System Control (IT Control) Analyst Job Requirements

Just like IT Risk analyst, IT control analyst is responsible for identifying weaknesses within an organization's information systems, processes and infrastructures and ensure the implementation of measures to minimize such risk. However, it specializes in devising, innovating and implementing controls to minimize/mitigate risk, vulnerabilities or threats identified by the IT risk analyst for the realization of business objectives. IT Control or System Control analyst sees to the today-to-today running of business system, process and application controls in terms of control effectiveness and adequacy. It provides continuous (daily) assurance to the business on the effectiveness and adequacy of system, process and technology controls as well as other safeguards/measures put in place by management for the realization of business objectives unlike Information Systems Auditors whose assurance function is periodic or seasonal (e.g. annually or bi-annually) and does not need to sit with the business on daily basis to provide its assurance in order to retain its independence. While information systems auditors within internal audit function reports to the Board audit committee (BAC) through the Chief Internal Auditor (CAE) for the purpose of giving stakeholders (management and the Board of Directors) independent opinion or assurance on the effectiveness and adequacy of controls and risk management activities, the IT control or systems control analyst sits with the business management and assist it in devising and implementing controls to minimize business risk arising from weaknesses within the business systems and IT infrastructures of an organization.

IT Control analyst plays a leading role in the conceptualization and implementation of new IT driven business projects or optimization/upgrade of existing systems and business solutions. Whether the new project/solution is developed in-house, outsourced or off-the-shelf acquisition, the IT Control or System Control analyst is part of all stages of the system development/acquisition life-cycle (SDLC) to ensure that controls that meet business requirements are embedded at all levels of the systems rather than the costly retrofitting of controls when the project or system is already in production. As a key stakeholder in the system development/implementation process and business process re-engineering effort of an organization, the IT Control analyst is involved at the requirement gathering, system analysis, design, development, testing, deployment, maintenance, upgrade and termination of all system development or acquisition effort to ensure that management controls are embedded at all stages as safeguards to protect the interest of the organization as well as prevent abuse of the system/process. IT Control analyst also feature prominently during testing (e.g. user acceptance testing, system testing, regression testing, functional test, etc.) of newly built, acquired or upgraded/enhanced systems/solutions with the primarily objective of ensuring that the system or solution met the business requirements of the organization while approved management controls are built as proposed and working as expected. System Control Analyst are also major stakeholders in an organization's change management process as they ensure that changes are controlled to meet business requirements of the organization. They ensure that all system changes are tested in line with the business requirement and objectives for the change while changes are evaluated to ensure that normal running of the system or business is not impaired by reason of the change. Where a change is imminent, IT Control analyst ensures that its impact on the system or business is minimal with room for rollback in the event that something goes wrong.

As a second line of defense role in the risk function, an IT Control analyst (System Control Analyst) ensures segregation of duties in all business system and IT infrastructures with significant impact to an organization in event that they are compromised. To do this, an IT Control analyst ensures the enforcement of maker-checker controls across relevant business systems and operations for greater accountability and to primarily protect the business from possible losses or breaches in the event of abuse by business owners and operators in the first line of defense role (risk owners). This is achieved by preventing the business/risk owners or system operators from successfully concluding certain operations or activities it initiated without second-level approval or authorization (maker-checker control) from the second line of defense function (i.e. IT Control Analyst). Some of the functions performed by IT Control analyst in the bid to serve a "checkers" in the business process are user access management (creation, modification, deletion of access privileges), role/privilege management, transaction limit management, dualized password custodian with the business, joint encryption key component custodian with business owners, etc. These second line of defense functions make the IT Control analyst part of the business and accountable to the business management (i.e. executive management).

Reporting line of a IT Control Analyst

IT Control analyst reports directly to the Head, Internal Control and Compliance of an organization who reports to the executive management.

Professional Certifications for System Control Analyst

To be endorsed as an IT Control analyst or Systems Control analyst, practitioners must acquire certification such as Certified in Risk & Information Systems Control (CRISC) by ISACA, Certified Information Systems Auditor (CISA) by ISACA, Certified Information Systems Security Professional (CISSP) by ISC2, among others.