As regulators tighten expectations on operational resilience, IT general controls (ITGC) are moving from back-office hygiene to board-level concern. These controls underpin the security, stability and auditability of an organisation’s entire IT environment, regardless of which applications sit on top. When they fail, the consequences cascade.

According to Copla, ITGC typically span six domains: logical access, change management, IT operations, backup and recovery, physical security, and segregation of duties. Together they produce much of the evidence auditors expect under ISO 27001, SOC 2, PCI DSS and DORA.

The distinction from application controls lies in scope. Application controls operate within a single system, governing the accuracy of inputs, processing and outputs, such as a validation rule that rejects a malformed payment file. ITGC, by contrast, protect every system simultaneously. The two are interdependent: an automated rule only holds value while ITGC prevent anyone from editing or disabling it. Weak foundations therefore compromise everything built above them.

The stakes are significant. IBM’s Cost of a Data Breach Report 2026 places the global average breach cost at $4.99m. Verizon’s 2026 Data Breach Investigations Report found exploited vulnerabilities were the leading initial access route, accounting for 31% of breaches, while ransomware featured in 48%.

For EU financial entities, DORA turns these controls into binding obligations. Regulation (EU) 2022/2554 demands documented access policies, rigorous change management and periodically tested backup and restoration procedures. Supporting technical standards require access rights for systems underpinning critical functions to be reviewed at least every six months, with change approvers kept independent of requesters and implementers.

Source link