What to Expect During an IT Controls Assessment

Establish the Scope and Understand the Environment

An IT controls assessment can require participation from technology personnel, business process owners, management, and other stakeholders throughout an organization. For individuals who do not routinely participate in audits or assessments, the process can sometimes appear more burdensome or disruptive than necessary.

Much of this concern can be reduced when participants understand the purpose of the assessment, what information will be requested, and how the results will be evaluated.

An effective assessment should not simply identify exceptions. It should provide management with a better understanding of whether controls are appropriately designed, operating as intended, and adequately addressing the risks they were established to mitigate.

The assessment generally begins with understanding its objectives and scope.

Depending upon the purpose of the review, the scope may include IT general controls, application controls, cybersecurity requirements, regulatory obligations, financial systems, or specific areas of technology risk.

The assessor will also need to understand the organization's operating environment. This may include reviewing system inventories, organizational structures, policies and procedures, prior assessments, process documentation, system diagrams, and other relevant information.

These activities help establish which systems, processes, controls, and personnel should be included in the assessment.

A clearly defined scope is important. Assessing controls that have little relationship to the relevant risks can consume resources without providing meaningful assurance. Conversely, an incomplete scope may overlook systems or processes that are important to the assessment objectives.

Expect Interviews and Walkthroughs

Documentation provides useful information, but it does not always demonstrate how a process actually operates.

Assessors will typically conduct interviews or walkthroughs with individuals responsible for performing or overseeing relevant activities. During these discussions, participants may be asked to explain how access is granted, how system changes are approved, how configurations are managed, how security events are monitored, or how other controls are performed.

Walkthroughs may also involve observing a process or reviewing examples of how a control operates.

The objective is not to test the individual's knowledge or find inconsistencies in an explanation. It is to develop an accurate understanding of the process and determine whether the documented control reflects actual practices.

These discussions frequently identify differences between policies, documented procedures, and day-to-day operations that may warrant further evaluation.

Supporting Evidence Will Be Requested

Assessors generally need evidence to determine whether controls operated during the period being reviewed.

Evidence may include access listings, approvals, system-generated reports, configuration settings, change records, meeting documentation, screenshots, training records, monitoring reports, or other information demonstrating that a control was performed.

For controls that operate repeatedly, the assessor may select a sample of transactions or activities for testing.

Providing evidence that is complete, relevant, and clearly associated with the control can significantly improve the efficiency of the assessment. Organizations should also be prepared to explain how reports or other information used in performing controls are generated and why that information can be relied upon.

Exceptions Do Not Automatically Mean Control Failure

Testing may identify situations in which a control was not performed exactly as expected. These exceptions require evaluation, but an exception does not always mean that the entire control environment is ineffective.

The assessor should consider the nature and frequency of the exception, the risk associated with the control, whether other controls address the same risk, and the potential impact of the condition.

Management may also have additional information that provides important context.

For this reason, communication throughout the assessment is important. Preliminary issues should be discussed with responsible personnel so that facts can be confirmed and relevant information considered before conclusions are finalized.

The Assessment Should Lead to Action

At the conclusion of the assessment, management should understand what was evaluated, what worked effectively, where weaknesses were identified, and why those weaknesses matter.

Recommendations should be practical and proportionate to the related risk. In some cases, remediation may require implementing or redesigning a control. In others, the appropriate action may involve improving documentation, clarifying responsibility, strengthening monitoring, or making an existing process more consistent.

The objective should not simply be to complete the assessment and close findings.