IT AuditChecklist, Process, and Independent IT Audit Services for Regulated Businesses

What Is an IT Audit?

An IT audit, also called an information technology audit or an IT infrastructure audit, is a structured review of how a business's technology is configured, operated, and governed, performed by someone who did not build it. The auditor defines a scope, selects the criteria the environment will be measured against, collects evidence, tests whether controls are designed correctly and operating as designed, and reports findings ranked by risk. The criteria can be a regulatory framework such as NIST SP 800-171 or the HIPAA Security Rule, a control framework such as COBIT or the CIS Critical Security Controls, or the business's own written policies.

The word "audit" is used loosely in IT, and it helps to be precise. In the accounting profession, an IT audit often means an IT general controls review performed by a CPA firm in support of a financial statement audit or a SOX Section 404 attestation. For most small and mid-sized businesses, the question is different and more practical: is our environment sound, is it documented, would it survive a failure or an attack, and would it satisfy the assessor or insurer who is going to ask? That is the kind of IT audit this page describes, and it is the kind Petronella Technology Group performs.

We have run IT environments for businesses in the Research Triangle since 2002, which means our auditors have also been the engineers who inherit an environment after someone else's audit. That experience shapes the method. We look for the things that fail in real incidents and real assessments: backups nobody has restored, administrator accounts nobody owns, firewall rules nobody can explain, and policies that describe a company that no longer exists.

Types of IT Audits and the Question Each One Answers

Before any evidence is collected, the business and the auditor should agree which of these audits is being performed. Most engagements combine two, and saying so in the scope statement prevents the most common complaint about audit reports: that they answered a question nobody asked.

If the question is specifically about cyber risk, including threat exposure, attack paths, and security posture scoring, our cybersecurity audit and risk assessment is the better starting point. If a customer or contract requires a SOC 2 report, the audit on this page prepares you for it, and the SOC 2 compliance page explains how the readiness work hands off to the CPA firm that issues the report.

The IT Audit Checklist: Ten Domains and What to Examine in Each

This is the working checklist our auditors carry into an engagement. Each item is phrased as a test, and each test names the evidence that answers it. Use it to run a self-audit, to scope a formal one, or to check whether a report you already received actually looked at these things.

Two domains produce the most findings in the environments we review. Asset inventory fails quietly: an inventory that is ninety percent complete feels finished, but the missing ten percent is usually the unmanaged laptop, the forgotten cloud storage account, or the old server under a desk, and those are where incidents start. Our IT asset management page describes how to keep the inventory reconciled continuously. Identity and access fails through accumulation: people change roles, contractors finish projects, and permissions are added but never removed. A quarterly user access review and a disciplined employee offboarding checklist close most of those findings before an auditor sees them.

How to Conduct an IT Audit in Eight Steps

These are the steps Petronella Technology Group follows. They are the same whether the audit covers a twenty-person professional services firm or a multi-site manufacturer; what changes is the sample size and the number of systems in scope.

Step 1 is where most audits go wrong. A vague scope such as "review our IT" produces a vague report. A useful scope names the systems (the Microsoft 365 tenant, the two office networks, the ERP server, the three SaaS applications that hold customer data), the period (for operating-effectiveness testing, usually the last three to twelve months), and the decision the report will inform (renewing a cyber insurance policy, preparing for a CMMC Level 2 assessment, deciding whether to keep the current IT provider).

Step 5 is what separates an audit from an assessment. Design testing asks whether the control, as written, would address the risk. Operating effectiveness testing asks whether it ran. A policy requiring quarterly access reviews is well designed; if the auditor asks for the last four quarters of review sign-offs and receives one, the control is not operating. We sample across the review period rather than accepting the most recent example, because the most recent example is often the one prepared for the audit.

Step 8 is the one that justifies the cost. A findings report that sits in a shared drive changes nothing. Our remediation plans rank findings so the first month addresses the risks most likely to cause an outage or a breach, the next quarter addresses the findings an assessor would cite, and the remainder are scheduled into normal operations. Each finding is re-tested with new evidence before it is closed, and the closure evidence is kept for the next audit.

How IT Audit Findings Are Rated and Prioritized

A report with sixty findings and no ranking is a to-do list nobody finishes. We rate every finding on two axes, likelihood that the gap is exploited or causes a failure, and impact on the business if it does, and we state the rating logic in the report so leadership can challenge it.

The targets above are the defaults we propose, not rules; your framework or insurer may set shorter windows for specific findings, and some remediation depends on budget or vendor lead times. What matters is that every finding has a target that someone agreed to, and that the plan distinguishes the three things that must happen this week from the thirty that can wait for the next quarterly review with your virtual CIO.

Which Frameworks Require a Periodic IT Audit

Few regulations use the phrase "IT audit," but most require an organization to evaluate whether its controls are effective on a recurring basis. An IT audit is the most direct way to produce that evidence.

For regulated clients, we map every audit finding to the specific control it affects inside ComplianceArmor®, our compliance documentation platform, so the remediation plan becomes the plan of action and milestones an assessor expects to see. Craig Petronella lays out the defense contractor side of this in his book CMMC 2.0 Certification Guide, including how self-assessment evidence feeds the SPRS score.

What Changes After a Well-Run IT Audit

The value of an audit shows up in how the business answers questions it could not answer before. These are the shifts we see most often once findings are remediated and the controls are running.

Six Reasons IT Audits Fail to Improve Anything

We are often brought in after a previous audit, and the same patterns explain why the earlier report did not change the environment.

How Petronella Technology Group Performs IT Audits

Our IT audits are performed by engineers who run production environments every day, supported by the same compliance team that prepares clients for CMMC, HIPAA, and SOC 2 assessments. That combination matters: the findings are ones an operator would recognize, and the remediation steps are ones an operator can actually carry out.

Many audits start because a business is deciding whether its current IT arrangement is working. If the answer is to change, the audit becomes the transition plan: the IT documentation it produces is the handover package, the change and patch findings shape how the new provider operates, and the IT change management and patch management disciplines described on those pages are what keep the environment from drifting back. For businesses in the Triangle that want us to run the environment after the audit, the managed IT services Raleigh page describes that service; for businesses with internal IT staff, co-managed IT keeps your team in charge while we supply the process and tooling.

Self-Audit vs. Provider Self-Review vs. an Independent IT Audit

All three have a place. A self-audit with the checklist above is a good first step; the table shows what each option can and cannot tell you.

IT Audit: Frequently Asked Questions

Related Managed IT and Compliance Pages

Last Updated: September 12, 2026 (first published September 12, 2026). This page references NIST SP 800-171 Rev. 2 controls 3.12.1 and 3.12.2, CMMC 2.0 Level 2 practice CA.L2-3.12.1, the HIPAA Security Rule at 45 CFR 164.308(a)(1)(ii)(A), 164.308(a)(8), and 164.312(b), SOC 2 Trust Services Criteria CC4.1 and CC8.1, PCI DSS v4.0 requirements 11.3, 12.4, and 12.5.2, the FTC Safeguards Rule at 16 CFR 314.4(d), ISO/IEC 27001:2022 clause 9.2, and NIST CSF 2.0. Confirm current requirement text with the issuing body before relying on it for an assessment.