Which IT controls should be tested at the project level in construction audits?

• A. Access rights, segregation of duties, change management for project systems, and user access reviews
• B. Only password policies
• C. IT controls are not tested
• D. Only physical security measures

Answer: (C)

Testing IT controls at the project level is essential because the systems used in a construction project—such as project management software, ERP, BIM platforms, and scheduling tools—touch critical data on costs, timelines, procurement, and design. Without evaluating these controls, risks like unauthorized access, inappropriate changes, or untracked updates can go unnoticed and undermine project outcomes.

A solid project-level IT control review looks at who can access project systems and what they can do (access rights and segregation of duties), how changes to project systems are requested, approved, tested, and deployed (change management), and whether there are periodic reviews of user access to ensure permissions stay appropriate. Password policies and physical security are important components of the overall security environment, but focusing only on them misses broader controls that prevent errors and fraud, such as proper change processes and ongoing access governance.

Therefore, IT controls should be tested at the project level to provide assurance on data integrity, security, and governance; claiming that IT controls are not tested would leave significant risk unaddressed.