The Senior IT Auditor's Cloud-Era ITGC Workpaper

Description

What is the The Senior IT Auditor's Cloud-Era ITGC course about?

How a Senior IT Auditor at a large US bank rebuilds ITGC workpapers when the in-scope estate is half mainframe SOX and half AWS landing zone. Last year's ITGC workpaper set was built for mainframe and three on-prem ERPs. This year's in-scope list includes a cloud landing zone, Terraform pull requests, federated IdP entitlements, and pipeline merges, and the audit committee read-out.

Why this course?

What do you take away from the The Senior IT Auditor's Cloud-Era ITGC course?

A SOX ITGC scoping memo that defends a half-legacy, half-cloud boundary in plain language. A rewritten Risk and Control Matrix with cloud landing zone, IaC pipeline, federated IdP, and secrets manager entries. An IPE testing approach that holds for cloud-native logs (CloudTrail, IdP audit logs, pipeline run logs). A change-management population that captures Terraform pull requests and pipeline merges, not just ServiceNow.

What you get with this course?

Twelve written modules in the Art of Service learning environment, structured as audit workpaper guidance rather than theory. Downloadable templates for every module: scoping memo, RCM, IPE log, change-management population definition, access-recertification testing approach, secrets management test program, fourth-party reliance memo, data flow walkthrough script, exception log, retest plan, audit committee one-pager, workpaper carry-forward checklist. Worked examples from three representative US bank.

What you will have in hand by Day 1, Week 1, Month 1?

Within 24 hours: course access is provisioned in the Art of Service learning environment and the hand-built implementation playbook is delivered alongside it. Week one: scoping memo and RCM rewrite (modules 1 and 2). Weeks two and three: IPE, change-management, access, secrets, and vendor-risk modules (modules 3 through 7). Week four: data lineage walkthrough, exception logging, retest, audit committee summary, and carry-forward.

What does the The Senior IT Auditor's Cloud-Era ITGC cover on before and after?

The scoping memo is half last-year's text and half placeholder. The change-management population is still defined as ServiceNow tickets only. The IPE approach for CloudTrail is being written from scratch at fieldwork time. The audit committee summary is the document the IT Audit Director keeps sending back. The scoping memo defends a half-legacy, half-cloud boundary on one page. The RCM has the.

What happens if you do not address this?

The cycle closes late, the audit committee read-out gets re-drafted three times, and the carry-forward into next year inherits the same problem in a larger estate. Second-line technology risk starts redoing the IT audit work in parallel, the engagement partner pushes scope wider, and the workpaper review window collapses. The bank's external auditor reads the SOX 404 file and writes the kind.

Who it is for?

A Senior IT Auditor inside a large US bank's internal audit function, four to ten years in, leading the IT side of SOX cycles plus a couple of operational audits on cloud, vendor risk, or model risk. Accountable for scoping, workpapers, exception tracking, retest, and the audit committee summary on the IT side. Reports to an IT Audit Director, partners with second-line.

More answers: what you get with every course, refund policy, all help answers.

A focused course, tailored for you

The Senior IT Auditor's Cloud-Era ITGC Workpaper Playbook

How a Senior IT Auditor at a large US bank rebuilds ITGC workpapers when the in-scope estate is half mainframe SOX and half AWS landing zone.

Last year's ITGC workpaper set was built for mainframe and three on-prem ERPs. This year's in-scope list includes a cloud landing zone, Terraform pull requests, federated IdP entitlements, and pipeline merges, and the audit committee read-out has to land in the same window. The walkthrough notes do not survive copy-paste.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Senior IT auditors at large US banks are scoping the next SOX cycle into an estate that has moved decisively. The lines of business that migrated workloads to the cloud broke the old change-management population, the old IPE evidence approach, and the old access-recertification testing. The Risk and Control Matrix was written for SAP, Oracle EBS, and the legacy core. It now needs entries for the landing zone, the pipeline, the IdP, and the secrets manager. The scoping memo has to defend the new boundary in plain language for the engagement partner. The retest tracker has to hold up under second-line review. The audit committee summary at the back of the cycle has to read as confident, not as a recital of new acronyms. The walkthrough alone takes longer than it used to, and the workpaper set is the part that has to absorb all of it.

