COSO IT Controls: Technology-Related Control Activities

The CFO was practically shouting into the phone. "Our auditors just flagged 47 IT control deficiencies. FORTY-SEVEN! We have a $200 million revenue business, and apparently, we've been running it like a lemonade stand!"

This was 2017, and I was being called in to help a rapidly growing financial services company fix their IT controls before their SOX 404 audit became a complete disaster. The problem? They'd invested millions in technology but virtually nothing in the controls that governed it.

Six months later, we'd remediated every deficiency, implemented a robust COSO-aligned IT control framework, and their external auditors couldn't find a single material weakness. More importantly, the company discovered something surprising: proper IT controls didn't slow them down—they actually accelerated growth by reducing errors, preventing outages, and building stakeholder confidence.

After spending fifteen years implementing COSO IT controls across industries from banking to healthcare to manufacturing, I've learned that technology controls aren't about bureaucracy—they're about building reliability into the systems that run your business.

Let me show you how.

What Are COSO IT Controls? (And Why Everyone Gets Them Wrong)

Here's the first thing most people misunderstand: COSO IT controls aren't a separate framework. They're the technology-related implementation of the COSO Internal Control—Integrated Framework, adapted for our digital-first business reality.

The Committee of Sponsoring Organizations (COSO) framework has been the gold standard for internal controls since 1992. But back then, "IT" meant mainframes in locked rooms managed by specialists in white coats. Today, technology IS the business for most organizations.

"In the 1990s, IT was a support function. Today, it's the central nervous system of your entire enterprise. Your controls need to reflect that reality."

The Three Categories of IT Controls That Actually Matter

Through years of implementation, I've found that COSO IT controls fall into three critical categories:

1. IT General Controls (ITGCs): The foundation that makes everything else possible 2. Application Controls: The specific controls within your business applications 3. IT-Dependent Manual Controls: Where humans and technology intersect

Let me break down each one with real-world examples.

IT General Controls: Your Control Foundation

ITGCs are the bedrock. Get these wrong, and everything built on top becomes questionable. I learned this lesson the hard way in 2016.

I was working with a manufacturing company that had beautifully designed application controls—automated approval workflows, segregation of duties, exception reporting. Their auditors loved the design. Then they tested the underlying IT general controls.

Disaster.

Developers had production access. Change management was "we deploy on Fridays and hope for the best." Access reviews happened "when we remember." Backups were theoretically daily but hadn't been tested in eighteen months.

The auditors threw out every single application control. Why? If you can't trust the IT environment, you can't trust anything running in it.

The Five Pillars of IT General Controls

Here's the framework I use with every client:

Let me tell you a story about each one.

Access Controls: The $3.2 Million Mistake

In 2019, I was called to investigate suspicious financial transactions at a mid-sized distributor. Someone had been creating fake vendors and issuing payments to them—over $3.2 million across fourteen months.

The fraud was sophisticated, but the vulnerability was embarrassingly simple: a terminated employee still had system access six months after leaving.

When we dug deeper, we found:

• 23% of active accounts belonged to terminated employees

• No regular access reviews (last one was 19 months prior)

• Shared administrative passwords across the IT team

• No monitoring of privileged account usage

The fix required implementing four critical access control activities:

User Access Provisioning

New Employee → Manager Approval → IT Provisioning → Role-Based Access → Documented in System

Access Reviews

• Quarterly manager certification of team access

• Monthly privileged access review

• Automated reports of dormant accounts

• Immediate termination workflow

Privileged Access Management

• Individual admin accounts (no sharing)

• Elevated access only when needed

• Session recording for critical systems

• Regular privileged account audits

Access Monitoring

• Real-time alerts for suspicious activity

• Login anomaly detection

• Failed access attempt tracking

• Regular access log review

The result? No unauthorized access incidents in the five years since implementation. But more importantly, the company could finally trust that transactions in their system were legitimate.

