IT General Controls (ITGC) explained: the four domains

IT General Controls, or ITGCs, are the foundational controls over the systems that process your financial and operational data. They are not glamorous, but they are the controls auditors check first, because almost everything else depends on them. If your ITGCs are weak, an auditor cannot trust an automated control or a system-generated report, no matter how good either looks.

The four core domains

• Access to Programs & Data: who can get into a system and what they can do. Provisioning when people join, adjusting when they move, removing access promptly when they leave, periodic access reviews, privileged access, strong authentication and MFA.
• Change Management: changes to systems are requested, tested, approved and moved to production by someone other than the developer, with development, test and production kept separate.
• Computer Operations: scheduled jobs run and are monitored, backups are taken and, crucially, restoration is tested, and incidents are logged and resolved.
• Program Development (SDLC): new systems and major changes are authorised, tested, have their data migration validated, and are approved before go-live. This domain only applies when you actually have a project in flight.

Why ITGCs matter more than they look

ITGCs exist so two things can be trusted: automated application controls, and the reports that controls rely on (what auditors call Information Produced by the Entity, or IPE). When the IT general controls behind an automated control are effective, an auditor can test that control once instead of sampling it. When they are not, the reliance collapses and the work multiplies. That leverage is why ITGCs are the highest-value controls most organisations own.

The same controls, in every framework

Here is the quiet truth: the same access reviews, change tickets and backup logs are tested for SOX, for SOC 2 (criteria CC6, CC7 and CC8) and for ISO 27001 (Annex A). Most teams document them three times. Compliance One ships ITGC as a dedicated, framework-neutral hub and cross-maps each control to ISO 27001 and SOC 2, so one test's evidence counts across frameworks rather than being re-gathered for each audit.

ITGCs are the controls everything else leans on. Get them right once, and every audit gets easier.