What you walk away with

A SOX ITGC scoping memo that defends a half-legacy, half-cloud boundary in plain language.
A rewritten Risk and Control Matrix with cloud landing zone, IaC pipeline, federated IdP, and secrets manager entries.
An IPE testing approach that holds for cloud-native logs (CloudTrail, IdP audit logs, pipeline run logs).
A change-management population that captures Terraform pull requests and pipeline merges, not just ServiceNow tickets.
An access-recertification evidence approach for federated entitlements and just-in-time access.
An audit committee one-pager that explains the new estate without retreating into jargon.

The 12 modules

Module 1. Scoping memo for a half-legacy, half-cloud SOX estate

Rewrites the scoping memo for an estate where SAP, Oracle EBS, and the legacy core still carry material balances but the customer-facing platforms moved into AWS. Walks through how to defend the in-scope boundary to the engagement partner when application owners are arguing it should be narrower and second-line technology risk is arguing it should be wider. Includes the scoping memo template the auditor actually files, with worked examples for three representative banks and a sign-off checklist.

Module 2. Rewriting the RCM for cloud landing zone controls

Takes the existing Risk and Control Matrix and walks through the new entries needed for the cloud landing zone: account vending, guardrails, the platform control plane, network segmentation, and the shared services account. Each new control row is mapped to a testable artefact and a population, so the workpaper writer is not inventing test steps at fieldwork time. The deliverable is a populated RCM the audit team can drop straight into the workpaper set.

Module 3. IPE testing for cloud-native log sources

Builds the Information Produced by the Entity approach for CloudTrail, IdP audit logs, pipeline run logs, and configuration baseline reports. Walks through how to assert completeness and accuracy when the report does not come out of a controlled BI environment. Includes the IPE log template the team fills in for each test, the second-line review checklist, and worked examples for three of the most commonly tested cloud log sources.

Module 4. Change-management population for IaC pipelines

Expands the change-management population from ServiceNow change tickets to include Terraform pull requests, pipeline merges into the production branch, and emergency cloud console changes. Walks through how to test for segregation of duties when the same engineer can both author and approve a pull request, and how to evidence the four-eye control when it lives in GitHub or GitLab rather than ServiceNow. The deliverable is a population definition memo plus the sampling approach.

Module 5. Access recertification when entitlements are federated

Tests user access when the application entitlements live in an IdP, the IdP groups map to roles, and the roles map to application permissions through SCIM or a separate provisioning tool. Walks through how to walk the auditor from the IdP audit log back to the application access screen, how to handle just-in-time and privileged-access elevations, and how to evidence the quarterly recertification when the recertification tool is itself a new in-scope application.

Module 6. Secrets and key management as an ITGC control area

Adds a control area for secrets management and key management, which used to live inside application-level controls but now sits in a shared cloud service. Walks through how to scope the keys and secrets that protect financial reporting data, how to test rotation, how to test access to the secrets manager itself, and how to evidence break-glass procedures. Includes the test program the auditor uses for the secrets manager and the key management service.

Module 7. Vendor risk and cloud provider concentration

Frames the cloud provider itself as a fourth-party concentration risk and walks through how the IT auditor brings that into the cycle without duplicating the third-party risk management programme. Covers SOC 1 and SOC 2 reliance, the bridge letter handling at year end, the customer responsibility matrix walkthrough, and how to evidence that the bank's compensating controls cover the gaps named in the SOC report. Includes the reliance memo template.

Module 8. Data lineage and the in-scope data flow walkthrough

Walks the auditor through the data flow from source system, through the landing zone, into the data warehouse, into the reporting layer, and out to the financial statement disclosures. Names the control points along the way and which auditor (financial statement audit, IT audit, model risk audit) owns which control. Includes the data flow diagram template, the control-point inventory, and the walkthrough script.

Module 9. Exception logging and the second-line review loop

Sets up the exception log so that an exception raised at fieldwork has a clean path through second-line technology risk and back into the audit committee summary. Walks through the criteria for management response, severity rating, remediation tracking, and retest design. Includes the exception log template, the management response template, and the retest scoping checklist.

Module 10. Retest design for cloud and IaC controls

Designs the retest for a cloud or IaC control that failed initial testing. Walks through how to pick the retest population, how to handle remediation that itself changes the pipeline, and how to time the retest so it lands before the audit committee read-out. Covers the difference between a control redesign retest and a control operating-effectiveness retest. Includes a retest plan template and three worked examples from common cloud control failures.

