A city CIO asks internal audit to review IT general controls for the finance ERP before year-end. What should that engagement primarily evaluate?
Select an answer to reveal the explanation.
Short Explanation
Think of internal audit as the city's own checkup crew — they poke at how access, changes, and ops controls are built and whether they actually work day to day. For ITGCs around finance, design and operating effectiveness are the point. Branding and hosting preferences are not the audit question.
Full Explanation
Internal audit engagements on municipal IT general controls exist to give leadership independent assurance that the finance ERP—and the processes that feed it—rest on reliable access, change, and operations foundations. Design effectiveness asks whether the control, as written and configured, would prevent or detect the relevant risk if it operated as intended. Operating effectiveness asks whether that control actually ran, with competent people, complete evidence, and appropriate exceptions, across the period under review. For a city finance system that touches payroll, tax receipts, grants, and vendor payments, those questions map directly to user provisioning and periodic access reviews, privileged account oversight, change tickets and approvals into production, job scheduling and failure handling, and backup/restore readiness for financially significant flows. Auditors sample evidence that shows the control worked on real days, not merely that a policy PDF exists.
Marketing brand guidelines for a public Wi-Fi splash page do not speak to whether ERP access, changes, or batch processing can be trusted for year-end reporting. Preferring cloud vendors over on-premises hosting is an architecture or sourcing preference; it is not the ITGC evaluation criterion unless specific cloud control mappings are in scope as part of those same control objectives. Allowing developers to skip change tickets during holiday freezes undermines change control—the opposite of what an ITGC review should validate. The civic takeaway is practical: before the books close, the city needs proof that financial processing and access control are designed soundly and operated consistently, with owners who can produce samples on request. An operational check is to walk a single financially significant change and a terminated user’s access path end-to-end and confirm both design intent and logged execution match policy.