Socio-technical theory highlights the interaction between individuals and technology (Geels, 2004). Using this theory overlayed with recent standards from the auditing profession (ISA 315 (revised)) that focus heavily on controls over technology, this paper draws on insights from two case-study organisations, one in Australia and the other in the UK. It examines the controls that are employed over systems and new technology and how humans control technology, technology controls technology and technology controls humans. Our findings show that there may be a bottom-up approach to controls where a dominant IT department maintains a tight reign over technology, and controls focus on technological system controls. By contrast, a top-down approach may be apparent whereby senior executives set policy and guidance for the whole organisation and the structure and controls are more flexible resulting in more human controls. Further, the more dominant and advanced the systems, the more autocratic and rigid the structure. From an ethical standpoint, there is a heavy reliance on trust- but trust may be at the individual level or group level with implications for socio-technical control systems. Finally, the results suggest that cyber-security is more important in highly connected organisations.