We support internal audit and leadership teams that need a clear view of technology risk and control effectiveness — helping scope focused reviews, examine evidence and report findings that management can act on.
Engagements can support an internal audit plan, a specific risk concern or a need for additional specialist delivery capacity. The output is an assurance opinion that explains what was tested, what evidence was available, where the control failed and what management should do next—not a checklist of technology jargon.
The service is for audit committees, heads of internal audit, finance leaders and boards at UK and European scale-ups, regulated businesses and groups whose technology risk has outgrown their in-house audit coverage. It suits a company with a small internal audit team that needs cloud or cyber expertise, a business preparing for a customer assurance review, or a group integrating an acquisition and needing a consistent view of controls.
The audit question may concern a single critical SaaS platform, the IT general controls supporting financial reporting, a cloud migration, resilience, privileged access or a third-party service. We agree the objective and criteria before fieldwork so an ITGC review is not confused with an ISO 27001 internal audit, penetration test or certification audit.
Common triggers include a board asking whether a material cyber risk is controlled, an external auditor raising questions about access or change management, a customer requesting independent evidence, an acquisition bringing an unfamiliar technology estate, or a planned ISO 27001, SOC 2 or regulatory review. A serious incident may also prompt a targeted review of backup restoration, logging, incident response or supplier oversight.
In each case, the scope should answer a specific question: can only authorised people access production, are changes approved and traceable, can the business recover a critical service, or does management know when a supplier control has failed? Narrowing the question makes the report more useful and the testing more defensible.
They typically expect a documented scope, risk assessment, control criteria, walkthrough notes, evidence request and sampling rationale. For access, that may include joiner/mover/leaver tickets, privileged-role listings, periodic review sign-off and removal evidence. For change management, it may include a population of production changes, approvals, testing and emergency-change review. For operations, auditors look at monitoring, backup success, restoration tests, vulnerability handling and incident records.
They also ask whether a control operated throughout the review period, not only on the day of the interview. A report should state populations, sample selection, exceptions, compensating controls and limitations. It should distinguish a design gap from an operating failure and avoid implying that an unactioned recommendation is already closed.
We develop a risk-based scope, control matrix and evidence request around your systems, period and reporting needs. Fieldwork combines interviews, process walkthroughs, configuration review and sample testing. We speak with control owners as findings emerge, validate factual accuracy and give management an opportunity to explain compensating controls without weakening the independence of the conclusion.
Review areas can include identity and privileged access, secure configuration, change and release management, IT operations, vulnerability management, incident response, backup and resilience, supplier governance, asset inventory, data protection and security governance. We can align criteria to internal policy, ISO 27001, SOC 2 trust services criteria, COBIT or an agreed financial-audit control objective. We do not claim that one ITGC review proves compliance with every framework.
Clients receive a signed engagement scope, risk and control matrix, evidence request, walkthrough records, test sheets, exceptions log, draft findings for factual review and a final report for management and the audit committee. Findings state the expected condition, evidence observed, root cause where known, risk implication, severity, owner, target date and recommended action. A management action tracker records whether the response addresses the original risk.
For a follow-up review, we retest agreed actions against evidence such as a completed quarterly access review, approved change sample, successful recovery exercise or supplier review. The result says whether the action is implemented, partially implemented or still open, with limitations clearly recorded.
A focused ITGC or single-system review commonly takes three to six weeks. Week one confirms scope, criteria, populations and evidence access. Weeks two and three cover walkthroughs and testing; week four is used for analysis, management discussions and reporting. Larger estates, multiple countries, weak evidence retention or a long audit period may require six to ten weeks.
We can deliver a defined work package, co-source with your internal audit team or provide specialist support under your methodology. Reporting lines, access to evidence, confidentiality and any reliance on other assurance work are agreed at the outset.
A review may find that terminated users are removed from the identity provider promptly but remain active in a production database, or that emergency changes are made appropriately but never reviewed after deployment. It may find that backups report “successful” while no restore test demonstrates recovery within the business target, or that a critical cloud supplier is assessed at onboarding but not when its service or subprocessor changes. These are actionable observations because they name the system, control owner and missing evidence.
We agree reporting lines and conflict safeguards at the start. Where our team has supported implementation, audit assignments must preserve appropriate objectivity; this may require different personnel or another provider. Management remains responsible for operating controls, accepting risk and selecting remediation. Advisory support can follow the report, but it is scoped so the assurance conclusion remains clear.
Yes. The scope can be a defined work package or co-sourced specialist support, with reporting lines and objectivity agreed at the start.
Not necessarily. Coverage and sampling depend on the risk, population and agreed assurance approach; limitations and their effect are explained.
A focused ITGC review commonly takes three to six weeks, including planning, walkthroughs, testing and reporting. A multi-system or multi-country review takes longer.
Advisory support can be scoped separately with objectivity safeguards. Management remains responsible for choosing and operating the corrective action.
Tell us about the systems and risk areas you need covered.
Book a working session →