An IT audit checklist is a structured list of the things you will check, how you will check them, and where you will record the evidence. For a small business in Ireland, a good one covers ten areas: assets, network and firewall, user accounts, devices and patching, email and Microsoft 365, backup and recovery, data protection, printers and physical security, suppliers, and policies. It ends with findings that are rated by risk, each with an owner and a date. This guide gives you that checklist, the steps for running it, and a template layout you can copy into a spreadsheet.
TL;DR
- Define the scope first: all systems or one application, and whether you are testing security controls, operations or both.
- Work through ten areas, starting with an asset inventory, because you cannot audit what you have not listed.
- Ask for records and evidence (screenshots, exports, tickets), not opinions.
- Rate every finding, give it a reference number, an owner and a due date, then check that the fix worked.
- Repeat on a schedule, and bring in a specialist where the work needs skills you do not have in house.
Table of Contents
- What an IT audit is, and what it is not
- Set the scope and use risk to decide priorities
- The IT audit checklist: ten areas to check
- If you are a regulated firm
- How to run the audit, step by step
- Record and rate findings so they get fixed
- An IT audit template you can reuse
- How often to repeat the audit
- Let us run the audit with you
- FAQ
- Sources
What an IT audit is, and what it is not
An IT audit examines how an organisation uses technology: its infrastructure, policies and procedures, applications and data. The WGITA/IDI handbook on IT audit describes it as an analysis of systems and controls to confirm they meet business needs without compromising security, privacy or cost.
The core of the work is identifying risk and the controls that bring that risk down to an acceptable level. ISACA makes the point that IT auditing is not ordinary accounting control testing and not a simple compliance exercise: the auditor asks whether your systems and processes for achieving and monitoring compliance actually work.
For a company with 10 to 200 staff, this translates into a plain question: do the things we rely on every day work, are they protected, and could we recover if one failed? The checklist below is built to answer that.
Set the scope and use risk to decide priorities
A checklist is only as useful as its scope. Decide whether you are reviewing every system or a single application, and whether the review covers security and operations as well as anything that feeds your financial reporting. The IDI handbook lists scoping, planning, designing, conducting and reporting as the main phases, and notes that planning continues throughout, because what you find can change the plan.
You will rarely have unlimited time, so let risk set the order. The IT Audit Framework (ITAF) asks practitioners to use risk assessment in planning, so audit resources go to the areas that matter most. If you want a way of thinking about this at board level, board-ready risk registers show how risks can be listed, owned and ranked so that limited effort is spent where exposure is highest.
In practice, ask three questions for each system: what happens to the business if it is unavailable for a day, what happens if its data leaks, and how likely is either. Start the audit with the systems where both answers are painful, typically email, file storage, line-of-business software and anything holding customer or employee data.
Write the scope down on one page: title, objectives, what is in and out, the standard you are measuring against (your own policies, the NCSC small business guidance, ISO/IEC 27001 if you work toward it), the timeline, who is involved, and the first list of records you will request.
The IT audit checklist: ten areas to check
For each area, record what is in place, whether it is still supported and updated, and who looks after it. If an item does not apply, mark it N/A and say why in a line, so the omission is visible later.
1. Assets and inventory
List every business computer, laptop, mobile, server, network device and printer, with owner, location, operating system and support status. Do the same for software and cloud subscriptions. The Cyber Resilience risk assessment questions start here, asking whether you hold inventories of devices and software and whether they are kept up to date. Anything that has fallen out of vendor support goes straight onto the findings list.
2. Internet connection, firewall and network
Check that a firewall is enabled and its rules reviewed, that remote access runs over a VPN, and that Wi-Fi is segmented so guests and personal devices cannot reach business systems. The NCSC’s cyber security guidance for small businesses tells SMEs to enable firewalls and use VPN services for secure communications. Our note on business firewall features lists what to look for in the device itself. Confirm switches, access points and cabling are documented, and that nobody is using the default administrator password on any of them.
