes. For clients with operations or group entities in both India and the UAE, PNPC coordinates IS Audit / ITGC engagements across both jurisdictions from our Chennai/Bangalore/Hyderabad and Dubai offices under a single engagement team — relevant where a UAE entity's systems feed into an Indian parent's consolidated financial reporting, or where UAE Corporate Tax and VAT compliance depend on system-generated data whose integrity needs independent assurance.

A generic IT/cybersecurity firm brings technical infrastructure expertise but often lacks the Chartered Accountant's grounding in financial reporting risk, IFC-FR, CARO, and Companies Act governance requirements — meaning their findings, however technically sound, may not translate cleanly into what the Board and statutory auditor actually need. PNPC combines practising CA judgement on financial control objectives with structured IT audit methodology, so findings are framed in terms the Audit Committee can act on and that map directly to statutory and regulatory reporting obligations.

We minimise disruption by requesting evidence in structured batches rather than ad-hoc, and scheduling interviews with IT and process owners in defined windows rather than open-ended access. For a mid-sized single-location engagement, realistic internal effort is typically a designated IT coordinator's part-time involvement across the fieldwork period, plus brief interview time from a handful of process owners (access administrator, change manager, backup/DR owner).