Information systems audit from a Coimbatore audit firm

ITGC Audit Services for Mid-Size Companies in Tamil Nadu

When the statutory auditor raises IT exceptions, or an ERP change is due before year end, a mid-size Tamil Nadu company needs its IT general controls tested by someone other than the auditor. Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, provides ITGC audit services through its information systems practice. Access, change and operations testing gives you rated findings, agreed remediation actions and working papers the statutory auditor can inspect.

Scope Your ITGC Audit

Locked server racks and overhead cable trays in the server room of a Tamil Nadu manufacturing company

Our ITGC Audit and IT General Controls Services

IT general controls testing for companies that run an ERP across plants, branches or showrooms, rated by effect on the accounts.

Access to Programs and Data

Joiner, mover and leaver processes, privileged and administrator accounts, vendor support access and periodic access reviews, tested against the ERP user list and the HR exit list. These are controls a statutory auditor samples under section 143(3)(i).

Learn More

Program Development and Changes

Approval, testing and migration of changes, emergency changes and the separation of developers from production, evidenced by change tickets, test records and transport logs, so automated ERP controls relied on under the Companies Act, 2013 stay intact.

About Change Management Testing

Computer Operations, Backup and Recovery

Job scheduling, interface monitoring, incident handling, backup schedules and restoration testing, sampled across the financial year to 31 March, with batch job logs, incident registers and restoration results as evidence for each control.

View IT Operations Testing

Program and Data Integrity

Controls over data accuracy and completeness, including database management and data validation, so the internal financial controls that the board report covers under rule 8(5)(viii) of the Companies (Accounts) Rules, 2014 rest on reliable data.

See ITGC Audit Areas

Design and Operating Effectiveness Testing

Each control is tested for design and for operating effectiveness, with sample sizes set by control frequency and, where needed, an interim round and a roll-forward to 31 March, and working papers the statutory auditor can inspect.

See the ITGC Audit Scope

Controls Testing Mapped to a Parent's SOX Template

For Indian units of US-listed groups, IT general controls are tested as part of internal financial controls under COSO, and each control can be mapped to the parent's SOX template so one round of testing serves both year ends.

Explore Information System Services
Backup media, binders and files inside an open fireproof safe in a factory IT room

Our 5-Step ITGC Audit Process

Scoping the systems
For mid-size companies in Coimbatore, Tiruppur, Erode and Chennai, we list every system that posts to the ledger: the ERP, payroll, banking interfaces and plant or showroom systems. The period, the interim date and any exceptions raised by the statutory auditor are agreed in writing.

Walkthrough and design review
Each control is walked through with its owner in finance and IT, from user creation to change approval and backup. We assess whether the control, as written, would prevent or detect a mistake, and record design gaps before any sample is drawn for testing.

Operating effectiveness testing
Samples are drawn by control frequency across the period. Evidence such as ERP user lists, HR exit lists, change tickets, batch job logs and restoration results is filed in working papers, so the statutory auditor can inspect the same evidence later.

Findings rated by effect on the accounts
Every exception is rated by its effect on the financial statements, not by technical severity alone. Each finding carries an owner, an agreed action and a target date, and the summary is presented to management and, where one exists, the audit committee.

Agreed actions and follow-up
For Tamil Nadu manufacturers and distributors, each finding ends in an agreed remediation action, from removing leaver accounts to restricting the implementation partner's access. Failed controls can be retested once remediation is complete, where the engagement includes a follow-up round.

Choose by the output you need

IT Controls Tested With the Process Behind Them

ITGC audit providers produce different outputs. A Big Four firm suits work that feeds a US parent's SOX programme or a multi-country ERP. An IT audit or cyber security specialist suits cloud hosting, many integrated applications or online sales. A national mid-size firm combines ITGC testing with internal financial controls documentation. An internal audit practice with information systems auditors tests IT controls together with process controls such as purchase approvals and rate masters. Astral Business Consulting works in that last way. Choose the provider by the output your finance team and auditor need.

UPS battery racks and a distribution panel beside a factory server room

Audit-led IT controls testing

Why Choose Astral Business Consulting for IT General Controls Testing?

Through the computer, not around it

Audits at Astral Business Consulting run through the computer, not around it, so access lists, change logs and backup records are tested in the system itself rather than taken from a questionnaire.

A library of IT risks and controls

Testing draws on an in-house library of more than 2,500 information-systems risks and controls, within a COSO-based methodology, so each ERP environment is reviewed against a consistent, documented set of control objectives.

IT and process controls together

One team tests the IT general controls and the process controls that depend on them, such as purchase approvals and inventory postings, so finance and IT do not receive duplicate requests.

