Many finance and operations leaders assume an "IT audit" means checking whether antivirus software is installed. In reality, IT and systems audit covers the controls that protect data integrity, prevent unauthorised access, and keep core business systems trustworthy — issues that affect financial reporting as much as they affect technology.
IT General Controls (ITGCs)
These are the foundation of any systems audit:
- Access management — are user accounts created, modified, and removed through a documented process? Do former employees still have active logins?
- Change management — are changes to financial or operational systems tested and approved before going live, or can one person push changes directly to production?
- Backup and recovery — are backups tested, not just scheduled? A backup that has never been restored is not a backup you can rely on.
- Segregation of duties within systems — can the same user create a vendor, approve a payment to that vendor, and reconcile the bank account, all without a second person involved?
ERP and Financial System Reviews
For organisations running platforms like SAGE, SAP, or Oracle, we review the system's configuration against the organisation's actual control intentions — approval workflows, posting permissions, and audit trail settings are common areas where the system allows far more than policy intends.
Data Analytics in Audit
Rather than sampling a handful of transactions, data analytics techniques let us test entire transaction populations — flagging duplicate payments, unusual approval patterns, weekend or after-hours transactions, and round-number anomalies that manual sampling would likely miss entirely.
Why This Matters Even Without a Dedicated IT Team
Smaller organisations often assume IT audit is only relevant to large enterprises with complex systems. In practice, the opposite is often true — without a dedicated IT department, controls are more likely to be informal, undocumented, or dependent on a single person who happens to know how things work.
An IT systems audit is independent by design — it routinely covers systems implemented by third parties, in-house teams, or whoever was around when the system was first set up.
What You Get at the End
A clear, risk-rated set of findings — distinguishing genuinely critical control gaps from minor housekeeping items — with practical recommendations your team can actually implement, and a follow-up review to confirm they did.
Contact our IT & Systems Audit team for a scoping discussion tailored to the systems you actually run.
