Strong IT General Controls, Smarter Technology: How Smaller Reporting Companies Can Innovate with Confidence

Why are strong IT General Controls (ITGCs) essential for smaller reporting companies (SRCs) embracing automation and AI?

For smaller reporting companies (SRCs), maintaining secure, reliable, and efficient IT systems is essential, particularly given their limited personnel and infrastructure. ITGCs, including access controls, change management, and data backup and recovery, provide a foundational framework to protect systems and data across the entire IT environment. These controls are especially valuable for SRCs, where well-targeted efforts can improve resilience and compliance without requiring significant cost or overhead.

ITGCs as a Safeguard for Automation and AI in SRCs

As SRCs increasingly adopt automation and emerging technologies such as artificial intelligence to streamline operations, the role of ITGCs has grown significantly in managing associated risks. Historically seen as a lower risk area within an Internal Controls over Financial Reporting (ICFR) audit, ITGCs now represent a critical safeguard, particularly where SRCs rely on automated processes like system generated reports and transaction processing.

With fewer personnel to manually oversee systems, SRCs benefit from strong ITGCs that ensure these technologies function securely, accurately, and as intended, preventing unauthorized changes and mitigating failures. When automation does falter, ITGCs such as batch job monitoring provide a vital safety net, helping SRCs maintain operational integrity with limited resources.

Securing Information Produced by the Entity (IPE)

System reports and datasets used for financial reviews and audits are collectively referred to as IPE must be trustworthy. SRCs can gain immense value from ITGCs that properly control access, prevent unauthorized modifications, and ensure system stability. This allows management and auditors to rely on the data shown in key reports without requiring extensive manual validation, boosting confidence in the organization’s IT governance and ultimately, their financial records.

Three ITGC Principles for SRCs Embracing Automation and AI

As SRCs continue their journey toward automation and AI-driven efficiency, it’s vital they remain proactive in fortifying their internal controls with ITGCs being the key foundation that supports innovation, keeping these three principles top-of-mind:

1. Automation Demands Accountability – Emerging technologies can streamline processes but without robust ITGCs, SRCs risk unintended consequences from system errors or unauthorized changes.
2. AI Amplifies Control Complexity – The intelligence behind automation introduces new layers of risk making governance and oversight more critical than ever.
3. Lean Teams Require Lean Safeguards – With limited personnel, SRCs must lean on well-implemented ITGCs to maintain integrity across automation systems.

How Can Schneider Downs Help?

Schneider Downs assists SRCs not subject to the SOX 404(b) auditor attestation requirement in achieving SOX compliance that aligns with management, and where necessary, external auditor, expectations. Our experienced team collaborates with companies to design and execute a cost-effective approach for management’s attestation of effective internal controls over financial reporting.

For more information contact our team at [email protected].