Why do IT audit and financial audit teams struggle to work together?

Because the interface requires translation: IT auditors test general IT controls and report results; financial auditors must interpret what those results mean for control reliance and the financial statements. Each translation takes scoping rounds, meetings, and judgment calls between teams with different expertise — and research documents that the two groups often operate as two teams rather than one.

Why does an ITGC deficiency matter to the financial audit?

Under PCAOB AS 2201, the risk associated with an automated control depends on the effectiveness of general IT controls. An ITGC failure can undermine automated application controls and the reliability of system-generated reports — so its financial-statement impact must be worked out, control by control, at the interface between the two teams.

Is this interface friction measured anywhere?

Not systematically — which is the gap. The AuditEx Program samples this interface deliberately in its research design, measuring the experience of the handoff from both sides while never grading either team’s work.

← Resources

The IT audit ↔ financial audit interface

In integrated ICFR and SOX 404 work, one team tests and another concludes: IT auditors test general IT controls and report results; financial auditors must interpret what those results mean for control reliance and the financial statements. The translation layer between them — scoping rounds, deficiency triage, meetings where each side interprets the other — is one of the most consequential and least measured frictions in audit work.

Last updated July 24, 2026

Why the translation is structural

The duty sits in the standard itself: under PCAOB AS 2201, the risk associated with an automated control depends on the effectiveness of general IT controls — so every ITGC result must be carried across the interface and turned into an answer about reliance, scope, and the financial statements. Company-produced data and reports are a documented deficiency engine of their own: the PCAOB's April 2024 Spotlight found roughly 17% of all inspection comment forms in each of 2021 and 2022 involved insufficient testing of the accuracy and completeness of such information.

Two teams, not one

The friction is a studied phenomenon. Field research finds financial auditors and IT specialists frequently operate as two teams rather than one, and that the quality of the relationship shapes how specialist findings are integrated (Bauer, Estep & Malsch 2019; Estep 2021). Experimental work shows planning judgments weaken when the receiving side lacks the sender's systems expertise (Brazel & Agoglia 2007), and audit partners name the hardest ICFR judgments — management review controls, company-produced information, deficiency severity — at exactly this seam (Cohen, Joe, Thibodeau & Trompeter 2020).

Unmeasured — and unserved

No commercial tool category maps an ITGC deficiency to its financial-statement consequences or manages the triage between the two teams, and the experienced friction of the handoff — rounds, latency, rework — has never been measured at field grain. That measurement is part of the research design of the AuditEx Program, which samples this interface deliberately, from both sides, while never grading either team's work.

IT auditors test ITGCs; financial auditors must translate results into reliance and scope decisions.
The translation duty is structural (PCAOB AS 2201): automated-control risk depends on ITGC effectiveness.
~17% of PCAOB inspection comment forms (2021 and 2022) involved company-produced data and reports.
Peer-reviewed research documents the two-teams problem; the handoff's friction remains unmeasured.

FAQ

Why do IT audit and financial audit teams struggle to work together?: Because the interface requires translation: IT auditors test general IT controls and report results; financial auditors must interpret what those results mean for control reliance and the financial statements. Each translation takes scoping rounds, meetings, and judgment calls between teams with different expertise — and research documents that the two groups often operate as two teams rather than one.
Why does an ITGC deficiency matter to the financial audit?: Under PCAOB AS 2201, the risk associated with an automated control depends on the effectiveness of general IT controls. An ITGC failure can undermine automated application controls and the reliability of system-generated reports — so its financial-statement impact must be worked out, control by control, at the interface between the two teams.
Is this interface friction measured anywhere?: Not systematically — which is the gap. The AuditEx Program samples this interface deliberately in its research design, measuring the experience of the handoff from both sides while never grading either team’s work.