The ITGC controls auditors scrutinise most: access reviews, IPE and SoD

If ITGCs are where auditors look first, these are the controls they look at hardest. The findings repeat year after year, and almost all of them are avoidable with a little structure.

User access reviews: completeness and real review

The common failure is not that the review did not happen, it is that it was a rubber stamp over an incomplete list. The review must cover the full user population (the list itself is a report whose completeness has to be established), and there must be evidence the reviewer actually evaluated entitlements and removed what was wrong, not just signed.

Termination timeliness, not eventual removal

For leavers, the testable attribute is the lag between the termination date and the moment access was disabled. One user removed late can be an exception even when ninety-nine out of a hundred were on time. Measure and evidence the timeliness, do not just confirm access is gone.

IPE: the report must be trustworthy

Any report, query or spreadsheet used in a control is Information Produced by the Entity, and its completeness and accuracy must be validated before the control that relies on it can be trusted. 'It came from the ERP' is not validation. Custom queries and end-user spreadsheets carry the highest risk, and are a recurring source of findings.

Segregation of duties: conflict is not the same as incident

Build the SoD conflict matrix from actual entitlements, not job titles. Having conflicting access is a finding; exercising it is an incident. Where a conflict cannot be removed, the mitigating control (an independent review of the conflicted user's activity, or dual authorisation) must genuinely operate and be tested, not merely asserted.

Access reviews, report validation and segregation of duties: three controls, most of the findings. Structure them and the audit gets quiet.