Checklists
🇮🇳 Indian Mandate Aligned
13 min read
IT Audit Cheat Sheet: Transforming ITGC Controls into Board Assurance (NIST & ISO Aligned)
Comprehensive IT General Controls (ITGC) cheat sheet for internal auditors, CISOs, and compliance teams. Translates access management, change control, backup operations, and secure SDLC controls into clear board-level risk assurance aligned with ISO 27001:2022, SOC 2, and Indian statutory auditing mandates.
By BlueCiphr Threat Research Desk • Lead CEH & PenTest+ Auditors
📥 Download Offline Artifact:
Audit-Ready Formats
Interactive Technical Checklist (12 Verification Checkpoints)
-
[1. Logical Access] Verify that 100% of new user access requests have documented management approval and adhere to role-based access profiles.Mandate: Companies Act §143
-
[1. Logical Access] Sample 25 terminated employees; verify that all Active Directory, email, and ERP accounts were deactivated within 24 hours.Mandate: RBI IT Governance §4
-
[1. Logical Access] Review evidence of quarterly User Access Reviews (UAR) signed off by business application owners with unauthorized accounts revoked.Mandate: ISO 27001 Control 9.2
-
[1. Logical Access] Verify that Privileged Access Management (PAM) is enforced for domain admins with session recording and MFA.Mandate: PAM Standard
-
[2. Change Management] Verify that developer access to production environments is strictly blocked; code promotion must occur via automated CI/CD pipelines.Mandate: Segregation of Duties
-
[2. Change Management] Sample 25 production changes; verify that each had a Change Advisory Board (CAB) approval, rollback plan, and peer code review.Mandate: SOC 2 CC8.1
-
[2. Change Management] Audit emergency change procedures; ensure post-implementation retrospective reviews were executed within 48 hours.Mandate: Change Governance
-
[3. IT Operations] Inspect backup logs for core databases; verify 100% success rate with automated alerting on backup failures.Mandate: Business Continuity
-
[3. IT Operations] Review documented evidence of annual database restoration drill verifying data integrity and recovery time objective (RTO).Mandate: SEBI CSCRF BCP
-
[3. IT Operations] Verify physical and environmental controls at primary data centers (UPS, dual-generators, FM200 fire suppression, biometric access).Mandate: Physical Security
-
[4. System Development] Verify that dynamic and static application security testing (DAST/SAST) is embedded into deployment pipelines with zero critical CVE bypass.Mandate: Secure SDLC
-
[4. System Development] Confirm that production customer data is never cloned or utilized in unmasked format within development or staging environments.Mandate: DPDP Act §8(5)
📑 IT Audit Field Manual:
IT General Controls (ITGC) Cheat Sheet & Auditor Evidence Guide
IT General Controls (ITGC) provide the baseline assurance that an enterprise's technical environment is stable, reliable, and properly controlled. When external or statutory auditors test Internal Financial Controls over Financial Reporting (ICFR), ITGC failure invalidates all underlying automated controls.
The 4 Core ITGC Audit Domains & Required Evidence
Domain 1: Access to Programs & Data (AC)
Auditor Test: Sample user onboarding tickets, exit interview de-provisioning timestamps, and quarterly access review sign-off sheets.
Common Deficiency: Delayed deactivation of contractor accounts and developers having write access to production databases.
Common Deficiency: Delayed deactivation of contractor accounts and developers having write access to production databases.
Domain 2: Change Management (CM)
Auditor Test: Sample Git merge requests, Jira tickets with CAB approval timestamps, and documented rollback plans.
Common Deficiency: Emergency changes implemented without retrospective documentation and lack of formal segregation of duties (SoD).
Common Deficiency: Emergency changes implemented without retrospective documentation and lack of formal segregation of duties (SoD).
Domain 3: Computer Operations (CO)
Auditor Test: Daily automated backup completion logs, offsite replication reports, and annual database restoration test certificates.
Common Deficiency: Backups run daily but are never tested for restoration until a catastrophic ransomware incident occurs.
Common Deficiency: Backups run daily but are never tested for restoration until a catastrophic ransomware incident occurs.
Domain 4: Program Development (PD)
Auditor Test: User Acceptance Testing (UAT) sign-offs by business leads, SAST/DAST security scan reports, and data migration sign-offs.
Common Deficiency: Inadequate segregation of test and production data; cloning live customer data into developer environments.
Common Deficiency: Inadequate segregation of test and production data; cloning live customer data into developer environments.
🛡️ AUDIT DEFENSE & TECHNICAL VERIFICATION
Need Accredited Auditors to Execute This Audit or Gap Assessment?
BlueCiphr's certified lead auditors (CEH Master, PenTest+, ISO 27001 Lead Auditors) conduct deep technical verification and produce board-ready evidence binders complying with RBI, SEBI CSCRF, CERT-In, and the DPDP Act 2023.
Request Audit Scoping & Consultation →
⚡ Quick Response SLA • Board-Ready Evidence