What an IT audit covers — infrastructure, security, cost and risk, in plain terms
An IT audit tells a company what it is actually running, what could fail, what it is overpaying for and what an attacker would find first. What the audit includes, how long it takes, and what the report looks like when it is useful.
Most companies cannot answer four questions about their IT with confidence: what exactly are we running, what happens if this server or this person disappears, what are we paying for that we do not use, and how would someone get in. An IT audit answers them with evidence — not a questionnaire, but an inspection of the systems, the configurations, the contracts and the practices — and turns the answers into a prioritised plan.
What the audit includes
- Inventory — servers, cloud accounts, domains, licences, SaaS subscriptions, devices, integrations, and who owns each.
- Infrastructure and operations — hosting, backups (and whether they restore), monitoring, patching, single points of failure, documentation.
- Security — access and identity, exposed services, configuration weaknesses, email security, the basics that cause most incidents.
- Applications — the websites, shops and internal systems: versions, support status, technical debt, dependency on individuals.
- Cost — what is paid monthly and yearly, what is unused or oversized, what could be consolidated.
- Risk register and plan — findings ranked by likelihood and impact, each with a recommended action, effort and owner.
How it runs
Two to four weeks: a kick-off, access and interviews, inspection, a draft reviewed with your team, a final report and a presentation to management. The report is written for the people who decide, with the technical detail in appendices for the people who implement.
What to prepare
- A contact for each system and supplier.
- Access (read-only is enough) to servers, cloud consoles and admin panels.
- Contracts and invoices for IT services.
- Known incidents and current worries.
Details on the IT audit page.