Western Tamil Nadu manufacturing depth

Testing is planned for how plants in Coimbatore, Tiruppur, Erode, Salem and across Tamil Nadu actually work, where shared despatch log-ins, partner administrator rights kept after go-live and shared supervisor passwords are frequent gaps.

About Astral Business Consulting LLP

A Coimbatore-based management consulting and audit firm

Astral Business Consulting LLP is a management consulting and audit firm based in Coimbatore, offering internal, process and management audit to manufacturers across Western Tamil Nadu. Its work is organised in four divisions: Integrated Audit, Cycle Count, Best Accountant and Consulting. Its information system services cover ITGC audit, ERP and application audit, ERP selection and implementation support, and ISO/IEC 27001:2022 implementation support. The methodology is COSO-based and draws on an in-house library of more than 4,000 risks and controls, including 2,500+ information-systems risks and controls and 1,500+ process risks and controls. The team includes Chartered Accountants, Cost Accountants, software experts, engineers and information-systems auditors. Clients come from textiles and spinning, foundries and engineering, dairy and FMCG, jewellery retail, auto dealerships and educational trusts across Tamil Nadu.

  • 2,500+information-systems risks and controls in the in-house library
  • 1,500+process risks and controls
  • Four divisionsIntegrated Audit, Cycle Count, Best Accountant and Consulting

Questions About ITGC Audit Services

Which firms do ITGC audits for mid-size companies?
Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, does ITGC audits through its information systems services, testing IT controls together with process controls. Other options are national mid-size firms, IT audit specialists and Big Four firms. Choose one that knows your ERP, rates findings by effect on the accounts and is not your statutory auditor, which tests these controls for its own report under section 143(3)(i).

What does an ITGC audit cover?
An ITGC audit covers four main areas: access to programs and data, program development and changes, computer operations including backup and recovery, and program and data integrity, with IT policies and governance reviewed alongside. It tests whether these controls are designed well and operated throughout the period, so that application controls such as three-way matching inside the ERP can be relied on.

Are IT general controls part of internal financial controls in India?
Yes. Internal financial controls with reference to financial statements include the IT general controls behind automated ERP controls. Statutory auditors assess them within the same evaluation under section 143(3)(i) of the Companies Act, 2013, not as a separate IT exercise. If access or change controls fail, the auditor usually extends substantive testing instead.

Does every company need an ITGC audit for internal financial controls reporting?
No. One person companies, small companies and certain other smaller private companies are exempt from the auditor's internal financial controls reporting. Since 1 December 2025, a small company means paid-up capital up to ₹10 crore and turnover up to ₹100 crore. Other companies benefit from testing IT general controls before the statutory auditor does.

Can our statutory auditor also do the ITGC audit?
Not where the ITGC review forms part of internal audit. Section 144 of the Companies Act, 2013 bars the statutory auditor from providing internal audit, and design and implementation of any financial information system, to the company, its holding company or subsidiary. A standalone review is not a listed service but still needs board or audit committee approval, so confirm the position with your legal adviser.

Who does SOX ITGC testing for the Indian arm of a US-listed company?
SOX ITGC testing for an Indian arm is done by Big Four firms, national mid-size firms and internal audit practices with information systems auditors, working to the parent's risk and control matrix. SOX reaches an Indian company only when it, or a parent that consolidates it, files reports with the US SEC. Mapping each control to both frameworks avoids testing twice.

Who can audit our SAP system for access controls and segregation of duties?
An information systems auditor reviewing user access can test who holds which roles in the ERP, including privileged accounts, conflicting roles and support access kept by the implementation partner. Ask for evidence from the system itself, such as role and user lists, and for each conflict to be rated by its effect on the accounts.

Does an ISO 27001 internal audit replace an ITGC audit?
No. An ISO/IEC 27001:2022 internal audit checks whether the information security management system meets the organisation's own requirements and the standard, and its results go to management review. An ITGC audit tests controls over systems that feed the financial statements. The two overlap on access and backup, so evidence can be shared.

Tamil Nadu Service Coverage Areas

Astral Business Consulting is based in Coimbatore and tests IT general controls for companies across Tamil Nadu, including Coimbatore, Tiruppur, Erode, Salem, Chennai, Hosur, Madurai and Tiruchirappalli, with walkthroughs at the plant, branch or head office that runs the ERP.

Discuss Your ITGC Audit Requirement

Leave your name and email and the team will respond as soon as possible. Have ready the systems that post to your accounts, what your statutory auditor has raised and the date you are working to, for the first call.

contact@astralbusinessconsulting.com

Scope your ITGC audit

Tell us a bit about you and we'll be in touch shortly.

contact@astralbusinessconsulting.comScope Your ITGC Audit