Everything You Need to Know About ITGC and GITC
Priya was three months out of her BCom degree, scrolling job listings from a coffee shop in Madhapur, when she saw it: “IT Audit Analyst – ITGC – Freshers Welcome.” She’d never heard the word before. It sounded technical, maybe even coding-related, and she almost scrolled past. A week later, a friend who’d just joined a Hyderabad-based GCC (global capability centre) as an IT Audit intern told her something that changed her mind: “It’s not coding. It’s basically common sense, written down as a checklist. And every big company needs people who can do it.” That checklist is ITGC – Information Technology General Controls. If you’ve also seen the term GITC (General IT Controls, or sometimes General Information Technology Controls) in a job posting and wondered if it’s something different, here’s the short answer: it isn’t. ITGC and GITC describe the exact same set of foundational IT controls; different companies and auditors simply prefer one label over the other. What Exactly Is ITGC, and Why Does Everyone Also Call It GITC? Think of ITGC as the ground rules for how a company’s entire technology environment is run – not any one piece of software, but everything underneath it: who can log into which system, how changes get approved before they go live, how data gets backed up, and how new applications get built and tested. Application-level controls, by contrast, are specific to one piece of software, like a rule inside SAP that stops an invoice from being approved twice. ITGC is the umbrella; application controls sit underneath it. If the umbrella has holes, it doesn’t matter how well-designed the controls under it are – they can be bypassed. This is exactly why ITGC (or GITC) is a phrase you’ll run into constantly if you’re studying for internal audit exams like CIA Part 2, or working anywhere near financial reporting, because a weak ITGC environment can undermine an entire audit. The Four Areas You’ll Actually Test as an Auditor In real audit work, ITGC breaks down into four practical buckets. None of them require you to write a line of code – they require you to look at a process and ask whether the right people can do the right things, and whether there’s evidence of it. Here’s what each one actually means in plain language, and the kind of question an auditor asks to test it: Control Area What It Covers Auditor’s Test Question Access Management Who can log into systems, view or edit data, and how permissions are granted or removed If an employee leaves today, is their access removed within 24 hours? Change Management How updates to systems get approved, tested, and deployed Was this change to the payroll system approved and tested before going live? IT Operations Backups, recovery, job scheduling, and incident handling If the server crashed tonight, could we restore last night’s data by morning? System Development (SDLC) How new applications and systems are built, tested, and rolled out Was this new finance module tested by someone other than the developer before go-live? Notice a pattern? Every single question above is really just “who can do this, and can we prove it was done properly?” That’s the entire mental model behind ITGC. Once that clicks, the rest of the subject stops feeling like jargon and starts feeling like common sense with a checklist attached. Why This “Boring” Topic Became a Hot Hyderabad Career Here’s the part that surprises most freshers: ITGC isn’t a niche corner of IT. It’s a requirement. Public companies under U.S. law (SOX Section 404) must prove their IT controls over financial reporting are effective, and weak ITGC can trigger a formal “material weakness” finding – the kind of thing that makes headlines and costs jobs. Beyond SOX, frameworks like SOC 1, SOC 2, ISO 27001, and COBIT all lean on the same foundation of general IT controls. Hyderabad has turned into one of India’s biggest hubs for exactly this kind of work, largely because of the Global Capability Centre (GCC) boom – the in-house teams that MNCs set up in India to run finance, audit, and technology operations for their global parent companies. These GCCs need people who can test and document controls locally, on behalf of the parent company’s global audit, which is precisely the ITGC skill set. Search any job board today and you’ll find IT Audit Analyst, Internal Audit, and ITGC-and-SOX-testing openings posted out of Hyderabad on a near-daily basis, alongside similar demand in Bengaluru and Mumbai. For a fresher, that means the skill you’re learning isn’t theoretical – it’s actively being hired for, right now, close to home, and often without requiring you to relocate to a different city first. How Much Can You Actually Earn With ITGC Skills? Money is usually the second question after “what does this even mean,” so let’s address it directly. Industry salary data (Payscale, Glassdoor, and related sources, 2026) shows a fairly clear progression for IT audit and ITGC professionals in India: (Illustrative composite based on Payscale, Glassdoor, and industry salary data, 2026; actual pay varies by company and city.) A fresher with 0-2 years of experience can expect to start in the ₹5-6 lakh range, moving toward the national average for IT auditors of roughly ₹8.8 lakh as they gain 2-4 years of hands-on testing experience. Auditors who move into senior or consultant-level roles – especially in metro hubs – often land in the ₹12-15 lakh range, and audit managers can cross ₹20 lakh. None of these numbers are guaranteed, and they’ll vary by company and city, but the direction is consistent: this is a career that rewards a few years of real experience quickly. Do You Need a Coding or Finance Background to Learn ITGC? No, and this is the detail that surprises most people. ITGC work is about evaluating whether a control exists and works as intended, not about writing software or crunching balance sheets. You don’t need to be a programmer, and you don’t need to
Everything You Need to Know About ITGC and GITC Read More »
