As regulators tighten their grip on operational resilience, IT general controls (ITGC) have moved from a back-office concern to a board-level issue. These controls form the foundation of an organisation’s IT environment, and when they fail, every application control built on top of them loses its credibility.
According to Copla, ITGC span six core domains: logical access, change management, IT operations, backup and recovery, physical security and segregation of duties.
Unlike application controls, which govern the accuracy of inputs and outputs within a single system, ITGC protect the entire environment at once. A validation rule that rejects a malformed payment file is only trustworthy if ITGC prevent someone from quietly editing or disabling it.
The stakes are considerable. IBM’s Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99m, while Verizon’s 2026 Data Breach Investigations Report found that exploited vulnerabilities were the most common initial access route, accounting for 31% of breaches.
Ransomware featured in 48% of incidents, which underlines why tested backups matter. An untested backup remains an assumption until someone actually restores it.
For EU financial entities, DORA has turned these controls into hard regulatory requirements. Regulation (EU) 2022/2554 demands documented access policies, rigorous change management and periodically tested backup and restoration procedures.
Its technical standards go further, requiring access rights for critical systems to be updated at least every six months and change approvers to be independent of requesters and implementers.
The upside is efficiency. A single well-run control can satisfy an ISO 27001 Annex A item, a SOC 2 criterion and a DORA requirement simultaneously, meaning the work only needs doing once. ITGC also underpin NIS2 and PCI DSS, while SOX, passed in the US in 2002, remains the historical driver that made them widely known.
However, the order of work is critical. Strong programmes start with assets, move through a business impact analysis and risk assessment, and only then select controls. Checklist-first approaches run the sequence backwards, retrofitting controls to a framework list and automating the wrong work perfectly. A payments database warrants stringent access controls and frequent reviews; an internal wiki does not.
Auditors test both design effectiveness and operating effectiveness, sampling evidence such as change tickets from across the whole audit period. Evidence assembled the month before an audit only reveals what someone remembered to keep. Continuous monitoring and control automation, offered by platforms such as Copla, help keep evidence current between audits.
Common gaps include orphaned user accounts, unreviewed access, changes that skip approval and backups nobody has restored. Each closes the same way: assign an owner, run a gap analysis and act on the findings.
Read the full Copla post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
