What Is an ITGC Assessment and Why It Matters
If your organization is subject to SOX, ISO 27001, FedRAMP, or similar frameworks, you are almost certainly subject to scrutiny over your IT General Controls. An ITGC assessment is a structured evaluation of the foundational IT controls that underpin your financial reporting systems, operational security, and regulatory compliance posture. Auditors—whether internal, external, or government-affiliated—use ITGC assessments to determine whether your technology environment can be trusted to produce reliable, secure, and auditable outputs.
For defense contractors, federal agencies, and healthcare organizations, a failed or poorly documented ITGC assessment is not just an audit finding. It can trigger contract risk, impact your authorization to operate, or draw unwanted regulatory attention. Understanding what auditors expect—and preparing deliberately—is the difference between a clean opinion and a remediation spiral.
This guide is written for IT and compliance teams who need a practical, sequenced approach to ITGC assessment readiness. Whether you are facing your first assessment or tightening up ahead of an annual review, these steps will put you in a defensible position.
The Four Core ITGC Domains Auditors Evaluate
Before you can prepare effectively, you need to understand what an ITGC assessment actually covers. Most assessments evaluate controls across four primary domains:
- Access Management: Who has access to systems, how access is provisioned and deprovisioned, and whether privileged access is appropriately restricted and reviewed.
- Change Management: How software changes, patches, and configuration updates are tested, approved, and deployed into production environments.
- IT Operations: How systems are monitored, how jobs are scheduled and logged, and how availability and performance are maintained.
- Program Development: How new systems or major modifications are developed, tested, and approved before going live.
Auditors will examine evidence across all four domains. Gaps in any one area—even if your other controls are strong—can result in findings that require formal remediation. Our post on what IT general controls actually are provides a useful foundation if your team is new to this terminology.
Step 1: Define Your Assessment Scope
The first step in ITGC assessment preparation is determining what systems, applications, and environments fall within scope. This is not a decision to make informally. Work with your compliance lead, external auditors, and system owners to define the boundary clearly and document it.
Scope definition should answer the following questions:
- Which systems directly support financial reporting, CUI handling, or regulated data processing?
- Which third-party systems or cloud environments are integrated with in-scope systems?
- Which teams own or operate each in-scope system?
If your organization handles Controlled Unclassified Information or operates under DFARS, your scope definition must align with your System Security Plan boundary. The disciplines of IT compliance services and risk management overlap significantly here, and treating them as separate exercises is a common mistake.
Step 2: Conduct an Internal Gap Assessment
Once scope is defined, conduct a gap assessment before the formal ITGC assessment begins. This internal review benchmarks your current control state against what auditors will expect to find. For each ITGC domain, ask:
- Do documented policies exist for this control area?
- Are the policies actually followed in practice?
- Is there evidence—logs, tickets, approvals, reports—that demonstrates consistent execution?
Do not rely on your IT team's verbal assurances. Auditors require documented evidence. If a control exists but there is no record of it being executed, it will not receive credit. This is one of the most common reasons organizations with strong technical security still receive ITGC findings.
Our guidance on what external auditors expect from IT general controls can serve as a useful checklist during this phase.
Step 3: Remediate High-Priority Gaps Before the Assessment
Not every gap can be closed before an assessment, but high-risk deficiencies in access management and change management should be prioritized immediately. These two domains consistently receive the most audit scrutiny and produce the most damaging findings when controls are weak.
For access management, focus on:
- Completing and documenting a user access review for all in-scope systems within the past 90 days
- Ensuring terminated employees have been removed from all in-scope systems promptly
- Documenting the process for provisioning and approving privileged access
For change management, focus on:
- Ensuring all production changes went through a formal approval and testing process
- Documenting emergency change procedures and confirming they were followed for any expedited changes
- Verifying separation of duties between developers and production system owners
Organizations that lack structured security and compliance programs often struggle most in these areas. If your controls were built informally, now is the time to formalize them. Our compliance program development services are designed specifically to help organizations build the infrastructure needed to sustain these controls over time.
