An IT audit is rarely commissioned out of curiosity. It comes after an incident, before a change of provider, or because a third party — insurer, client, bank — has asked to see something.
In all three cases the client is in no position to assess the work he is buying: it is precisely because he does not know that he is commissioning it. The only thing he can assess before signing is the situation of whoever will write it.
What an IT audit covers
The standard scope comes in three blocks, and the third is the one nobody remembers to ask for.
- The existing estate. Hardware, network, backups, access, security, support levels and end-of-life dates.
- Contractual commitments. What the live contracts say: the real scope of maintenance, the committed response times, exit conditions, ownership of bespoke work.
- The organisation. Who decides, who executes, who is told. A properly equipped system with no designated contact falls over just as surely as an obsolete one.
The second block is the most profitable and the least requested. A smaller business regularly discovers, on this occasion, that its maintenance does not cover what it believed, or that leaving its contract requires a service never priced.
The question of conflict of interest
It is not a question of honesty. It is a question of structure: an auditor who also sells the solution sees first the problems he knows how to solve, and misjudges those he would not know how to handle.
Three questions place a provider before you entrust an audit to him:
- Do you resell hardware or licences, and at what margin?
- Are you paid by a software vendor or a manufacturer under a partnership?
- If the audit concludes that nothing should change, what are you paid?
No answer is disqualifying in itself. An evasive one is.
You do not ask an auditor to be disinterested. You ask him to say what he lives on.
The four stages of an audit that is any use
- Frame. What is examined, what is not, and which decision the report is meant to serve.
- Record. From documents and from interviews. The interview reveals what tools cannot see: the workarounds, the dependencies on one person, the abandoned uses.
- Rank. By consequence and by likelihood, not by technical area.
- Decide. The report proposes; the director arbitrates. An audit that does not end in a written decision has not produced its effect.
One-off or recurring
A one-off audit answers “where do we stand”. It is justified at a moment of decision: renewal, incident, change of scale, sale.
A recurring engagement answers “are we keeping up”. It is justified only if the company genuinely has things to decide on a regular basis — otherwise it produces reports that resemble one another and that nobody reads any more.
The mistake is to subscribe to permanent monitoring in order to avoid deciding once. Recurrence does not replace the decision, it defers it at regular intervals.
What ought to be on the first page
Three lines, before any table: what must be handled this quarter, what is scheduled within the year, what the company chooses to carry as it stands. The third line is the most important — it is the one that turns a list of risks into a decision.
What remains is knowing which of the two exercises you are buying, since they go by the same name: a technical audit and a decision audit do not address the same reader.
A report without that third line assumes everything must be fixed. No company works that way, and the document ends up in a shared folder.
Common questions
How do you choose an IT audit provider?
By assessing their position rather than their method: do they resell hardware or licences, are they paid by a vendor, and what do they earn if the audit concludes nothing needs changing? No answer is disqualifying in itself; an evasive one is.
What does an IT audit for a small business cover?
Three blocks: the technical estate (equipment, network, backups, access, security, end-of-support dates), contractual commitments (maintenance scope, response times, exit terms) and the organisation (who decides, who executes, who is informed). The second is the most valuable.
How does an IT audit run?
In four steps: scope what is examined and which decision the report must serve; gather evidence from documents and interviews; rank by consequence and likelihood; decide, through a written decision by the managing director.