Every day, millions of employees log in to business applications such as SAP, Oracle, Workday, ServiceNow, Microsoft 365, Salesforce, and other enterprise systems. We usually enter a username, provide a password or approve an MFA request, and start working.

But have you ever wondered what happens behind that simple login?

How does the organization know that you are really you?
How does it decide what you are allowed to access?
What happens when you change departments?
And most importantly, what happens to your access when you leave the company?

These questions are closely connected to IT General Controls (ITGC).

ITGC is a set of controls designed to help organizations maintain the security, reliability, availability, and integrity of their IT systems and data. Although ITGC is commonly discussed in audits and compliance programs, its impact can be seen in everyday activities such as logging in, requesting access, changing systems, and protecting company data.

What Is ITGC?

ITGC stands for Information Technology General Controls.

In simple terms, ITGC provides the foundation for controlling how an organization’s IT environment operates.

ITGC commonly covers areas such as:

• Access Management
• Change Management
• IT Operations
• Backup and Recovery
• Incident Management
• Logging and Monitoring
• Security Administration

For example, when an employee receives access to SAP, that access should normally be based on their job responsibilities and approved by an appropriate person.

Similarly, when an employee leaves the organization, their access should be removed within the required timeframe.

ITGC Area	Simple Real-Life Example
Access Management	Employee receives access based on their role
Change Management	Application changes require approval
Backup	Critical company data is backed up
Incident Management	System issues are recorded and resolved
Logging & Monitoring	Important user activities are logged
Recovery	Systems can be restored after an outage

What Actually Happens Behind Your Login?

Let’s take a simple example.

Imagine Rahul joins a financial services company as an Accounts Payable Analyst.

On his first day, Rahul needs access to:

• Email
• Microsoft Teams
• SAP
• HR application
• Expense management system

Rahul should not automatically receive administrator access to every application.

Instead, the organization follows an access management process.

Step 1: Employee Joins the Organization

HR creates Rahul’s employee record.

The employee’s:

• Name
• Employee ID
• Department
• Job title
• Manager
• Joining date

are recorded in the HR system.

This information may be used by downstream systems to initiate the access provisioning process.

Step 2: Access Is Requested

Rahul’s manager may request access to the applications he needs.

For example:

“Rahul requires Accounts Payable access in SAP.”

The request should identify what access is required and why.

Step 3: Approval Takes Place

The appropriate manager or application owner reviews the request.

If the request is appropriate, it is approved.

This creates an important control:

Access should not simply be granted because someone asks for it.

There should be an authorization process.

Step 4: Access Is Provisioned

Once approved, the appropriate IT or IAM team provisions Rahul’s account.

For example:

Rahul → SAP → Accounts Payable Role

Rahul should receive only the permissions required for his job.

This is known as the Least Privilege principle.

Identification, Authentication and Authorization

One of the easiest ways to understand ITGC is through the three concepts involved in accessing a system.

Concept	Meaning	Example
Identification	Who are you?	Username / Employee ID
Authentication	Can you prove who you are?	Password + MFA
Authorization	What are you allowed to do?	SAP Accounts Payable role

Identification

The system identifies the user through something such as a username or employee ID.

Authentication

The system verifies the user’s identity.

This could involve:

• Password
• MFA
• Security key
• Biometrics
• Single Sign-On

Authorization

After authentication, the system determines what the user can access.

For example, Rahul may be able to create invoices but may not be authorized to approve payments.

That separation is important from a control perspective.

What Happens When an Employee Changes Roles?

Now imagine Rahul moves from the Accounts Payable team to the Procurement team.

His old access may no longer be appropriate.

This is called a Mover scenario in the Joiner-Mover-Leaver process.

The organization should review Rahul’s existing access and determine:

What access should be removed?
What new access should be provided?

For example:

Before Transfer	After Transfer
Accounts Payable Role	Procurement Role
Invoice Processing	Purchase Order Processing
AP Reports	Procurement Reports
Old permissions	Revised permissions

If the old access is not removed, Rahul could potentially retain unnecessary privileges.

This is one reason why periodic User Access Reviews (UARs) are important.

What Happens When an Employee Leaves?

