Glossary

What Is IT Audit?

An IT audit is a structured review of an organisation’s IT systems, access rights, data handling and controls to confirm they are secure, reliable and aligned with policy, regulation and business needs.

An audit compares what is actually in place against a standard: your own policies, a framework such as ISO 27001, or a regulatory or financial-audit requirement. Typical areas are user access and permissions, change management, backups and recovery, network and system security, and how data is handled.

There are different kinds: internal reviews run by your own team, external audits by an independent party, and IT general controls (ITGC) reviews that support a financial audit. Each ends with findings, a risk rating and recommendations.

A good audit is not just a list of problems: it gives evidence, prioritises what to fix first and leaves you with an action plan. Preparing documents and evidence beforehand makes the process faster.

Related

• ITGC audit checklist (guide)
• ERP audit checklist (guide)
• ISO 27001 for small business (guide)
• IT governance & compliance (guide)
• What is IT governance?

← Back to glossary