A city CIO asks internal audit to review IT general controls for the finance ERP before year-end. What should that engagement primarily evaluate?
Select an answer to reveal the explanation.
Short Explanation
Think of internal audit as the city's own checkup crew — they poke at how access, changes, and ops controls are built and whether they actually work day to day. For ITGCs around finance, design and operating effectiveness are the point. Branding and hosting preferences are not the audit question.
Full Explanation
Internal audits of city ITGCs focus on control design and operating effectiveness for areas such as access management, change control, and computer operations that underpin reliable processing. The engagement produces assurance for leadership about whether those controls are suitably designed and working as intended. Cosmetic or strategic preference topics outside the control objectives are out of scope for that assurance purpose.