What ITGC Assessment Findings Are Telling Us About Your Control Environment
Every year, our team at Cleared Systems conducts and supports dozens of IT general controls reviews across defense contractors, federal agencies, healthcare organizations, and financial institutions. The pattern is consistent: organizations that struggle most in an ITGC assessment are not struggling because of exotic or obscure control failures. They are failing on the fundamentals — the same categories, the same gaps, the same documentation shortfalls — audit cycle after audit cycle.
This post is a direct, practical breakdown of the deficiencies we see most often, why they persist, and what your team can do to remediate them quickly without derailing ongoing operations. If you are a compliance manager or IT leader preparing for a SOX audit, ISO 27001 certification, or a federal risk review, this is your field guide.
The Most Common ITGC Assessment Deficiencies
1. Access Control Weaknesses
Access management is the single most frequently cited category in ITGC findings. The deficiencies cluster around three specific failures: excessive privileged access that has never been formally reviewed, terminated employee accounts that remain active beyond the separation date, and shared credentials used across administrative functions.
What makes this particularly damaging in a regulatory context is that access control failures are not just an IT problem — they create direct liability exposure under SOX IT compliance requirements, NIST frameworks, and ISO 27001 Annex A controls. Auditors treat them as high-severity findings because they undermine virtually every other control layer you have built.
Fast remediation steps:
- Conduct an immediate privileged access review — pull a full list of admin accounts and reconcile against current active employees within the first week.
- Implement a formal user access recertification process on a quarterly cycle, documented with evidence of management sign-off.
- Eliminate shared credentials and enforce individual accountability through unique user IDs and multi-factor authentication.
- Establish a formal joiner-mover-leaver process tied directly to HR offboarding workflows, with a defined SLA for account deactivation.
2. Change Management Control Failures
The second most common finding involves change management. Specifically: changes being deployed to production without documented approval, emergency changes that bypass the standard process and are never retroactively reviewed, and missing evidence that testing occurred in a non-production environment before deployment.
For organizations pursuing ISO 27001 certification or maintaining compliance under frameworks like NIST SP 800-53, change management is a foundational control. Auditors are not simply looking for a change management policy — they are looking for evidence that the policy is actually followed, consistently, with documented approval chains and test results attached to every significant change ticket.
Fast remediation steps:
- Review your ticketing system configuration to enforce mandatory approval fields before a change can be moved to production status.
- Create a retroactive review process for emergency changes, with a required post-implementation report filed within 48 hours.
- Define and document what constitutes a significant change versus a routine maintenance task to eliminate gray areas that create audit exposure.
3. Inadequate Logical Access Logging and Monitoring
Many organizations have logging infrastructure in place but cannot demonstrate that logs are reviewed, retained for the required period, or tied to any alerting or response process. This is a critical distinction: having logs and actively monitoring logs are two different control states, and auditors assess both.
Under frameworks governing regulated industries — from healthcare to federal defense contractors — the expectation is that anomalous activity is detected and acted upon within a defined timeframe. If your team cannot produce evidence of log review, you have a deficiency regardless of your logging technology stack.
Fast remediation steps:
- Document your log retention configuration and verify it meets the minimum required period for your applicable frameworks.
- Establish a formal log review procedure, even if it is manual, and produce dated evidence of those reviews during the audit window.
- Configure alerting for high-priority events such as failed login attempts, privilege escalation, and after-hours access to sensitive systems.
4. Backup and Recovery Control Gaps
Backup and recovery deficiencies tend to surface in one of two forms: either backups are occurring but recovery has never been tested, or backup configurations have drifted from documented procedures and no one has noticed. Both are audit findings. Auditors want to see evidence that your recovery process works — not just a policy stating that it should.
Fast remediation steps:
- Schedule and complete a documented recovery test within the next 30 days if one has not been performed in the current audit period.
- Reconcile your backup configuration against your documented backup policy and remediate any variances immediately.
- Ensure backup success and failure notifications are sent to a monitored mailbox and that failures trigger a defined response process.
