IT audit: what it covers and when your business needs one

Your systems have grown one tool at a time: a spreadsheet here, a subscription there, an old application nobody dares to touch. Before you invest in something new, you want to know what you actually have. That is the job of an IT audit.

But the term covers very different things. Some audits look at servers and networks, others at security, others at your applications and the way work flows through them. This guide explains what an IT audit can cover, which kind of auditor does which part, the signs it is time for one, how it runs, and what the final report must contain to be useful.

What an IT audit covers

An IT audit is an outside look at your information system: what it is made of, how well it serves your business, and what should change. In practice, “information system” spans several layers, and an audit rarely covers all of them in the same depth.

Applications, processes and data

This is the layer closest to your daily work. Here the audit looks at:

• Processes: how an order, a file or a request really moves through the business, including the steps done by hand or by email;
• Tools: the software you use, from off-the-shelf subscriptions to in-house applications, and how well each one fits;
• Data and integrations: where your data lives, how often it is re-keyed, and how your tools exchange information, or fail to;
• Constraints: budget, deadlines, the rules that apply to your sector, the skills of your team.

When an older application is involved, the audit also reads its code: every business rule, even those hidden in it, is identified and documented.

Infrastructure and security

The second layer is technical: servers, networks, workstations, backups, cloud services and access rights. Typical questions: are backups ever tested? Who has administrator access? Which systems are no longer supported by their vendor?

A deeper security assessment, such as a penetration test, where specialists try to break in the way an attacker would, is a job in its own right.

What an IT audit is not

The same word is used for audits with a formal role. The kind of IT audit described here is not:

• a statutory or financial audit, where auditors review your IT general controls as part of checking your accounts;
• a certification audit, such as the one required for an ISO standard;
• a legal or regulatory compliance opinion.

If a regulator, a bank or a customer asks you for an audit, ask them which kind they mean, and check with your accountant or legal adviser.

Who does which part

No single provider is the right one for every layer. This is how the work is usually split:

Part of the audit	What it looks at	Usually carried out by
Application and process audit	Processes, tools, data, integrations, code	Software and consulting firms
Infrastructure review	Servers, network, workstations, backups, licences	IT support and managed service providers
Security audit, penetration test	Vulnerabilities, access, resistance to attacks	Specialist security firms
Financial or certification audit	Controls required by law or by a standard	Accredited auditors

Our audit covers the first line: we analyse your processes, tools, data and constraints. When a question belongs to the infrastructure or security side, we say so and recommend that a specialist reviews it. If you are comparing providers, our guide on how to choose an IT provider lists the questions to ask.

Signs your business needs an IT assessment

An IT assessment is most useful before a big decision, or when daily friction becomes a pattern. The usual signals:

1. The same data is typed several times into different tools or spreadsheets.
2. A key application is ageing: its developer has left, and every change takes longer and feels riskier. This is often technical debt building up.
3. You are about to buy or build something big: an ERP (enterprise resource planning), a CRM (customer relationship management) or custom software. An audit tells you what must connect to it and what can be retired.
4. Nobody has the full picture: the knowledge sits with one or two people, and there is no up-to-date map of your tools.
5. The business has changed: growth, a new site, a merger, new regulations.
6. Costs are hard to explain: overlapping subscriptions, licences nobody uses.

When is it not worth it? If you have a handful of tools that work well together and no project in sight, a full audit would tell you little. A short conversation is enough to confirm that.

How an IT audit runs

A technology audit for a small business follows the same steps as a larger one, with fewer people to meet. This is how ours runs.

1. A discovery call

Everything starts with a free 30-minute discovery call. We listen to your situation and your goals, and tell you frankly whether an audit would help. If it would, we propose one at the end of the call, on the basis of a quote that sets its scope.

2. Interviews and observation

We meet the people who do the work, not only the managers: the way a task is really done often differs from the way it is described. We look at the tools in use, on real examples.

3. Analysis of tools, data and code

We map your applications and the data they exchange, check the quality of that data and, when an in-house application is involved, read the code to bring out the business rules it contains. This is also how our modernisation projects begin.

4. Report and presentation

We present the findings, discuss the options with you and leave you a written report. Then the decision is yours: act on it with us, with another provider, or not at all.

Checklist: what a good IT audit report must contain

A report is only useful if you can act on it. Before you accept one, check that it includes:

• Scope and method: what was audited, what was not, and who was interviewed.
• A map of your information system: applications, data flows, integrations, and who uses what.
• Findings backed by evidence: what was observed, where, and why it matters to the business.
• A clear line between facts and opinions.
• Risks ranked by impact, described in business terms, not only technical ones.
• Options, not a single answer: keep, improve, replace with an off-the-shelf tool, or build, with the trade-offs of each.
• Priorities and a sequence: what to do first, and what depends on what.
• A costed proposal for the recommended work, if you asked for one. Our article on the cost of custom software explains what drives that figure.
• Points outside the scope, such as infrastructure or security, flagged for a specialist.
• Plain language: a manager who missed the interviews can follow the summary.

Be wary of a report that ends with “rebuild everything” without showing other options, or one that lists technical problems with no link to your business.

Frequently asked questions

What is the difference between an IT audit and an IT health check?

The terms overlap. “IT health check” usually means a quicker review of the infrastructure: servers, backups, updates, licences. An IT audit can go further and examine your processes, applications and data. Whatever the name, ask for the scope in writing: which layers are covered, which are not, and what the report will contain.

Is an IT audit worth it for a small business?

Often, when a significant decision is coming: choosing software, replacing an old application, reorganising a team. The audit helps you avoid committing to the wrong tool. But it is not always needed. If your tools work, your data is in one place and no project is planned, a discovery call may be enough to confirm it.

Does an IT audit include a security test?

Not necessarily. An application audit may point out weaknesses it comes across, such as shared passwords or overly broad access rights, but it does not test your systems the way an attacker would. A penetration test is a specialist’s job, ordered separately, with rules agreed in advance.

In short

An IT audit can cover applications, processes, data, infrastructure and security, and different specialists handle different parts. Ours focuses on your processes, tools, data and constraints, and flags what needs a specialist. Commission one before a major decision or when friction becomes a pattern, and judge it by its report: evidence, options, priorities and plain language.

Wondering whether your tools still fit the way your business works? Book a free 30-minute discovery call: we look at your situation together and, if an audit would help, we propose one at the end of the call, on the basis of a quote.