"Access control isn't about saying 'no' to people. It's about ensuring that when someone says 'yes' to a transaction, you know exactly who they are and that they're authorized to do it."

Change Management: When "Move Fast and Break Things" Breaks Everything

I'll never forget the call I got at 11:47 PM on a Wednesday in 2018. An e-commerce company's entire platform was down. Black Friday was 36 hours away.

The culprit? An "emergency" database change that hadn't been tested. The developer who made it was well-intentioned—trying to fix a performance issue. But the change cascaded into a complete system failure.

Cost of the outage: $1.8 million in lost revenue, plus another $400,000 in recovery costs.

The tragic part? A proper change management process would have caught the issue in testing, preventing the entire disaster.

Here's the change management framework that actually works:

After implementing this framework with the e-commerce company, here's what happened:

• 94% reduction in production incidents caused by changes

• Zero unplanned outages in the following Black Friday (compared to three the previous year)

• Faster deployment times because tested changes don't need rollbacks

• Developer satisfaction increased because they weren't firefighting constantly

The counterintuitive truth: Proper change controls make you faster, not slower.

Computer Operations: The Silent Killer

Computer operations failures are like carbon monoxide poisoning—silent, invisible, and potentially fatal.

I worked with a healthcare provider in 2020 that was experiencing "mysterious" data quality issues. Financial reports didn't reconcile. Patient records had inconsistencies. Nobody could figure out why.

After three weeks of investigation, we discovered the batch processing jobs that ran overnight were failing 30-40% of the time. They'd been failing for eighteen months. Nobody noticed because there was no monitoring, no alerting, and no operational procedures.

The data quality issues cascading through the organization were costing them millions in billing errors, compliance risks, and operational inefficiency.

Here's the operations control framework I implemented:

Job Scheduling and Monitoring

• Automated job scheduling with dependency management

• Real-time monitoring and alerting

• Automated retry logic for transient failures

• Daily operational review of job status

Incident Management

• Defined severity levels and escalation procedures

• 24/7 on-call rotation for critical systems

• Root cause analysis for all P1/P2 incidents

• Knowledge base of known issues and resolutions

Performance Monitoring

• Proactive capacity planning

• Real-time performance dashboards

• Automated alerts for degradation

• Regular performance tuning

Within six months:

• Batch job success rate: 99.7% (from 60-70%)

• Mean time to detect issues: 4 minutes (from "eventually")

• Mean time to resolve: 42 minutes (from hours or days)

• Data quality issues: reduced by 91%

Backup and Recovery: When "We Have Backups" Is a Lie

"Of course we have backups!" the IT manager assured me confidently in 2015.

"When did you last test a restore?" I asked.

Silence.

"Have you EVER tested a restore?"

More silence.

We tested that afternoon. The backup had been failing for eleven months. They just didn't know it because nobody was monitoring the backup logs.

This scenario is shockingly common. I've tested backup systems at over 30 companies, and here's the disturbing truth:

Here's the backup and recovery control framework that actually protects you:

Backup Controls

Daily automated backups → Automated validation → Secure storage → Retention management → Monitoring and alerting

Recovery Testing

• Quarterly full restore tests of critical systems

• Monthly sample restore tests

• Annual disaster recovery exercise

• Documented and updated recovery procedures

Monitoring and Validation

• Automated backup success/failure alerts

• Daily backup log review

• Backup integrity verification

• Storage capacity monitoring

I implemented this at a financial services firm in 2021. Six months later, they experienced a ransomware attack. Thanks to tested backups and documented procedures:

• Detection to isolation: 12 minutes

• Recovery decision made: 45 minutes

• Full operations restored: 4.2 hours

• Ransom paid: $0

• Data lost: 37 minutes of transactions (within acceptable RPO)

Compare that to the average ransomware recovery time of 21 days and average ransom payment of $570,000.

"Backups are like parachutes. You don't want to discover they don't work when you're already falling."

