There are typically a few such controls within major applications in each financial process, such as accounts payable, payroll, general ledger, etc. The focus is on "key" controls (those that specifically address risks), not on the entire application. IT general controls that support the assertions that programs function as intended and that key financial reports are reliable, primarily change control and security controls; IT operations controls, which ensure that problems with processing are identified and corrected.