5. IT Security Policy Gaps and Documentation Deficiencies
An ITGC assessment will always evaluate whether your written policies exist, whether they are current, and whether there is evidence that employees have been trained on them. Organizations frequently carry policies that have not been reviewed or updated in two or more years. In a rapidly changing threat and regulatory environment, this creates both a compliance gap and a genuine security risk.
Our IT compliance services team consistently finds that policy documentation is the fastest area to remediate but also the area most commonly deprioritized until audit season. That sequencing is backwards. Policies must be living documents, reviewed at least annually, with version control and evidence of management approval maintained.
Fast remediation steps:
- Conduct an immediate policy inventory — identify every IT security policy, its last review date, and its current approval status.
- Prioritize updating policies directly mapped to ITGC control categories: access management, change management, incident response, and data backup.
- Document training completion for all relevant staff and ensure acknowledgment records are retrievable for auditor review.
6. Segregation of Duties Violations
Segregation of duties failures are particularly prevalent in smaller organizations and business units where IT staff wear multiple hats. The control objective is straightforward: no single individual should be able to initiate, approve, and complete a significant IT transaction without oversight. When one person holds all three roles — common in lean IT environments — the control environment is fundamentally compromised from an auditor's perspective.
Addressing this does not always require hiring additional staff. Compensating controls — such as enhanced monitoring, mandatory management review of transactions above a defined threshold, and detailed logging — can satisfy auditors when true segregation is operationally impractical.
Fast remediation steps:
- Map current role assignments against your key IT processes and identify specific conflicts where initiation, approval, and execution roles overlap.
- Document compensating controls formally in your control narrative and ensure auditors can see evidence of those controls operating during the review period.
- Engage leadership on a roadmap to achieve full segregation as the organization scales.
Why These Findings Recur Cycle After Cycle
The honest answer is that most ITGC deficiencies recur because remediation is treated as an audit event rather than an operational discipline. Organizations fix the finding, close the ticket, and return to the same practices that created the gap in the first place. Without a sustained compliance program that integrates control monitoring into daily IT operations, the cycle repeats.
This is precisely the problem that a structured compliance program development engagement is designed to solve. Rather than reactive patching, a mature program embeds control execution into standard operating procedures, assigns ownership, and generates continuous evidence — which means your next ITGC assessment becomes a confirmation exercise rather than a crisis response.
For organizations that need strategic oversight without the cost of a full-time hire, our regulatory vCISO services provide the ongoing leadership required to maintain control effectiveness between audit cycles. This is particularly valuable for mid-size defense contractors and healthcare organizations that face rigorous external assessments but lack dedicated internal security leadership.
Building a Rapid Remediation Timeline
When a client comes to us with a list of ITGC findings, we prioritize remediation based on two factors: auditor severity ratings and time required to produce defensible evidence. High-severity findings related to access control and segregation of duties are addressed first because they represent the greatest organizational risk and because auditors will look for evidence of corrective action before they issue a final report.
A realistic 60-day remediation sprint for most organizations looks like this:
- Days 1 to 14: Access control review, privileged account reconciliation, and policy inventory completion.
- Days 15 to 30: Change management process hardening, log review procedure documentation, and backup recovery test scheduling.
- Days 31 to 45: Segregation of duties analysis, compensating control documentation, and policy updates with management approval.
- Days 46 to 60: Evidence collection, control narrative updates, and internal validation testing before external auditor review.
This timeline is aggressive but achievable when leadership is committed and resources are allocated. Organizations that attempt to remediate without dedicated ownership typically find that findings remain open at the next audit cycle.
If your organization operates in the defense industrial base, you should also be aware of how ITGC control expectations intersect with CMMC and NIST SP 800-171 requirements. Our post on what external auditors expect from IT general controls provides additional context on where these frameworks align and where they diverge.
Take Action Before Your Next ITGC Assessment
If your organization has open ITGC findings from a prior audit — or if you know an assessment is on the horizon and you are not confident in your current control environment — the time to act is now, not 30 days before the auditors arrive. Cleared Systems works directly with compliance managers and IT leadership at defense contractors, healthcare organizations, and federal agencies to close control gaps systematically and build the documentation infrastructure that survives rigorous external review. Request a quote today to discuss your ITGC assessment readiness, or explore our engagement models to find the right level of support for your organization's size and compliance obligations.