The Process of an IT Audit

Technology plays a key role in the success of a business, so it’s no coincidence that the most successful companies have an IT infrastructure and support system that meets their day-to-day needs and is aligned with their long-term goals. In addition, businesses leverage IT audits to determine the health of their current technology and develop a strategic plan for future IT investment. An audit is a comprehensive review of your company’s computer network. An IT audit should highlight major and minor risks within your IT environment, outline a strategic IT budget and assess your readiness to outsource IT. Typically, an IT audit has three steps—an executive interview, technical discovery and analysis, and an audit findings presentation.

The Executive Interview

To correctly identify the risks to your company, we must first understand your business. We’ll meet with your company’s C-suite to discuss any challenges the business has faced, as well as any goals the leadership team has set forth. We’ll ask questions about your business’s applications, staffing and off-boarding processes, and remote work capabilities. We’ll also ask for details of any ongoing problems within the business that technology may solve. The executive interview will help our team understand your company’s business model and key processes, budget requirements, and time constraints.

The Technical Discovery and Analysis

After we’ve understood your business, we’ll begin the technical discovery and analysis phase of the IT audit process. This consists of on-site visits from a technician who will take inventory of your company’s IT infrastructure, run security scans and examine the applications installed in your environment. To complete this portion of the audit, we’ll need physical and virtual administrative access to your company’s servers to run information-gathering tools within your network.  The raw data collected during the technical discovery is compiled, examined, and analyzed by a virtual chief information officer, or vCIO. This data and the information gathered during the executive interview are used to prepare the audit findings presentation.

The Audit Findings Presentation

The data collected during the technical discovery and analysis phase of the IT audit process typically generates several hundred-page reports. The report is reviewed by a vCIO and is condensed into a summary that details your business’s IT environment at a glance. The audit findings presentation should outline the following: 

• Your company’s IT architecture—includes an overview of your hardware such as workstations, backup devices, firewalls, and servers and identifies any potential risks.
• The applications used in your environment—include a look at your software such as Microsoft Office, CRM tools, and file-sharing programs and identifying potential risks.
• Project recommendations are designed to mitigate risks in security, business continuity, and your network.

The audit findings presentation should also include an assessment of your technology vendor relationships, as well as a complete IT budget and a 12 to 24-month IT roadmap for future IT investment. This roadmap should include a list of immediate risks and compliance gaps to be remedied, as well as recommendations regarding your company’s IT support structure.