IT Audit, ITGC & ITAC
ITGC evidence is commonly requested by external auditors, while internal audit functions are expected to hold IT audit capability. Among Hong Kong organisations below 500 staff, having both in house is uncommon.
Access to programs and data
Provisioning, privileged access, periodic access review, MFA — and the evidence that reviews happened.
Program changes
Change requests, testing, approval, and segregation between developer and production.
Program development
Project approval, requirements, testing and data migration controls.
Computer operations
Job scheduling, monitoring, incident handling, backup and restore testing.
IT application controls
Input, processing and output controls; interface controls; key reports.
Segregation of duties
We identify roles where a single person can both create a vendor and approve a payment.
Frequently asked
Does ITGC evidence also serve ISO/IEC 27001?
Largely yes. Access control, change management and operations evidence overlaps significantly with Annex A controls, so one body of evidence can serve both.
What is the difference between ITGC and ITAC?
ITGC are the controls over the systems themselves. ITAC are the controls inside a specific application that keep a transaction complete, accurate and valid.
Do you issue an audit opinion?
No. We perform control testing and review under an advisory engagement. The audit opinion belongs to your external auditor.
Consultancy fee refund commitment
If your organisation is not recommended for certification at the first certification audit, we refund our consultancy fee in full.
Conditions: the agreed corrective actions are completed, the required records and evidence are provided, and the audit is conducted by an accredited certification body within three months of our readiness sign-off. The commitment covers our consultancy fee only, not the certification body's fees.
Request a quotation
Tell us which standard or service you need. If you are not sure, tell us what the client or regulator is asking for and we will work it out.