IT general controls: the foundation every application control stands on
IT general controls decide whether you can rely on anything a system tells you. Weak ITGC does not fail on its own — it invalidates the controls above it.
An OLA is what each internal team owes the one facing the customer. Without it, an SLA is a promise made on behalf of people who never agreed to it.
An operational level agreement is an internal agreement between the teams inside one organisation that together deliver a service: what each will do, how quickly, during which hours, and what happens when they cannot. It has no customer in it. Its entire purpose is to make the commitments in the customer-facing service level agreement achievable.
The arithmetic is what makes the concept worth taking seriously. If support promises a four-hour resolution, and the change that fixes the problem has to pass an approval board that meets on Tuesdays, the SLA is not a target — it is a fiction that will be missed, reliably, in a way nobody in support can prevent.
Priority definitions are the item most often skipped and most often the cause of failure. Where support calls something a P1 and infrastructure treats it as a normal request, the two teams are not disagreeing about urgency — they are using different scales, and no amount of escalation fixes a definition mismatch.
The most common gap is a supplier whose contracted response is slower than the promise you made to your own customer. That is not an operational problem to be managed with effort — it is a commercial mismatch, and it has to be fixed in one of the two contracts.
OLAs go stale faster than SLAs because reorganisations change who owns what without anyone reopening the document. Tie the review to structural change rather than to the calendar: a new team, a moved responsibility, a changed supplier, a new product with different hours all invalidate parts of it.
And measure both sides. An OLA where only the customer-facing team is reported on becomes a stick rather than an agreement, and the teams behind it stop treating the numbers as theirs.
Because an OLA is an agreement between teams rather than a policy handed down, it needs to name responsibilities the way the organisation is actually structured. Ettex Teams holds the team structure and its responsibilities, so the agreement references roles that exist rather than a chart from two reorganisations ago. Whether the promised times are achievable is a management judgement — the document only makes the promise explicit enough to test.
An SLA is between a provider and its customer. An OLA is between internal teams within the provider. The OLA exists to make the SLA deliverable, and its targets must be tighter than the SLA it supports.
Not as formal documents, usually. But the underlying question — can the team that answers the customer actually get what it needs from the team behind it, in the time promised — applies at any size.
A contract with an external supplier whose performance your own service depends on. Its terms have to be at least as strong as the commitments you make downstream.
The service owner, with each internal team accountable for its own section. Ownership by the customer-facing team alone tends to produce a document the other teams never agreed to.
IT general controls decide whether you can rely on anything a system tells you. Weak ITGC does not fail on its own — it invalidates the controls above it.
Segregation of duties splits a transaction so that committing fraud or hiding an error requires collusion. Most breaches of it are accidental, and invisible until tested.
A remote joiner misses everything that is normally absorbed rather than taught — who to ask, how things really work, whether their pace is right. All of it has to become explicit or the first month is guesswork.