Application Controls: Where Business Logic Meets Technology

IT general controls are your foundation, but application controls are where the business actually happens. These are the controls embedded in your ERP, CRM, financial systems, and custom applications.

Let me share a framework I developed after watching too many companies struggle with application control design.

Input Controls: Garbage In, Gospel Out

In 2018, I investigated a $4.7 million inventory writeoff at a distribution company. The root cause? A clerk typed "10000" instead of "1000" in a purchase order, and the system happily accepted it.

No validation. No reasonableness check. No approval threshold. Just "CLICK. Congratulations, you've ordered 10,000 industrial widgets when you needed 1,000."

Here's the input control framework that prevents this:

After implementing these controls at the distribution company:

• 87% reduction in data entry errors

• $2.3 million prevented in erroneous orders (first year)

• 43% faster month-end close (fewer corrections needed)

• Zero inventory writeoffs due to data errors (following three years)

Processing Controls: The Black Box Problem

Processing controls ensure that data is handled correctly once it's in the system. This is where things get interesting—and where I've seen the most creative control failures.

My favorite example: A payroll system that was supposed to cap overtime at 20 hours per week. Due to a programming error, it actually multiplied overtime by 1.2 instead of capping it.

For six months.

An employee who worked 18 hours of overtime received pay for 21.6 hours. Nobody noticed because the amounts seemed reasonable. The company overpaid approximately $340,000 in overtime before someone caught it during an audit.

Here's the processing control framework:

Automated Controls

• System-enforced business rules

• Workflow routing and approvals

• Automated calculations and allocations

• Exception and error handling

Reconciliation Controls

• System-to-system reconciliations

• Control totals and batch balancing

• Automated variance analysis

• Period-over-period comparisons

Sequence and Timing Controls

• Transaction numbering and sequencing

• Cut-off controls for period-end

• Dependency management

• Scheduled job monitoring

Output Controls: Trust, But Verify

Output controls ensure that the results of system processing are accurate, complete, and delivered to the right people.

I worked with a healthcare provider in 2019 that was sending patient billing statements to wrong addresses. Not occasionally—systematically. About 8% of all statements.

The financial impact was massive:

• Delayed payments (average 34 days)

• Increased collection costs

• Patient satisfaction scores declining

• HIPAA privacy concerns (PHI going to wrong addresses)

Root cause? A data migration three years earlier had corrupted address records, but there were no output controls to detect it.

The output control framework I implemented:

Results after implementation:

• Misdirected statements: reduced to 0.3% (from 8%)

• Average payment time: improved to 21 days (from 34)

• Collection costs: reduced by 41%

• Patient satisfaction: increased 18 points

IT-Dependent Manual Controls: The Human Element

Here's something most COSO implementations miss: many "manual" controls actually depend on IT-generated information to work properly.

I call these IT-dependent manual controls, and they're where things often fall apart.

The $2.1 Million Reconciliation That Wasn't

In 2020, I was reviewing controls at a manufacturing company. They had a beautiful manual control: a senior accountant reconciled inter-company transactions monthly, investigating and resolving variances.

On paper, it looked great. In practice, it was a facade.

The reconciliation report came from their ERP system. During testing, we discovered:

• The report had a bug that excluded certain transaction types

• The bug had existed for 19 months

• Approximately $2.1 million in variances were invisible on the report

• The accountant was diligently reconciling... incomplete data

The manual control was working perfectly. The IT control feeding it was broken.

Framework for IT-Dependent Manual Controls

Here's how I help organizations identify and control IT-dependent manual processes:

Identification Phase

1. Map all manual controls in the organization

2. Identify which controls use system-generated data

3. Document the IT systems and reports involved

4. Assess criticality and materiality

Control Design Phase

Implementation Phase

• Implement required IT controls for each dependency

• Add compensating manual controls where IT controls are weak

• Train personnel on IT control dependencies

• Document the linkage between IT and manual controls

Monitoring Phase

• Test IT controls underlying manual processes

• Validate report accuracy and completeness

• Review user access to critical reports

• Assess ongoing control effectiveness

The COSO IT Control Implementation Roadmap (From Someone Who's Done It 50+ Times)

Let me give you the implementation approach that actually works in the real world.

