The IT Audit Checklist: What To Include and How to Create and Use It

It's one thing if an individual IT person forgets to audit their own technology systems. For example, maintaining their computer or cellphone, updating software, managing storage, updating passwords, and scanning for computer viruses and malware. However, it's an entirely different thing and a much more costly thing if your company fails to perform routine IT audits.

IT audits are the backbone of an efficient and secure information technology system. They help the overall IT system function at its highest capacity. An IT audit checklist, then, is the tool that helps you accomplish the audit itself.

Today, we will discuss IT audits and audit checklists. We'll explain what they are, what to include in a checklist, how to perform an IT audit, and why IT audits are essential. Then, at the end, we'll provide a downloadable PDF checklist to help you and your business be the best it can be.

What is an IT Audit?

An IT audit is a health checkup for your information technology systems or controls. With IT audits, you can ensure that your system is running efficiently and securely. Similarly, you can identify gaps in your system whereby you may be at risk of cyberattack.

IT audits will look different for every company. However, there are usually primary objectives or goals that a good IT audit should accomplish.

• Verification that IT controls are being practiced among personnel
• Evaluate IT systems for efficiency and eliminate inefficiencies
• Identify risks to the system's information assets
• Identify methods to mitigate such risks
• Verify that IT systems are in compliance with specific policies, laws, and standards (this will depend on the industry)

What is an IT Audit Checklist?

An IT audit checklist is the road map, or list of items for how, when, and why to perform IT audits. With a well-designed IT audit checklist, you can systematically review your IT system controls to ensure everything functions correctly and perform a comprehensive risk assessment.

IT audit checklists are also helpful tools for new employees. You can incorporate an IT audit checklist into the onboarding process so that new employees understand what data is necessary to protect and help identify potential risks to cybersecurity. Likewise, employees can use checklists to prepare for audits.

5 Common Types of IT Audits

Not all IT audits are created equally. They are designed to accomplish different objectives, like bolstering efficiency, improving security, or reviewing for compliance. Let's take a look at five unique types of IT audits:

1. Application Audit

   An application audit focuses on figuring out if an organization's systems and applications are efficient and secure, being used appropriately, and compliant with any regulations. In most cases, application audits look directly at the systems that handle a company's data.

   For example, healthcare providers must ensure that all their applications are HIPAA-compliant. Giva offers a range of products that meet the needs of healthcare institutions that require high security and compliance, like Giva HIPAA-compliant cloud help desk software.

2. Facility Audit

   Facility audits are all about assessing the physical security and environmental controls of an organization's IT facilities. Examples of IT facilities include an off-campus data center or an on-site server room. During a facility IT audit, an auditor will examine if the facility is adequately secure and well-maintained for sustainable business continuity.

3. System Development Audit 

   System development audits ensure that IT systems that are under development will meet the organization's standards. Similarly an audit of this type helps ensure that existing systems are also maintained and efficient.

4. Management Audit

   A management audit examines the capacity of the IT management personnel to adequately support their organization. In particular, an IT management audit will verify if the IT department and personnel are aligned with the organization's strategies and business operations.

5. Network Audit

   A network audit examines the network infrastructure, including intranets and extranets. An audit of these two types of networks checks for functionality, reliability, and security. An intranet is a private or in-house network that allows employees to share information, collaborate, and communicate. An extranet allows authorized users from outside the organization to gain access to an organization's internal resources.

5 Critical Items to Include in an IT Audit Checklist

Every IT audit checklist is different from the next. That's because each checklist should be customized to fit your needs. For example, an audit will vary based on your industry, the IT department you're auditing, whether the auditor is in-house or third-party, and the overarching objective of the audit.

With that being said, we want to provide five checklist categories to help you better understand what can be (and probably should be) included on an IT audit checklist:

1. System Security

   Antivirus Software

   Antivirus software should be installed and active on all necessary devices. It should be updated regularly, especially after incidents occur.

   Network Firewall

   Firewalls should be installed, active, and updated on a routine basis. The firewalls should include intrusion detection and prevention systems.

   Hardware

   Devices should meet all minimum security requirements, like password-protected screen locks. All hardware should be properly inventoried, maintained, and tracked.

   Passwords

   Passwords must be encrypted and require alphabetic, numeric, and symbolic characters. Passwords must be changed every three months, and group passwords are not permitted. When invalid passwords are attempted, accounts should be locked.

   Accounts

   Outdated accounts need to be deactivated and removed. Any account information sharing should be encrypted. Necessary accounts need to have administration privileges.

   Physical Security

   IT facilities should have locked doors and windows. All company property is under video surveillance. Any and all mobile hardware is locked away in storage. When necessary, it should be checked in and out.

