The dreaded IT audit: How to get through it and what to avoid

Think about all the IT in your office and used by your now remote workforce. It’s essential for insurance and safety purposes to have a comprehensive overview of the IT in your business. Do you know which IT they are using? When a piece of technology is changed or replaced, do you have systems in place to track this, as when audit day arrives, you will need this information.

Many business owners dread audits of any kind, but if you lay the groundwork and have detailed tracking and reporting systems in place, audits will become just another process your company can easily manage and execute.

What’s an IT audit for?

When the word ‘audit’ is uttered, the first thing many business owners think of is whether they have their accounts in order, as audits tend to look closely at the financial health of the business. However, there are several types of audit businesses will need to manage. For example, a security audit is essential, so is a health and safety audit; but your company will also potentially need a license audit to ensure full compliance.

Regular IT audits also help unearth issues such as shadow AI, in which workers use unauthorized AI tools to complete tasks in the enterprise.

Latest Videos From

For IT, the devil is in the details. A PAT (Portable Appliance Testing) audit is often a tick box exercise with most devices passing the test when this was carried out. But the question then remains whether the device is still safe. According to the HSE (Health & Safety Executive):

“The Electricity at Work Regulations 1989 require that any electrical equipment that has the potential to cause injury is maintained in a safe condition. However, the Regulations do not specify what needs to be done, by whom or how frequently (ie they don't make inspection or testing of electrical appliances a legal requirement, nor do they make it a legal requirement to undertake this annually).”

For any IT audit, your business should use its common sense and test the equipment that’s in use. Approach your IT audit as a business asset, rather than thinking of it as a cost center and a drain on time and resources. This is a useful way to ensure your equipment is functioning correctly and is safe to use. Ultimately, an IT audit is a way of preventing any issue in the future that might occur because of faulty equipment. Your IT audit also enables you to have an overview of the equipment in it, which is essential for insurance purposes and when the time comes to replace these devices.

Does my small company need an IT audit?

Startups and microbusinesses may not think they need an IT audit, but taking the time to create the processes that support an IT audit are still a good idea. Many smaller enterprises will rely heavily on cloud services, but devices are still needed to connect to these spaces. Understanding which devices are in use, why, and what applications are installed, is still valuable information to gather and keep up to date.

IT audits can optimize operational efficiency and cost-effectiveness. By evaluating current IT systems and workflows, businesses can identify redundancies, streamline processes, and allocate resources more efficiently. This can lead to cost savings and improved productivity, crucial factors for small businesses with limited budgets and manpower.

Investing in IT audits is a proactive measure that can safeguard small businesses against cyber threats, improve operational efficiency, and ensure compliance with regulations. It's a strategic decision that can ultimately contribute to the long-term success and sustainability of your business.

Do we need regular audits?

Conducting audits should be a routine practice, but the reality is that auditing can mean significant time and expense, typically prompting action only when a compelling business need arises. Therefore, prioritization becomes essential.

While scheduling an annual Health and Safety or PAT audit might seem sensible, if uncertainties surround your software licensing compliance are not clear, it becomes imperative to focus your attention there. Not to diminish the importance of electrical safety, but allegations of software infringement can swiftly escalate making this element of your IT audit imperative to carry out on a regular basis.

Instead of repetitive, standardized audits year after year, sporadic spot checks, customized to address current concerns often yield greater insights. By focusing on specific areas for audit, you maximize the likelihood of uncovering critical information while minimizing expenses and disruptions.

Can I automate my IT audit?

In an ideal world, your business would be able to run an IT audit application and automatically collect all the data that is needed. In reality this comes with risks. It’s also very easy to collect overwhelming quantities of information. In this scenario it is difficult to identify which information is critical to ensure the IT audit is based upon relevant data.

That said, AI is becoming an increasingly important tool within DevOps and AI agents and large language models (LLMs) can make the data aggregation necessary for IT audits far easier.

Automated inventory management tools keep track of hardware and software assets across your network, and can be highly useful for regular audits. These tools can automatically scan your systems, identify devices and installed software, and maintain up-to-date records of your IT assets.

Another approach is to ask your staff to self-report their IT for the audit. This also has its risks, as you are relying upon each member of staff to accurately report the IT they are using. With remote mass working now the norm, a mixture of personal devices and business-issued IT can confuse the data that an IT audit gathers. A hybrid approach that connects automated inventory systems with human data gathering will often give your business the most accurate data for the IT audit.

