An IT audit gives management and stakeholders an independent view of whether technology risks are under control. Good audits follow a clear, repeatable method. This guide walks through the IT audit process in six phases, from planning to follow-up, with practical tips for both auditors and the teams being audited.
Overview of the six phases
| Phase | Main output |
|---|---|
| 1. Planning | Audit scope, objectives, criteria and plan |
| 2. Risk assessment and understanding | Key risks and the controls that address them |
| 3. Control evaluation | Judgement on control design |
| 4. Testing and evidence | Evidence that controls work, or do not |
| 5. Reporting | Findings, ratings and recommendations |
| 6. Follow-up | Confirmation that fixes are in place |
Phase 1: Planning
First, agree on what the audit covers and why. The plan should define:
- objectives, such as “assess access management for the finance ERP”;
- scope: systems, locations, processes and time period;
- criteria: the standard or policy you will measure against, such as ISO 27001, COBIT or internal policy;
- team, timing and access needs.
Then hold an opening meeting with the auditee. As a result, everyone knows what to expect and which documents to prepare.
Phase 2: Understanding and risk assessment
Next, learn how the area works. Read policies, diagrams and previous reports, and interview key staff. Then identify the main risks, for example unauthorised access, data loss or failed changes, and the controls meant to manage them. Focus the audit on the highest risks.
Phase 3: Evaluating control design
Ask whether each control, if it works as intended, would actually reduce the risk. For instance, a quarterly access review is well designed only if reviewers have accurate data and authority to remove access. Design gaps become findings even before testing.
Phase 4: Testing and gathering evidence
Then test whether controls operate effectively over the audit period. Common techniques include:
- inquiry: asking people how a process works;
- observation: watching a task being done;
- inspection: reviewing documents, logs and configurations;
- re-performance: repeating a control yourself, such as recalculating access rights;
- sampling: testing a selection, such as 25 user access requests out of 500.
Document every test: what you checked, the sample, the result and where the evidence is stored. Others must be able to follow your work.
Phase 5: Reporting
Draft findings with four parts:
- Condition: what you found.
- Criteria: what should be happening.
- Cause: why the gap exists.
- Effect: the business risk.
Rate each finding, for example high, medium or low. Then discuss the draft with management, agree on actions, owners and dates, and issue the final report. Finally, hold a closing meeting.
Phase 6: Follow-up
An audit only adds value if issues get fixed. So track actions and retest them after their due dates. Report overdue items to senior management or the audit committee.
Tips for teams being audited
- Prepare evidence in advance and name files clearly.
- Answer questions honestly; do not guess.
- Raise known issues yourself, together with your plan to fix them.
- Agree on realistic action dates.
Related guides
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