3. User accounts and access
Export the list of user accounts and compare it with your current staff list. Disabled leavers, shared logins and unused admin rights are the most common findings in a small firm. Check that multi-factor authentication is enabled, which the NCSC guidance recommends for small businesses. For Microsoft 365, our MFA migration checklist and the guide to conditional access policies cover the configuration. Review your password rules against our password policy practices, and check whether staff use a business password manager.
4. Devices, patching and endpoint protection
For each PC, laptop and server, record patch level, whether automatic updates are on and whether updates come from trusted sources, whether anti-virus is installed and current, and whether the device is encrypted and password-protected. These are all items in the NCSC guidance. Sample a handful of machines rather than trusting a dashboard alone. Our pages on securing business PCs and deploying endpoint encryption explain how to close gaps without disrupting work. For servers, a daily maintenance runbook gives you something concrete to test against.
5. Email and Microsoft 365
Email is where most small business incidents start. Check spam and phishing filtering, how external senders are flagged, whether mailbox auditing is on, how shared mailboxes are controlled and who holds administrator roles. We cover the detail in what an email security audit should check.
6. Backup and recovery
The question is not whether backups exist but whether you can restore from them. The NCSC guidance recommends regularly tested backups with current copies. The Cyber Resilience questionnaire goes further, asking whether cloud-stored business data is backed up, whether backups are tested, and whether critical data has immutable or air-gapped copies. Record the last successful restore test, the time it took and who ran it. If you have never done one, schedule it as your first remediation. Microsoft 365 data needs its own thought: see our guide to Microsoft 365 backup for Irish SMEs and our notes on testing disaster recovery.
7. Data protection and GDPR
If you process personal data, your audit should show you have appropriate technical and organisational measures. The Data Protection Commission’s data security guidance summarises that GDPR Articles 25 and 32 require the ability to restore access to personal data in a timely manner and a process for regularly testing and evaluating the measures. Its guidance for SMEs asks for a risk-based approach, and notes that a data protection impact assessment is mandatory before new high-risk processing. Add checklist lines for where personal data is stored, who can reach it, how long it is kept and how a breach would be spotted and reported.
8. Printers, copiers and physical security
Network printers and multifunction devices store documents and sit on your network, yet they are often missing from audits. Check firmware, admin passwords, scan-to-email settings and stored job data. Our printer security hardening plan breaks this into manageable stages. For physical security, confirm the server or comms cabinet is locked, access is logged, and equipment disposal wipes data.
9. Suppliers and cloud services
List every supplier with access to your systems or data: IT support, hosting, software vendors, payroll. Record what they can reach, whether a contract covers security and data protection, and how access is removed when the relationship ends.
10. Policies, training and incident response
Check that acceptable use, password, remote working and incident policies exist, are current and have been read. Ask who staff call when something looks wrong and test that the answer is the same from three different people.
If you are a regulated firm
Some Irish businesses carry formal obligations. Under the Digital Operational Resilience Act (DORA), the Central Bank of Ireland’s FAQ explains that financial entities must document and review their ICT risk management framework at least once a year, or periodically in the case of microenterprises. For entities other than microenterprises, the framework is also subject to internal audit by auditors with sufficient ICT risk expertise and appropriate independence, as set out in Article 6(6) of DORA. If that applies to you, confirm your obligations with your compliance adviser before relying on a general checklist.
How to run the audit, step by step
The PEMPAL IT audit guide describes a sequence that scales down well to a small business.
- Agree scope, objectives, timing and team.
- Collect initial data: inventories, policies, network diagrams, account exports.
- Finalise the checklist and the areas of highest risk.
- Test the controls, gather evidence and write up issues as you go.
- Draft the report, discuss it with the people responsible and agree actions.
- Issue the final report, close the engagement and schedule follow-up.
Two practical points improve the result. First, the person running the audit should not be the person who owns the area being checked. In a small firm that is hard, which is one reason many owners use an outside party for the first review. Second, write checklist questions that ask for a record, such as an export, a screenshot or a ticket, rather than asking someone whether they think a control works.
Record and rate findings so they get fixed
A finding without evidence is an opinion, and a finding without the requirement it fails leaves the owner unsure what to change. For each one, state the requirement, the evidence you saw and the gap. ISACA’s guidance on the components of an IT audit report recommends rating each finding’s significance and giving it a unique reference, then recording the response, the responsible manager and the agreed date. ITAF adds that findings must rest on sufficient evidence and that progress on them should be monitored and reported to those responsible for oversight.