Module 11. Audit committee summary for a cloud-heavy cycle

Writes the audit committee one-pager when the cycle covered a cloud migration. Walks through how to explain the new control areas in plain language for a committee that has heard about cloud for years but has not seen it inside the audit report. Includes the one-pager template, three written examples calibrated to different committee styles, and the talking points the auditor uses with the IT Audit Director before the meeting.

Module 12. Next cycle scoping and the workpaper carry-forward

Closes the cycle by setting the carry-forward for next year. Walks through which workpapers should roll forward unchanged, which need a full rewrite because the underlying control changed, and which control areas need to be added because of regulator focus or new applications coming in. Includes the carry-forward checklist, the workpaper retirement memo template, and the new-control intake form.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Scoping the next SOX cycle into a half-legacy, half-cloud estate (modules 1, 2).

Writing IPE and change-management workpapers that survive second-line review (modules 3, 4).

Testing access and secrets controls when they live in federated cloud services (modules 5, 6).

Handling cloud-provider concentration, exceptions, retest, and the audit committee read-out (modules 7 through 12).

What you get with this course

Twelve written modules in the Art of Service learning environment, structured as audit workpaper guidance rather than theory.
Downloadable templates for every module: scoping memo, RCM, IPE log, change-management population definition, access-recertification testing approach, secrets management test program, fourth-party reliance memo, data flow walkthrough script, exception log, retest plan, audit committee one-pager, workpaper carry-forward checklist.
Worked examples from three representative US bank ITGC cycles for each module.
Per-buyer implementation playbook hand-built for the buyer's actual in-scope estate and SOX cycle calendar, delivered alongside course access.
Thirty-day money-back guarantee.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: course access is provisioned in the Art of Service learning environment and the hand-built implementation playbook is delivered alongside it.

Week one: scoping memo and RCM rewrite (modules 1 and 2).

Weeks two and three: IPE, change-management, access, secrets, and vendor-risk modules (modules 3 through 7).

Week four: data lineage walkthrough, exception logging, retest, audit committee summary, and carry-forward (modules 8 through 12).

Before and after

Before

After

The scoping memo defends a half-legacy, half-cloud boundary on one page. The RCM has the new cloud-landing-zone control rows in place with their populations defined. The IPE log and change-management workpaper are filled in from templates that pre-date fieldwork. The audit committee one-pager reads as confident, lands in the first review, and frees the cycle to close on time.

What happens if you do not address this

Who it is for

Who this is NOT for. First-line IT control owners. External auditors at a Big Four firm. Staff auditors below the workpaper-owner level. CISO-track operators who do not write audit evidence. Anyone whose week is not built around scoping, walkthrough, testing, exception tracking, retest, and committee reporting.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. About twenty hours of reading and template work spread across four weeks, plus the time the auditor spends adapting the templates to the bank's actual workpaper conventions. Most of the value is realised the first time a template replaces a workpaper that was being written from scratch.

Why $199 is the right number

Internal Audit training courses from the IIA cover ITGC at a generic level and do not ship the workpaper templates. The Big Four publish thought-leadership white papers on cloud audit but do not give the workpaper set. Internal knowledge-management sites carry last year's workpapers which are exactly what no longer works. This course ships the templates and the worked examples calibrated to the half-legacy, half-cloud estate the auditor is actually walking through.

FAQ

Is this course Big-Bank specific?

It is calibrated to a large US bank's SOX cycle and the IT audit team structure that goes with it. Senior IT auditors at insurance carriers, broker-dealers, and large asset managers have used similar workpaper structures, but the worked examples are US banking.

Does the course cover model risk audit or SR 11-7?

No. Model risk audit is a separate discipline. The course covers ITGCs that are in scope for SOX 404 and the IT audits of cloud, change management, access, and vendor risk that sit alongside SOX in a typical bank IT audit plan.

How is the implementation playbook tailored?

After purchase the auditor sends a short note describing the in-scope estate, the current SOX cycle calendar, and the two or three control areas under the most pressure. The playbook is hand-built against that information and delivered alongside course access.

Will the templates conflict with the bank's existing workpaper format?

The templates are structured to map cleanly onto the most common workpaper systems and onto Excel-and-Word workpaper sets. The auditor adapts the format to the bank's house style during the first cycle.

Refund policy?

Thirty days, no questions asked.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.