According to IIA guidance, which of the following statements is true?

According to official IIA guidance, the IT environment is viewed as having multiple layers, each with its own set of risks and corresponding controls. This layered model typically includes entity-level controls (related to governance), general IT controls (which apply to many applications and support the overall IT environment, such as change management and logical access), and application-level controls (specific to individual software applications). Risks can manifest at any of these layers, and a comprehensive control framework must address them accordingly. This concept is fundamental to creating a "defense-in-depth" strategy, ensuring that the failure of a single control does not compromise the entire system.

A. Risks are best mitigated by an integrated system of controls (defense-in-depth), not by relying on individual controls which can have single points of failure.
B. The focus of a control framework is on the entire IT environment, including governance and general controls, not just on controls within critical applications.
C. IT risks are strategic, financial, and compliance-related, not just operational. A purely bottom-up approach is insufficient; a top-down approach is also needed to align with strategic objectives.

1. The Institute of Internal Auditors (IIA), Global Technology Audit Guide (GTAG) 1: Information Technology Controls, 2nd Edition, 2012.

Page 6, Figure 1, "IT Control Hierarchy" and accompanying text: This section explicitly illustrates and describes the layered nature of IT controls. It states, "IT controls can be viewed as a hierarchy... At the top of the hierarchy are governance and management controls that create the IT control environment. The next layer is general controls... The final layer is application controls..." This directly supports the concept that control process risks are found at multiple layers.

2. The Institute of Internal Auditors (IIA), Global Technology Audit Guide (GTAG) 8: Auditing Application Controls, 2nd Edition, 2012.

Page 4, "Relationship Between General and Application Controls": This guide reinforces the layered concept by stating, "IT general controls create the environment in which application systems and controls operate. If the general controls are not effective, the application controls may be rendered ineffective." This highlights the interdependency and existence of controls at different layers (general and application).