An IT-substantive strategy involves understanding IT processes, the risks within those

processes and identifying and testing the ITGC that address the risks

Answer

IT general control. ITGC (IT General Control) is a basic control that can be applied to IT
systems such as applications, operating systems, databases, and supporting IT infrastructures.
The purpose of ITGC is to ensure the integrity of the data and processes supported by the
system.

Our strategies for addressing the risks of using IT are developed at the IT application level or
coherently for all related IT applications.

• ITGCreliance strategy allows you to identify and test ITGC processes, understand the risks
in the process, and respond to risks.

• A practical strategy for IT can address these risks by understanding the IT processes, the
risks along the way, and practically testing the activities of the IT processes.

When planning to use an ITGCreliance strategy or an ITsubstantive strategy, identify IT

applications as “scopes” of IT process steps.

• A direct test strategy can test application controls and IT Dependent Documentation
(ITDM) controls over time to determine whether IT risk handling has failed.

• Do not rely on SCOT's management for practical strategies. Design and implement
substantive procedures at the assertion level to address the risk of material misrepresentation.