IT Audit and IT General Controls Audit
Independent IT Audit and ITGC Assurance for Business-Critical Systems
Muzamani provides IT audit and IT General Controls (ITGC) reviews to assess whether controls over business-critical systems are appropriately designed and, where agreed, operating effectively.
Our risk-based approach covers access management, change management, IT operations, security, backup and recovery, technology governance and third-party services.
When an IT Audit Is Needed
Organisations may require an IT audit when:
- External audit identifies IT control weaknesses.
- An Audit Committee requires assurance over technology risks.
- An ERP or business-critical system is being implemented or changed.
- Access, change management, backup or recovery controls require independent review.
- Management needs assurance over technology supporting financial or operational processes.
- Internal audit requires specialist IT audit capacity.
What We Review
Access Management
User provisioning, terminations, privileged access, access reviews and segregation of duties.
Change Management
Change requests, approvals, testing, deployment and emergency changes.
IT Operations
Job scheduling, system monitoring, incident management, problem management and operational controls
Backup and Recovery
Backup monitoring, retention, recovery procedures and restore testing.
Security and Governance
Security policies, logging, monitoring, configuration, patch management, IT risk management and technology governance.
Third-Party and Cloud Services
Vendor governance, service arrangements, access controls, independent assurance reports and complementary user controls.
How We Scope and Test
We scope the audit around the relevant applications, business processes and supporting technology layers.
Depending on the engagement, we assess:
Control design
Whether controls are appropriately designed, documented and implemented.
Operating effectiveness
Whether controls operated effectively over an agreed period.
Our testing may include walkthroughs, inquiry, inspection, re-performance, sample testing and data analysis. Where reliable system data is available, we can analyse larger populations using Excel, SQL and Power BI.
Reporting
Findings are structured around:
Condition → Criteria → Cause → Risk and Impact → Recommendation → Management Action
Reports provide management and governance committees with evidence-based findings, risk ratings and practical corrective actions.
Deliverables may include:
- IT risk and control assessment
- Risk and Control Matrix
- Audit programme and testing schedules
- Exceptions and findings register
- Final IT audit or ITGC report
- Management action plan
- Audit Committee reporting
- Follow-up report
Engagement Options
ITGC Readiness Review
Assessment of control design, documentation and implementation.
Full ITGC Audit
Assessment of control design and operating effectiveness over an agreed period.
Application-Specific IT Audit
Focused review of a business-critical application and its supporting controls.
IT Audit Co-sourcing
Specialist IT audit support for an existing internal audit function.
Independence and Objectivity
Muzamani assesses potential conflicts of interest before accepting assurance engagements. We do not undertake assurance work where previous advisory involvement creates a self-review threat that cannot be appropriately managed..
Engagement scope, responsibilities and reporting arrangements are agreed before fieldwork begins.
Standards and Frameworks
Depending on the engagement, our work may be informed by:
- IIA Global Internal Audit Standards
- COBIT 2019
- ISO/IEC 27001:2022 and ISO/IEC 27002:2022
- NIST Cybersecurity Framework 2.0
- COSO Internal Control Framework
- Applicable legislation, regulatory requirements and organisational policies
For public-sector engagements, applicable PFMA, MFMA and National Treasury requirements are also considered.
Who We Support
- State-owned entities and public-sector organisations
- Municipalities and public institutions
- Private-sector organisations
- NGOs and donor-funded programmes
- Organisations implementing or changing ERP and other business-critical systems
- nternal audit functions requiring specialist IT audit capacity
Why Muzamani?
Muzamani combines IT audit, internal audit, risk management, governance, SCM and data analytics experience.
This allows technology controls to be assessed in the context of the business processes and risks they support, rather than in isolation.
Need an Independent IT Audit or ITGC Review?
Whether you need an ITGC readiness review, full ITGC audit, application review or specialist IT audit support, we can scope the engagement around your systems and risks.