As regulators tighten expectations on operational resilience, IT general controls (ITGC) are moving from back-office hygiene to board-level concern. These controls underpin the security, stability and auditability of an organisation’s entire IT environment, regardless of which applications sit on top. When they fail, the consequences cascade.
According to Copla, ITGC typically span six domains: logical access, change management, IT operations, backup and recovery, physical security, and segregation of duties. Together they produce much of the evidence auditors expect under ISO 27001, SOC 2, PCI DSS and DORA.
The distinction from application controls lies in scope. Application controls operate within a single system, governing the accuracy of inputs, processing and outputs, such as a validation rule that rejects a malformed payment file. ITGC, by contrast, protect every system simultaneously. The two are interdependent: an automated rule only holds value while ITGC prevent anyone from editing or disabling it. Weak foundations therefore compromise everything built above them.
The stakes are significant. IBM’s Cost of a Data Breach Report 2026 places the global average breach cost at $4.99m. Verizon’s 2026 Data Breach Investigations Report found exploited vulnerabilities were the leading initial access route, accounting for 31% of breaches, while ransomware featured in 48%.
For EU financial entities, DORA turns these controls into binding obligations. Regulation (EU) 2022/2554 demands documented access policies, rigorous change management and periodically tested backup and restoration procedures. Supporting technical standards require access rights for systems underpinning critical functions to be reviewed at least every six months, with change approvers kept independent of requesters and implementers.
The efficiency case is compelling. A single well-run control can simultaneously satisfy an ISO 27001 Annex A item, a SOC 2 criterion and a DORA requirement, meaning the work is done once but counted several times.
Yet many organisations approach ITGC backwards, retrofitting controls to a framework checklist rather than starting with genuine ICT risk. The more effective sequence begins with an asset inventory, followed by a business impact analysis, a risk register built on proper assessment, and only then the selection of controls that address specific risks. A payments database warrants stringent access controls and frequent reviews; an internal wiki does not.
Execution matters as much as design. Auditors test both design effectiveness and operating effectiveness across the full audit period, sampling evidence such as a year’s worth of change tickets. Evidence pulled together the month before an audit only reflects what someone remembered to retain. Continuous monitoring and control automation keep evidence current, and platforms such as Copla attach evidence directly to the control it proves, with named owners for each risk.
Common gaps remain stubbornly familiar: orphaned user accounts, unreviewed access, changes that bypass approval, untested backups and missing segregation of duties. Each closes only when someone owns it.
Read the full Copla post here.
Copyright © 2026 FinTech Global