   Alerts

   A robust alert system should be in place and monitored at all times. The system should include alerts for unauthorized access, unplanned system modifications, and alerts for physical security intrusions.

2. Standards and Procedures

   Employee Requirements

   Background checks are required to access certain systems. All employees must acknowledge and sign security policy agreements. All employees must participate in security awareness training protocols.

   Incident Recovery and Response

   A comprehensive business emergency plan is documented, updated, and shared among all necessary stakeholders. Employees should undergo emergency response training on an annual basis. The overall chain of command for emergency response is well-defined.

   Document Disposal

   All sensitive documents should be shredded. Shredded documents should be stored correctly until the time of disposal and are disposed of by professionals. Similarly, all devices undergo a factory reset before changing users or before being thrown out or donated.

   Backups

   Necessary critical backups are performed on a daily basis. Backup systems are checked and validated regularly. And backed-up files should be stored in at least two different places.

3. Documentation and Reporting

   Security Protocols

   All security protocols should be formally documented. Similarly, they should be updated after any system modification or security event. Security protocols need to be shared with all employees, third-party vendors, and business partners.

   IT Logs

   Detailed logs of IT systems should be stored for at least six months. Storage of the IT logs needs to be secure. All logs should be reviewed on a weekly or monthly basis.

   Incident Reports

   A reliable incident reporting system should be in place at all times. Incident reports should record descriptions, times, and dates. Likewise, reports should include causes and solutions for the incidents, and procedures should be updated if necessary. When necessary, a business impact assessment should be carried out.

4. Performance Monitoring

   Outages

   Frequencies of outages, both planned and unplanned, should be recorded. In addition, specific metrics related to outages should be recorded, such as mean time to resolve, mean time between outages, total downtime, and downtime by service.

   Storage Utilization

   How much storage is being utilized needs to be known at all times. This includes RAM storage, hard drive, and cloud storage utilization.

   Network Performance

   Certain network performance metrics should be reported. For example, upload speeds, download speeds, and network latency. 

   Finances

   IT finances can be included in an audit. Financial data points include total IT expenses, IT expenses per employee, total cost per asset, and total cost per user group or user.

5. Systems Development

   Design and New Development

   A robust review process should be implemented to determine which parts of the greater IT system need to be developed. When developments are made, they should be well documented and followed. In addition, developments should require approval when necessary. Lastly, documentation of developments should be comprehensive and accurate.

   Testing

   Testing of IT systems and controls should be rigorous and comprehensive. Likewise, testing of any and all programs needs to be implemented routinely and done correctly.

   Implementation 

   Structured procedures for the implementation of new developments should be in place at all times. The implementation process needs to be documented and within compliance when necessary. Changes to the implementation plan should require approval. Likewise, specific security protocols should be followed during and after implementation. Afterward, documentation of the newly implemented control should be standard procedure.

Pro Tip: Check out our free, downloadable IT Audit Checklist.

The Process for How to Perform an IT Audit

How a business in the healthcare sector carries out its IT audits may vary drastically from how a law firm or large corporation facilitates its audits. That's because each institution's IT audit checklist will look a little different. Nonetheless, IT audits do have a generic progression from start to finish.

• Schedule the Audit

  Like a lot of things in life, sometimes the hardest step is the first one. But once you have an audit officially on the schedule, you can roll with the momentum. To mitigate operating too long without an audit, we recommend scheduling multiple audits so they become a normal routine in your business practice.

  To schedule your audit, you'll need to make a big decision: conduct an internal audit or hire an external auditor. Once you've decided that, you'll need to pick a date or a series of dates. Typically, it's best to schedule the audit during a "quiet" time on the business calendar, if possible.

• Prepare for the Audit

  Once you have the timeframe for an IT audit set in stone, it's time to start prepping.

  • Highlight the primary objectives of the audit
  • Define the scope of the audit, meaning what areas will be audited and the level of scrutiny they will be under
  • Create a more detailed audit schedule, such as which departments will be audited on which days and how much time is allotted for each one

• Carry Out the Audit

  If you perform an internal audit, it's time to execute the plan. If you've hired an external auditor, then it's time to let them work their magic. It's critical not to rush this step.  That's because to benefit the most from the audit, you want to allow the process to unfold organically, as you outlined in your audit plan. Instead, focus on business as usual.

• Report the Findings from the Audit

  After the audit is completed according to your timeframe and plan, you will be left with a series of findings and suggestions. To make the most of these findings, you will want to incorporate them into an official audit report. If you performed multiple audits, a report should be created for each one. The report(s) should be cataloged for future reference.