Phase 1: Assessment (Weeks 1-4)

Week 1: Inventory and Scoping

• Identify all significant IT systems

• Document business processes dependent on IT

• Map IT controls to business risks

• Prioritize systems and controls by risk

Week 2: Current State Analysis

• Review existing IT control documentation

• Conduct management interviews

• Observe control execution

• Identify obvious gaps and deficiencies

Week 3: Risk Assessment

• Evaluate likelihood and impact of IT control failures

• Consider fraud risks and compliance requirements

• Assess compensating controls

• Develop risk-prioritized remediation list

Week 4: Gap Analysis and Planning

• Compare current state to COSO requirements

• Identify design deficiencies

• Assess operating effectiveness concerns

• Develop implementation roadmap

I worked with a $500M healthcare company that tried to skip the assessment phase. "We know our problems," they said. "Let's just fix them."

Four months later, they discovered their "known problems" were symptoms of deeper issues they'd completely missed. They had to start over, costing six weeks and $180,000.

Phase 2: Design (Weeks 5-12)

This is where you design the controls that will actually protect your organization.

Control Design Principles I Live By:

1. Automated > Manual (whenever possible)

2. Preventive > Detective (stop problems before they happen)

3. Simple > Complex (controls that people can't understand don't work)

4. Integrated > Bolt-On (build controls into processes, don't add them after)

Here's the design framework:

Phase 3: Implementation (Weeks 13-32)

This is where theory meets reality. And reality fights back.

Realistic Implementation Timeline:

Implementation Lessons from the Trenches:

1. Run pilots before full rollout - I learned this by NOT doing it and creating chaos

2. Document as you go - Trying to document after implementation is nightmare fuel

3. Train early and often - Controls that people don't understand get circumvented

4. Expect resistance - Change is hard; plan for it

5. Celebrate wins - Implementation is exhausting; acknowledge progress

Phase 4: Testing and Validation (Weeks 33-40)

You've designed controls. You've implemented them. Now comes the moment of truth: do they actually work?

Testing Framework:

I worked with a company that implemented beautiful access controls. Beautiful design. Perfect documentation. One problem: nobody was actually using them.

IT staff had discovered a "quick workaround" that bypassed the approval workflow. They meant well—they were just trying to be efficient. But it completely undermined the control.

We only discovered it during operating effectiveness testing. Good thing we tested.

"Controls that look good on paper but don't work in practice aren't controls—they're expensive documentation."

Phase 5: Monitoring and Continuous Improvement (Ongoing)

This is where most organizations fail. They implement controls, pass their audit, then forget about them until next year.

Bad idea.

Continuous Monitoring Framework:

Daily Monitoring

• Automated backup success/failure

• Failed login attempts

• Privileged account usage

• Critical system availability

Weekly Monitoring

• Access review exceptions

• Change management metrics

• Incident trends

• Control exception summaries

Monthly Monitoring

• Access certification by managers

• Change success rates

• System performance trends

• Control effectiveness dashboard

Quarterly Monitoring

• Formal control testing

• Risk assessment updates

• Process improvement reviews

• Metrics and KPI analysis

Annual Monitoring

• Comprehensive control assessment

• External audit preparation

• Framework updates

• Strategic improvements

Common Pitfalls I've Seen (And How to Avoid Them)

After implementing COSO IT controls at over 50 organizations, here are the mistakes I see repeatedly:

Pitfall #1: Focusing on Compliance Instead of Risk

The Mistake: Implementing controls because "the auditors require it" without understanding the underlying risk.

Real Example: A company spent $120,000 implementing segregation of duties controls in a system that only two people used, for non-material transactions, with complete audit logging. The risk was negligible, but "SOX required it."

