Protect · Cybersecurity
An independent look at how your IT really runs
Boards, auditors, regulators and clients increasingly ask how technology risks are managed. Our IT audits review your controls against a clear standard and give you findings you can act on, not just a checklist.
The problem we solve
Assurance, not just inspection
An IT audit answers a simple question with evidence: are the controls you rely on actually working? Who can reach your systems, how changes are made, whether backups restore, whether software is licensed and whether personal data is protected.
We gather that evidence, explain what it means in plain language and agree a practical plan with the people who will do the fixing.
What you get
What an IT audit covers
Access and identity
Who has access to what, how it is approved and reviewed, and how quickly leavers lose it.
Change management
How systems are changed, tested and approved, and who can change them directly.
Backups and continuity
Whether backups run, restore and cover what matters, and how you would keep working after an outage.
Licensing and assets
Software licences, hardware inventory and equipment that is out of support.
Data protection
The technical measures behind your NDPA obligations, checked against how data is really handled.
E-invoicing readiness
Your invoicing systems, data and processes reviewed against NRS e-invoicing requirements.
What you receive
Findings you can act on
A concise report for management and the board, with the evidence and detail your IT team and external auditors need.
- An overall rating and a summary of the main risks
- Findings rated by likelihood and impact, each with its evidence
- A management action plan with owners and dates
- A follow-up review to confirm the actions were completed
How it works
How an IT audit runs
Plan and scope
We agree the scope, the standard to audit against and the evidence we will need.
Fieldwork
Interviews, walkthroughs, system reviews and sample testing, arranged around your team.
Report
Draft findings discussed with you, then a final report and action plan.
Follow up
A review of progress on the actions at the agreed date.
Our IT audits are independent technical reviews. They are not statutory financial audits, and we do not issue certifications. Where we have built or run a system ourselves, we say so and recommend an independent reviewer for it.
Questions
Frequently asked questions
How is an IT audit different from a security assessment?
A security assessment looks for weaknesses an attacker could use. An IT audit tests whether your controls work as intended, across access, change, backups, licensing and data protection, and documents the evidence.
Which standards do you audit against?
We can structure the review around frameworks such as ISO/IEC 27001 or COBIT, the NDPA’s security expectations, or the requirements your regulator, auditors or clients have set.
Will our external auditors accept the report?
We write it so the evidence can be relied on, and we can share our working papers with them. Whether they rely on it is their decision.
Can you train our staff on the findings?
Yes. We can run short sessions for the teams involved, from access reviews to backup testing, so the fixes stick.
Related services
Often paired with
Tell us what you need
Share a few details and we will reply by email with questions, next steps and, where it helps, a short call.