Resource
What an IT Audit Covers, and How It Becomes a Plan
An IT audit is a documented review of what technology your business has, what condition it's in, and where the gaps are, based on what's actually running rather than what anyone assumes. An IT strategic plan is what you do with those findings: a ranked list of what to fix first, what it will cost, and when it happens.
Most owners hear "IT audit" and picture a binder nobody opens again. Done properly, it's one of the most practical documents a business can have. It answers the questions a lender, an insurance carrier, a client's security questionnaire, or a buyer will eventually ask, before they ask.
Dawn Sizer · CEO and Co-Founder, 3rd Element Consulting · What a real IT audit reviews
- Hardware and software inventory. Every laptop, server, firewall, and application, checked against what the business believes it has.
- Accounts and access. Who can reach which systems, and whether that list still matches who works there.
- Multi-factor authentication. Which accounts are protected and which aren't, including admin and vendor accounts.
- Backup and recovery. Whether backups run, and whether anyone has ever restored from them.
- Security controls. Patching, endpoint protection, email security, and admin rights, measured against a written baseline.
- Monitoring and history. Whether network devices, endpoints, Microsoft 365 sign-ins, email DNS records, backups, Wi-Fi, and internet speed are actually watched, and whether enough history is kept to see when a problem started.
- Microsoft 365 configuration. Licensing, sharing settings, conditional access, and mailbox security.
- AI tools. Which AI tools are in use, including features built into existing software, and whether a written AI acceptable use policy covers them.
- Vendors and contracts. Who supports what, what's in the contracts, and what's up for renewal.
- Lifecycle. What's aging out, what's out of warranty, and what's no longer getting security updates.
- Documentation and policy. Whether written policies exist, and whether day-to-day practice matches them.
What we usually find
In the environments we review, the same findings come up again and again:
- A few accounts are missing MFA, often admin, service, or shared accounts that were set up before MFA was required.
- Some devices are missing security protection, or it's installed but not reporting in.
- Patching is missing on a few devices, usually the ones that are rarely rebooted or sit off the network for long stretches.
- Former employees still have active accounts.
- Backups run every night but have never been restored.
- Devices are on the network that nobody can identify.
- Staff have admin rights they don't need.
- Business data is sitting in cloud apps nobody approved.
None of these are exotic. They're what happens when nobody is assigned to check.
From audit to strategic plan
An audit on its own is a list of problems. A strategic plan ranks them by two things: how likely each gap is to cause a real problem, and how costly or disruptive it would be if it did. That keeps attention on what matters instead of what's cheapest or most visible.
A good plan also fits the business's actual timeline. A practice with a compliance deadline next quarter and a company preparing for a lender conversation next year may have similar findings, but they fix them in a different order. The plan turns into a roadmap and a budget, so IT spending follows a plan instead of the last emergency. Keeping that plan current is the work of our vCIO services.
When businesses usually need one
- Before a conversation with a lender, investor, or buyer
- Ahead of a cyber insurance renewal or a client security questionnaire
- When leadership changes, or after an acquisition
- Before switching IT providers, so you know what you're handing over
- When the same problems keep coming back and nobody can explain why
Keep it current
An audit done once goes stale quickly. New employees, new software, and new vendors change the picture every month. The businesses that get the most from this keep the inventory and documentation current, so they never have to rebuild it from scratch when someone asks.
Monitoring is more than having tools
Monitoring tools report what they were built to report, and the gaps between them are where problems hide. We monitor every layer of the environments we manage, from network devices and endpoints to Microsoft 365 sign-ins, email DNS records, backups, Wi-Fi health, and internet speed, and keep 90 days of history across all of it. Many problems, like a slow internet connection, get caught before anyone has to report them. When something does go wrong, we can show you when it started and why. We don't guess. We look it up.
The checklist
Download the IT Audit Readiness Checklist
A free checklist covering everything above, so you can see what you can document today and what you can't.
Common questions
Questions leadership usually asks first.
Continue reading
Related work and reading.
vCIO Services
Turning audit findings into a roadmap and a budget, and keeping both current.
Read more: vCIO ServicesHow to Switch IT Providers Without Creating Chaos
Know what you're handing over before a transition starts.
Read more: How to Switch IT Providers Without Creating ChaosIT Provider Vetting Checklist
The questions to ask before you sign with a managed IT provider.
Read more: IT Provider Vetting ChecklistCIS Controls vs NIST CSF
The foundational controls an audit measures against.
Read more: CIS Controls vs NIST CSFNext step
Not sure what your audit would turn up?
Schedule an IT Environment Review.