The Fix: Start with risk assessment. Implement controls proportional to actual risk. Use compensating controls when primary controls are too expensive for the risk level.

Pitfall #2: Over-Documenting, Under-Implementing

The Mistake: Creating 300 pages of control documentation that nobody reads or follows.

Real Example: I reviewed a company's change management procedure. It was 47 pages long, with flowcharts, forms, and detailed instructions. When I asked developers how they request changes, they said, "Oh, we just email Bob."

The Fix: Documentation should be useful, not impressive. One-page process documents with clear steps. Quick reference guides. Visual workflows. Make documentation a tool people actually use.

Pitfall #3: Treating IT Controls as IT's Problem

The Mistake: Making IT responsible for controls that protect business processes.

Real Example: A finance team complained that IT's change management process was "slowing them down." They demanded exceptions for their ERP system. Within six months, an unauthorized change caused a material financial misstatement.

The Fix: IT controls protect business outcomes. Business owners must be engaged and accountable. IT provides expertise, but business owns the risk.

Pitfall #4: Implementing Controls That Don't Scale

The Mistake: Manual controls that work for 10 people but break when you have 100.

Real Example: A startup had a manual process for provisioning access—IT manager personally reviewed and approved every request. Worked great at 30 employees. Became a nightmare at 200. Delayed onboarding, frustrated managers, created security risks as people shared accounts to "just get work done."

The Fix: Design controls for where you're going, not where you are. Automate from the start. Build scalability into control design.

The ROI of IT Controls: Real Numbers from Real Organizations

Let me address the elephant in the room: IT controls are expensive. But you know what's more expensive? Not having them.

Here's data from companies I've worked with:

Common sources of ROI:

1. Prevented incidents and outages (typically 2-5x implementation cost)

2. Reduced audit fees and time (20-40% reduction)

3. Lower cyber insurance premiums (30-60% reduction)

4. Operational efficiency gains (15-30% improvement in IT productivity)

5. Faster close processes (25-40% reduction in month-end time)

6. Market access (enterprise deals previously unavailable)

7. Reduced fraud and errors (varies widely, but often substantial)

Your Action Plan: Getting Started with COSO IT Controls

If you're ready to implement proper IT controls, here's your roadmap:

Week 1: Executive Alignment

• Present business case to leadership

• Secure budget and resources

• Identify executive sponsor

• Set realistic expectations

Weeks 2-4: Quick Assessment

• Inventory IT systems and processes

• Identify top 10 IT risks

• Review any existing controls

• Engage internal audit

Month 2: Framework Selection

• Decide control framework (COSO, COBIT, ISO)

• Define scope and priorities

• Establish governance structure

• Hire expertise (internal or consultant)

Months 3-6: Design and Pilot

• Design critical controls

• Pilot with one system or process

• Refine based on feedback

• Develop training materials

Months 7-12: Full Implementation

• Roll out across organization

• Train staff extensively

• Document everything

• Begin monitoring

Year 2+: Optimization

• Continuous monitoring

• Regular testing and validation

• Process improvements

• Expand scope as needed

Final Thoughts: IT Controls as Competitive Advantage

I started this article with a story about 47 control deficiencies. Let me end with the rest of that story.

After we remediated those deficiencies and implemented a robust COSO IT control framework, something unexpected happened. The company didn't just pass their audit—they transformed their operations.

Within 18 months:

• System uptime increased from 97.2% to 99.7%

• Month-end close time reduced from 12 days to 6 days

• IT incidents decreased by 73%

• External audit fees reduced by 34%

• Won their largest enterprise customer (who required SOC 2 compliance)

• Reduced cyber insurance premium by 42%

The CFO who'd been shouting into the phone called me two years later. "Those IT controls we fought so hard against? Best investment we ever made. They didn't just fix our audit problem—they made us a better company."

That's the real secret of COSO IT controls. Done right, they're not compliance overhead—they're the foundation of operational excellence.

The question isn't whether you can afford to implement IT controls. It's whether you can afford not to.