Now comes one of the most important ITGC scenarios.

Suppose Rahul leaves the company.

Should he still be able to log into SAP?

No.

The organization’s termination process should trigger removal or disabling of his access.

The process may look like this:

HR records termination → IAM/IT receives notification → Account disabled → Application access removed → Evidence retained

Auditors may test whether terminated employees had access after their termination date.

For example:

Employee	Termination Date	Account Disabled	Exception
Rahul	June 10	June 10	No
Employee B	June 15	June 15	No
Employee C	June 20	June 22	Yes

The third employee may require investigation because access remained active after termination.

What Does an ITGC Auditor Do?

An ITGC auditor doesn’t simply ask:

“Do you have access controls?”

The auditor looks for evidence that the controls are designed appropriately and operated effectively.

For an access control, an auditor may:

1. Understand the access provisioning process.
2. Identify the control owner.
3. Obtain the population of users or access requests.
4. Select samples.
5. Review approvals.
6. Verify that access matches the user’s role.
7. Check whether access was provisioned appropriately.
8. Document the testing results.
9. Investigate exceptions.

For a User Access Review, the auditor may examine whether the reviewer actually reviewed the appropriate population and whether inappropriate access was identified and addressed.

ITGC Is More Than Just Login Security

Although login access is an easy way to understand ITGC, ITGC covers much more.

Consider a company deploying a new feature to its financial application.

Can a developer simply make a change directly in production?

Normally, organizations establish controls around this process.

The change may need:

• Business approval
• Technical review
• Testing
• Change ticket
• Deployment approval
• Evidence of implementation

This falls under Change Management.

Similarly, organizations need controls around backups, incidents, system operations, and recovery.

ITGC Example: From Login to Audit

Let’s put everything together.

Imagine an employee named Priya.

Event	ITGC Control
Priya joins company	User provisioning
Manager requests SAP access	Access request
Manager approves access	Authorization
IT provisions account	Access provisioning
Priya logs in	Authentication
Priya changes department	Access modification
Periodic review occurs	User Access Review
Priya leaves company	Termination control
Account is disabled	Deprovisioning

This is ITGC in real life.

The employee may never see the word “ITGC” while working, but the controls are operating behind the scenes.

Why Should Students Learn ITGC?

ITGC is particularly relevant for students and professionals interested in careers such as:

• IT Auditor
• ITGC Auditor
• SOX IT Auditor
• GRC Analyst
• Risk & Compliance Analyst
• Internal Auditor
• Information Security Auditor
• IT Risk Consultant

A good ITGC learning program should not focus only on definitions.

Students should learn how to work with actual audit scenarios, evidence, populations, samples, access listings, change tickets, and control testing.

For students looking for structured learning, an ITGC course in Hyderabad can provide a practical introduction to IT audit, access management, change management, SOX controls, and audit testing.

Similarly, professionals looking for practical experience can consider ITGC training in Hyderabad that includes hands-on exercises and real-world audit scenarios.

ITGC Skills You Can Learn

Skill	Why It Matters
Access Management	Helps evaluate user access controls
UAR Testing	Helps identify inappropriate access
Change Management	Helps assess system change controls
Audit Evidence Review	Supports audit conclusions
Sampling	Helps select transactions/users for testing
RCM Preparation	Connects risks with controls
SOX ITGC	Important for financial reporting environments
Excel	Frequently used for audit data analysis
ServiceNow	Commonly used for ITSM and change tickets
SAP	Widely used enterprise application

Final Thoughts

The next time you enter your username, password, and MFA code, remember that your login is only one small part of a much larger control environment.

Behind that login, an organization may have processes for:

Identity → Authentication → Authorization → Access Review → Monitoring → Modification → Termination

That is the practical side of ITGC.

ITGC may sound like an audit or compliance term, but its principles are present in everyday business operations. From giving an employee access to an application to removing that access when they leave, ITGC helps organizations establish controlled and accountable IT processes.

For anyone planning a career in IT audit, GRC, SOX, risk, or compliance, understanding these real-world scenarios is much more valuable than simply memorizing definitions.

ITGC isn’t just about controls on paper. It’s about what happens behind the systems we use every day.