Topic starter
24/06/2026 11:20 pm
TL;DR: IT application controls inside ERP and SaaS systems are shifting from annual evidence collection to continuous assurance, according to SafePaaS, because static testing cannot keep pace with configuration changes, releases, and control drift. The governance challenge is no longer whether a control was designed correctly, but whether it still operates as intended after the environment changes.
Editorial analysis by NHI Mgmt Group, based on content published by SafePaaS: “What Does ITAC Stand For? A Practical Guide for Audit and IT”.
Key questions
Q: What breaks when IT application controls are only tested at audit time?
A: They can drift out of alignment with the live application even when the original design was sound.
Q: When should organisations prioritise continuous testing over periodic assessments?
A: Organisations should prioritise continuous testing when asset turnover, cloud change, or third-party integration volume makes scheduled reviews too slow to stay current.
Q: What signals show that IT application controls are drifting out of date?
A: The clearest signals are repeated exceptions, controls that no longer match current workflows, and evidence packs that require manual reconstruction every audit cycle.
Practitioner guidance
- Inventory every in-scope ITAC Create a single inventory that maps each control to the process, risk, application, owner, and evidence source so audit and operations work from the same list.
- Bind controls to change governance Require configuration changes, role changes, and custom code changes to trigger review of any ITAC they could affect, including compensating controls and exception paths.
- Monitor control execution continuously Track whether each ITAC ran, how often it ran, and what exceptions it produced so evidence is available before the audit request arrives.
Bottom line: IT application controls only create assurance when their live behaviour still matches their documented design.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:08 am
Continuous assurance is becoming the real control objective for ITAC programmes: annual evidence collection cannot prove that an application control remained effective after the environment changed. When ERP and SaaS releases keep moving, the control has to be treated as an operating condition, not a once-a-year test artifact. The practitioner conclusion is that control ownership now includes ongoing validation, not just initial design.
A question worth separating out:
Q: How should audit, finance, and IT share responsibility for ITACs?
A: Audit should define the assurance objective, finance should own the business process risk, and IT should maintain the configuration and monitoring needed to keep the control effective. If those roles are separated without a shared inventory and exception workflow, the organisation ends up with fragmented evidence and unclear ownership.
👉 Read our full editorial: IT application controls are shifting from audit evidence to continuous assurance