Divya sat at her desk in Madhapur, closing her fortieth support ticket of the week. She reset passwords, fixed login errors and kept the systems running. Then an email arrived. The company’s auditors were visiting on Monday, and her manager wanted her in the meeting.
On Monday, an auditor asked her a simple question. “Who approved this access, and when was it removed after the person left?” Divya knew she had done the work. But she could not show proof in a way that satisfied the auditor. That evening she understood something important. Doing the work and proving the work are two different skills, and proving it is exactly what an ITGC course teaches.
What a Good ITGC Course Really Teaches
ITGC means IT General Controls, the everyday rules that keep company systems safe and honest. Divya had read the definition many times. What she wanted to know was what she would study week after week. Here is a simple 12 week plan that shows how a good course is usually shaped.
| Phase | Weeks | What you learn | What you practise |
|---|---|---|---|
| Foundations | 1 to 2 | Control basics, risk, SOX, ISO 27001 and SOC reports in plain words | Reading a control and spotting what could go wrong |
| Access | 3 to 5 | Joiners, movers, leavers, access reviews, privileged accounts | Checking a leaver list against HR records |
| Change and operations | 6 to 9 | Approvals, testing, emergency changes, backups, job monitoring | Tracing a change ticket from request to release |
| Proof and career | 10 to 12 | Samples, evidence, audit reports, interview skills | Writing a finding and a mock interview |
Time matters too. Divya wondered where to spend her hours, so she looked at a sample split. Treat it as a planning guide for your own study, not a fixed rule.
Graph 1: Sample split of study time across 12 weeks
How Big Is a Sample? The Part That Surprised Divya
An auditor does not check every single ticket. Under common audit practice, the more often a control happens, the more examples the auditor checks. A control done once a year needs one example. A control done every day may need twenty to forty. Exact numbers vary by firm, but the pattern stays the same.
Graph 2: Typical sample size by how often a control runs (bar shows the top of the usual range)
Automated controls are often tested just once, as long as change management around them works well. That is why class spends so much time on change management.
Where Audit Findings Usually Come From
In a real IT controls audit, the same few problems appear again and again. Divya learned to look for them first.
| Area | Common finding | Evidence the auditor asks for |
|---|---|---|
| Access | A former employee’s account is still active | HR leaver list matched to the system user list |
| Access | A shared admin account nobody can trace | Account owner list and login records |
| Access | Access review done but never acted on | Reviewer sign off and proof of removals |
| Change | A developer can also release to live systems | Role listing and release approvals |
| Change | Emergency changes missing from the change log | Complete change list with ticket numbers |
| Operations | Backups run but restores are never tested | Restore test record |
One more lesson is easy to miss. If the list you test from is incomplete, your test proves nothing. A change log that leaves out emergency changes, or a user list pulled after a clean up, can weaken a whole audit. Divya wrote that on a sticky note and stuck it on her monitor.
Choosing the Right ITGC Training in Hyderabad
Divya compared several options for ITGC training in Hyderabad and made a short list of questions. Does the trainer have real audit experience? Will I practise on sample evidence, not only slides? Is there help with resumes and interviews? Can I join online if my shift changes?
She found that MTJ Job Solutions offers an ITGC course in Hyderabad that covers SOX, ISO 27001 and SOC reports, with online and classroom batches and support for resumes and interviews. Whichever place you pick, ask for the plan, the trainer’s background and a demo class before you pay.
Practise Like an Auditor Before You Join
Divya did not wait for her first class. She began with small exercises at her own desk, and you can do the same. Pick one system you use every day. Write down who can log in, who approves new users, and what happens when someone leaves. Then ask a colleague how a software change gets approved before it goes live.
Next, practise writing a finding in three short lines. First say what you saw, then say why it is a risk, and finally say what proof you checked. This habit makes class easier, because audit reports are really just clear sentences backed by evidence. Keep every example in a notebook. In interviews, those small cases become real answers.
Where These Skills Lead
| Stage | Typical role | Main focus |
|---|---|---|
| Start | Associate IT auditor or controls tester | Testing access and change controls |
| Grow | Senior IT auditor | Planning audits and guiding juniors |
| Lead | Audit or risk manager | Managing teams and reporting to leaders |
Many people add the CISA certification along the way. The exam has 150 questions and lasts four hours. The full certificate needs five years of relevant experience, though the experience can be completed within five years after passing the exam.
How Divya’s Story Ended
Three months later, Divya sat across from the same auditor. When he asked who approved the access and when it was removed, she opened a folder. It held the leaver list, the approval and the removal record. The auditor nodded and moved to his next question. Nothing dramatic happened, and that was the point. Good controls and good proof make audits quiet. If you work in support, testing or operations, you may already be doing half the job.
Frequently Asked Questions
Do I need coding skills for an ITGC course?
No. You need to read carefully, ask why, and keep neat notes. A basic idea of how systems and logins work is helpful.
How long does it take to learn ITGC?
A focused plan of about 12 weeks can cover the basics. Real confidence comes from practising on sample evidence.
What is the difference between ITGC and application controls?
ITGCs are the wide rules around systems, such as access, change and operations. Application controls sit inside one system, like a check that blocks a payment without approval.
Can a fresher become an IT auditor?
Yes. Many people start as associates or controls testers and learn on the job. A course gives you vocabulary and practice before your first interview.
Do I need CISA before I start?
No. CISA usually helps later in your career, once you have some audit experience behind you.