What Is ITGC? A Plain-English Guide for Career Changers

Last updated November 6, 2026

If you’ve spent any time in financial audit or accounting, you’ve probably heard “ITGC” tossed around in a meeting and nodded like you knew exactly what it meant. ITGC stands for IT General Controls. Once you understand it, you’ll see that IT audit uses the same methods as the audit work you already know, applied to a different set of records.

You understand financial risk and control testing. What you may not know is how networks or cloud systems operate, and you might worry that gap is too wide to cross. ITGC is a good place to close it, because it was built by auditors who had the same background you do.

What is ITGC, and what does it cover?

ITGC are the controls that govern the systems sitting underneath the financial and operational data a company relies on. Instead of testing whether a journal entry was approved, you’re testing whether the systems that produce, store, and move that data are managed with the same discipline. ITGC splits into four domains, and all four map to concepts you already test in a financial audit.

Access controls: who’s allowed in

This uses the same logic as segregation of duties, applied to a login screen instead of a check-signing authority. You check who can get into the system that posts to the general ledger, and whether that access was approved before it was granted. You pull a user access list and match it against HR records and approval tickets. Then you flag anyone who shouldn’t still be there, like someone with admin rights six months after they switched departments. That’s sampling and corroboration, the exact skill set from a SOX walkthrough.

Change management: who’s allowed to touch it

Before a company pushes an update to a system that touches financial data, somebody is supposed to approve the change and document that it was tested first. Change management testing means pulling a sample of changes from a ticketing system and checking for a paper trail that proves the change was reviewed before it went live. If you’ve ever tested whether a capital expenditure had the right sign-off before it hit the books, you’ve already done this exercise under a different name.

Computer operations: whether systems run and recover

This domain covers day-to-day operations such as backups and job scheduling, and whether anyone notices when something breaks. You check whether the nightly batch job that updates account balances ran, and whether anyone noticed when it failed. You also check that the backup works when it’s needed. The work means reading logs and exception reports, with no scripting.

Program development: how new systems get built

When a company builds or buys a new system that will touch financial reporting, this domain checks whether it went through a controlled process before go-live, with requirements signed off and testing completed before anyone touched live data. You’d ask the same question about a new accounting policy.

None of the four domains involves writing code or configuring a firewall. ITGC testing is an exercise in evidence and judgment, the same one you already run. The technical vocabulary is the new part, and vocabulary can be learned.

Why ITGC is the place to start

A lot of career-change advice tells accountants to learn Python or get comfortable in a terminal before they can touch IT audit. You can start with ITGC instead. It’s the part of IT audit modeled on financial controls testing, which is why it’s usually the first thing taught to someone making this move and the first thing tested in a real engagement. You already have the discipline it requires.

How the pay compares to where you are

IT audit roles average $93,000 a year, with a typical range of $72,000 to $112,000 (ZipRecruiter, 2026). General accountant roles average $68,326 a year, with a typical range of $53,500 to $78,500 (ZipRecruiter, October 2026). The bottom of the IT audit range sits close to the top of the accounting range, and IT audit keeps going well past it.

The skills on both sides are close to identical: you gather evidence and defend a conclusion to someone who will push back on it. In IT audit you apply them to a different set of records, at a higher rate of pay.

Where people get stuck learning this on their own

Most people try to learn ITGC from a slide deck, with no one around to ask when a term doesn’t click. That causes more trouble than the concepts themselves. “Change management” sounds abstract until someone walks you through a real ticket and shows you what a complete evidence trail looks like next to one with a gap in it. After that, you can test the control under time pressure in an interview.

The MasterClass teaches ITGC live, in the first weeks, with real control testing. You practice the walkthrough you’d run in your first engagement, with someone there to correct you when you miss evidence.