The purpose of this sample audit work program—focused on access to programs and data—is to outline the IT general controls to be tested, review the results of management’s testing, and document the procedures to test each control.

Document the procedures to be performed to conclude on the operating effectiveness of the controls identified, including a specific description of the nature, timing and extent of procedures. For all controls that are tested at an interim date, list the procedures performed to roll-forward the interim testing to period end. Organizations should continuously update/monitor this work program to ensure that documentation reflects business operations.