A simple three-level scale works for most small firms: high for anything that could stop the business or expose personal data now, medium for weaknesses that need a plan within a quarter, low for tidying. Closing a ticket is not the same as showing the fix works, so retest the control before you mark it done.
An IT audit template you can reuse
Build one row per control, using these columns.
| Column | What goes in it |
|---|---|
| Ref | A unique number, such as NET-03 |
| Area | Network, accounts, devices, backup and so on |
| Control to test | For example, MFA enabled for all users |
| Test procedure | Export of MFA status from the admin portal |
| Evidence reference | File name or screenshot location |
| Result | Pass, fail or N/A, with a one-line reason |
| Risk rating | High, medium or low |
| Recommendation | The specific change needed |
| Owner and due date | A named person and a date |
This structure, with a control, a test procedure and fields for evidence, findings and ratings, is the one described by theaudit.org, and it turns the checklist into both a testing guide and an evidence trail. Add a summary tab that counts findings by rating, and you have something a director can read in two minutes.
How often to repeat the audit
A full review once a year suits most small businesses, with quarterly spot checks of the fast-moving items: user accounts, patch status and backup restores. Repeat sooner after a major change such as a move to Microsoft 365, a new office, a merger or a security incident.
Our perspective on IT audits
In our thirty years of supporting Irish organisations, the pattern we see is that a checklist is most valuable when it feeds a routine, not when it is completed once and filed. A small business that audits itself every year but only reacts when something breaks has the paperwork without the protection.
That is why we favour proactive managed services: continuous monitoring, early threat detection and regular review mean many checklist items are being checked every day, and the annual audit confirms rather than discovers. Our aim is to act as an extension of your own team, so the owner and the office manager are not left carrying technical work alongside their day jobs.
We also believe an independent view matters. As an HP Amplify Partner and a Microsoft Cloud Service Provider, we work inside the environments we audit, and we can turn findings into scheduled work: patching, backup design, Microsoft 365 hardening, cabling or hardware replacement, in a sensible order and at a pace the business can absorb.
Carl
Let us run the audit with you
If you would rather not carry the audit alone, we can help you scope it, test the controls and turn the findings into a plan. Our IT security and data protection services include threat and risk assessment and planning, vulnerability management and penetration testing, and our managed IT services for small businesses keep the results in place month after month.
To talk through your environment, visit lancast.ie and tell us what you are running today.
FAQ
What is a checklist in an IT audit?
It is a structured list of the controls you will test, the procedure for testing each one and fields for recording evidence, findings and risk ratings. It works as a guide while you test and as proof afterwards. It prompts investigation and does not replace judgement.
What should a small business include in an IT audit?
Start with an asset inventory, then check firewalls, patching, anti-virus, encryption, multi-factor authentication and tested backups, all of which the NCSC recommends for small businesses. Add data protection checks tied to GDPR, plus email, printers, suppliers and policies.
How long does an IT audit take for a small business?
The time depends on the number of sites, users and systems, so no single figure applies. A focused review of a single-office business is usually a matter of days of evidence gathering, plus time to write up and agree actions. Scoping carefully at the start is the best way to keep it short.
Can we run an internal IT audit ourselves?
Yes, for the basics, provided the person auditing does not own the area being checked and every answer is backed by a record. Where the work needs specialist skills, such as penetration testing or a regulated framework review, bring in an experienced IT provider.
Sources
- WGITA/IDI Handbook on IT Audit
- ISACA Journal: The Core of IT Auditing
- ISACA Journal: The Components of the IT Audit Report
- IT Audit Framework (ITAF), 4th Edition
- NCSC Ireland: Cyber security for small business
- Data Protection Commission: Data Security Guidance
- Data Protection Commission: Guidance for SMEs
- Cyber Resilience: Risk assessment
- Central Bank of Ireland: DORA FAQ
- DORA, Chapter II: ICT risk management
- PEMPAL: IT audit guide
- theaudit.org: IT audit checklist template