  Typically, audit reports are two-fold: they highlight the business's strengths. Or what the business is already doing well. In addition, the report will also highlight the business's weaknesses. These are the areas that you'll focus on for improvement.

  Next, you will want to devise an action plan for each weak point. For example, if your audit identified that some of your software is out of compliance with industry standards, you'll need to plan to update that.

• Circle Back

  After you have delivered your audit report and begun to carry out the different action plans to assess the weaknesses within your IT system, you'll want to eventually circle back to assess your progress.

  Put a date on the calendar in the near future to gauge if the proper corrections were implemented. If not, reassess your plan. If so, fantastic! It may be necessary to assign multiple dates to follow up. Before you know it, it will eventually become time for another IT audit, whereby you'll get a vivid picture of the improvements you've made in the past (and which weak points still require attention).

Why Do Businesses Perform IT Audits?

Businesses nowadays are becoming increasingly digitized and technological. And so, businesses with complex computerized systems perform IT audits to review that their IT-related controls and processes are working properly.

Some organizations will choose to keep an in-house IT expert specializing in IT audits on their salary. On the other hand, some organizations will hire a third-party IT auditor to perform the review. This is typically the best-case scenario because it helps guarantee that the audit is done impartially (with as little bias as possible).

In either case, IT auditors should be meticulously trained and certified. Examples of certifications include:

• Certified Information Systems Auditor (CISA)
• Certification in Risk and Information Systems Control (CRISC)
• Global Information Assurance Certification (GIAC) Systems and Network Auditor (GSNA)
• Certified Internal Auditor (CIA)

Types of Organizations that Perform IT Audits

If you ask yourself, "Does my company need an IT audit?" the answer is probably yes. That's because almost any company operating within today's digital landscape could benefit from an audit.

• Small to medium business: Even small and medium-sized companies can have complex IT systems that must be maintained. For example, non-profits and charities can operate more efficiently with innovative IT support solutions like help desks and customer service software.
• Large corporations: IT audits are critical for corporations to protect data and guarantee compliance with international standards. Similarly, legal firms and law offices require compliant software.
• Financial services: Financial institutions like banks must protect themselves from cyberattacks and maintain compliance with regulatory standards. The entirety of the institution's IT service management system must be compliant.
• Educational institutions: Universities manage a ton of personal data while also needing to maintain incredibly efficient IT systems for thousands, sometimes tens of thousands of users. To ensure the best user experience possible, colleges and universities can deploy IT service management and IT help desk software.
• Healthcare providers: Healthcare providers must ensure that patient data is secure.  And that all software, like IT service management applications, help desks, and customer service software, are compliant according to HIPAA guidelines.

What are the Benefits of an IT Audit?

IT audits are like brushing your teeth – there really is no downside to doing it. Yes, you have to invest some time and money into the process, but when it's all said and done, you're much better off than before. And the more frequently you do it, the more you can reap the benefits:

• Exposing security risks within your current networks
• Ensuring your IT assets are secure and updated
• Maintaining privacy and security compliance
• Addressing inefficiencies within your systems or controls
• Promoting trust and good business practices among employees, customers, and vendors
• Saving money by keeping IT systems in tip-top shape and preventing outages

What are the Risks of Not Doing an IT Audit?

The risks associated with not doing audits are widespread.

Without performing routine IT audits, you risk being exposed to cybersecurity threats.

In addition, you have to deal with network inefficiencies, unmaintained software and hardware, and outdated physical facilities.

Furthermore, without regular IT audits, you risk operating out of compliance.

IT Audit Checklists: Roadmaps for the IT Audit Destination

Every business is on a journey to grow and provide the best product or service possible. To accomplish that, businesses must be ready to participate in an increasingly complex and digital operation whereby a skilled IT department is at the forefront of their growth.

For IT departments to maximize their efficiency, mitigate cybersecurity threats, and avoid outages and other obstacles, routine IT audits must be in place. With routine IT audits, companies can ensure their IT systems remain healthy and sustainable. An audit checklist, then, is the roadmap for how to carry out the audits.

Reminder: Here's our free, downloadable IT Audit Checklist.

Giva Can Help With All Your Issue Tracking and Change Management Needs

Giva's IT help desk, ITSM and change management software offer easy-to-use and set-up solutions to help streamline your IT organizations.

Features include:

• Intuitive and flexible dashboard
• Helpful Copilots for quicker issue handling
• Ticket Macros for faster UI interactions
• Multiple service desks for different departments

To learn more, book a free Giva demo to see our solutions in action, or start your own free, 30-day trial today!