Step 4: Gather and Organize Your Evidence
Evidence collection is where ITGC preparation becomes operationally intensive. For each control in scope, you need to produce documentation that demonstrates the control was operating effectively throughout the audit period—not just at the moment of the assessment.
Common evidence types include:
- Access review reports and sign-off documentation
- Change management tickets showing approvals, testing, and deployment records
- System-generated logs showing job completion, monitoring alerts, and exception handling
- Onboarding and offboarding records demonstrating timely access provisioning and deprovisioning
- Training completion records for IT staff with privileged access
Organize evidence by control, not by date or system. Auditors will map evidence to specific control objectives, and making that process easy for them reflects well on your program's maturity. If your current environment lacks the logging and audit trail capabilities to support this evidence, address those technical gaps as part of your remediation effort.
Step 5: Prepare Your Key Personnel
An ITGC assessment is not purely a documentation exercise. Auditors will interview system owners, IT staff, and control operators to verify that documented procedures match actual practice. Inconsistency between what your policies say and what your staff describes during walkthroughs is a significant red flag.
Before the assessment, brief all relevant personnel on:
- What the assessment will cover and which systems they own
- How to describe their role in each control process accurately and consistently
- Where supporting documentation is located and how to retrieve it quickly
This is not about coaching staff to give scripted answers. It is about ensuring that the people who operate your controls every day can speak to those controls clearly and confidently. A well-prepared team signals program maturity. An unprepared team—even one with solid controls—creates unnecessary doubt.
Step 6: Review Your IT Policies and Procedures for Accuracy
Auditors will pull your IT policies and compare them against what they observe in practice. Outdated policies that do not reflect current operations are a significant liability. Before your ITGC assessment, review and update:
- Access control and identity management policies
- Change management and release management procedures
- Incident response and escalation procedures
- Logging, monitoring, and retention policies
Each policy should have a documented review date, an owner, and an approval signature. Policies that appear to have never been formally approved or reviewed will draw scrutiny regardless of their content.
For organizations operating in ISO 27001 environments, policy alignment is particularly critical. Our post on ISO 27001 compliance and risk management covers the policy requirements in greater depth.
Step 7: Engage Leadership and Establish Accountability
ITGC assessments succeed or fail based on organizational commitment, not just technical execution. Compliance managers must secure executive sponsorship and ensure that IT leadership understands what is at stake. When findings emerge—and some almost always do—having leadership already engaged accelerates the remediation response and prevents findings from sitting unresolved.
Consider whether your organization would benefit from dedicated compliance leadership support during the assessment period. Regulatory vCISO services provide the senior-level oversight needed to coordinate across IT, compliance, and executive leadership during high-stakes assessments, without requiring a full-time hire.
Common Mistakes to Avoid
Even experienced teams make avoidable errors during ITGC assessments. The most common include:
- Starting evidence collection too late and lacking full-period coverage
- Documenting controls that do not match actual operational practice
- Underestimating the scope of in-scope systems, particularly cloud-hosted and third-party platforms
- Failing to include IT operations controls alongside the more prominent access and change management domains
- Treating the assessment as an IT-only exercise rather than a cross-functional compliance effort
Our analysis of the five ITGC categories where organizations fail most often provides additional detail on each of these failure patterns and practical remediation guidance.
How Cleared Systems Supports ITGC Assessment Readiness
At Cleared Systems, we work with defense contractors, federal agencies, and regulated industry organizations to build the controls infrastructure needed to pass ITGC assessments with confidence. Our team brings deep experience across SOX IT compliance, ISO 27001, FedRAMP, and CMMC frameworks, giving us a clear picture of where controls overlap and where organizations consistently fall short.
We also support clients preparing for broader federal risk assessments through our federal and SLED risk assessment services, which address the full landscape of IT and compliance risk facing government contractors and public-sector organizations today.
Take the Next Step Toward ITGC Assessment Readiness
If your organization has an ITGC assessment on the horizon—or if you have received findings in a previous cycle that remain unresolved—now is the time to act. Cleared Systems can help you assess your current control posture, close critical gaps, and build the evidence package needed to support a clean assessment outcome. Request a quote today to speak with our compliance team about your specific assessment timeline and requirements.