What are the advantages and risks using an external IT auditor?

There are two basic reasons your business would use an external auditor: The first is to save time and other resources by outsourcing the IT audit to a third party. An outside IT audit may already be part of some or all of your SLA’s (Service Level Agreements), which can ensure that all your IT is compliant to use the services these IT audits are connected to.

The second reason for using an outside auditor is often a strategic business decision. If your business is developing a partnership with another business, the deal may be dependent on a thorough IT audit to ensure all parties are happy that the IT that their systems will connect to is secure.

Handing your business’s IT audit to a third party can also ensure an independent pair of eyes is looking at your systems with no bias, which can reveal trivial issues such as outdated applications that can be remedied easily, to more serious issues such as cybersecurity vulnerabilities.

How detailed does my IT audit need to be?

That’s the sixty-four-million-dollar question. The first thing to think about is what ‘audit’ means for your business. For example, IT asset management (ITAM) looks to set a framework to manage all the IT assets across your business. Some outside auditors will have ITAM certification, if you’re looking to outsource your IT audits. But take a close look at how ITAM is being applied to your business to ensure these reports are now misleading.

The detail you put into your IT audit should be guided by your business needs and any regulatory compliance you must support.

There really is no one size fits all, you have to adapt your IT audit reporting to your particular need. These needs may change over time, so be ready to update how you approach an IT audit in the future. It may seem like an IT audit is a moving target you are never going to hit, but the reality is if you develop a clear picture of what your IT audit needs to report.

Put in place systems to gather the data needed, then write clearly defined reports, and your business will be able to perform IT audits with ease.

What are the practical aspects of performing an IT audit?

How your business performs an IT audit will have a few key components: tools that can automatically collect data about all the devices you need to audit, will be your first port of call.

Dispersed workforces will be the most difficult to track what devices they are using, so remote access applications like TeamViewer, RemotePC and VNC Connect can help here. After that, human data collection will be the next best way to collect the data you need, as humans can make value decisions a machine can’t.

Log files, software installation and update logs are also invaluable if your IT audit needs to ascertain whether devices are running the correct licensed version of applications or are using the current security applications. You'll also be able to see if any unauthorized applications have been downloaded and installed onto a user’s device, which often happens and can be the cause of serious security breaches.

How does auditing work with cloud services?

You may lament the good old days when you could see your staff sitting at their desks. Perhaps the most profound impact the pandemic had was permanently shifting many businesses to mass remote working or embracing hybrid working. The impact for IT audits is to identify the IT these workers are using.

The risks associated with today’s bring your own device (BYOD) policies have largely been mitigated. Today, workers want to use the most convenient devices to complete their tasks, which is often their personal IT.

Tracking these devices is possible. If you find yourself in a position where you must monitor activity on your employees' personal devices, there exists a plethora of mobile device management (MDM) tools and services to consider. While not typically marketed explicitly as auditing tools, these solutions are adept at gathering the relevant information for your IT audit.

When our IT audit is complete, what do we do with the data?

An IT audit gives your business valuable information: What IT and how this is being used, where and by whom is powerful data you can use to make practical changes to workflows, improve efficiency, reduce costs, and increase security. Use the information you gather for staff training and education. Perhaps your IT audit has revealed a weak spot on your network for with remote workers. Your training can use the IT audit to tailor this training.

Perhaps your IT audit has revealed a weak spot on your network for remote workers. Your training can use the IT audit to tailor this training.

Whether the audit has been understood or not, there's an instinct in many companies to treat the findings as if they were valuable business secrets, and to keep them as far as possible from the eyes of the public and the workforce. However, it's far better to share findings with your staff, and canvass their experiences and opinions for exactly the same reasons that you carried out the audit in the first place.

In short, even in the most hierarchical businesses, the only sensible conclusion to an audit process is an open discussion of what has been found and what ought to be done. There's a good chance your audit will have turned up something unexpected, so be open-minded in your response.

Whether it's uncovering software licensing discrepancies or addressing hardware vulnerabilities, an IT audit empowers organizations to make informed decisions, improve efficiency, and maintain a competitive edge in an increasingly digital landscape. Ultimately, investing in IT audits is not just practical but essential for the long-term success and sustainability of any business.