# Categories of Controls in an Automated Environment
When an entity uses IT systems for processing financial information, the auditor must understand the layers of controls that ensure the system produces reliable data. These controls fall into three interconnected categories.
## A. General IT Controls (GITC)
General IT Controls are policies and procedures that relate to many applications and support effective functioning of application controls. They cover:
### 1. Program Change Controls
- Objective: Ensure that modified systems continue to meet Financial Reporting (FR) objectives.
- Activities covered: Change management process, recording, managing & tracking change requests, testing of changes before deployment.
### 2. Access Security Controls
- Objective: Ensure access to data is authenticated and authorized to meet FR objectives.
- Activities covered:
- Security organisation and management
- Security policy and procedures
- Application security
- Data security
- Operating system security
- Network security
- Physical security
### 3. Application System Acquisition, Development & Maintenance
- Objective: Ensure systems are developed, configured and implemented to meet FR objectives.
- Activities covered: Overall management of development activities, project initiation, analysis & design, construction, testing & quality assurance, etc.
## B. Application Controls
Application controls are automated or manual controls operating at the business process level. They help ensure Completeness, Accuracy and Integrity (C-A-I) of data.
Examples:
- Edit checks
- Sequence number checks
- User limit checks
- Reasonableness checks
## C. IT Dependent Controls
These are manual controls that make use of data produced from IT systems and applications. Because the manual control uses system-generated data, its effectiveness depends on the IT system being reliable.
## Relationship Between General IT Controls & Application Controls
These two control types are interrelated:
- General IT Controls are needed to support functioning of application controls.
- Both are needed together to ensure complete and accurate information processing.
> Key takeaway: Without strong GITCs, you cannot rely on application controls — even if the application control itself looks well-designed, the underlying environment may corrupt the data it operates on.