An IT audit checks whether the systems a business depends on are secure, change in a controlled way, keep running and produce reliable data. The best order is to start with scope and governance, then test who has access, how changes are made, how systems are run and recovered, and finally how security is monitored. The checklist below follows that order, with the evidence to request at each step.
Last reviewed: 17 October 2026. Facts checked. We searched for IT audit and general controls checklists. Results were vendor blogs and TechTarget, and none was ISACA, COBIT or ICAI material. We did not open any standard or regulation. The order and checklist reflect common practice, so adapt them to your own risk assessment. We did not verify any legal threshold.
What is an IT audit?
It is a review of the technology and the controls around it. Our guide to IT audit, ITGC and cybersecurity audit explains how these three overlap. This post is the practical checklist. For the controls most financial auditors rely on, see the ITGC audit guide for India.
Why the order matters
Each step builds on the one before. If access control is weak, nothing else can be trusted. If changes are uncontrolled, a test of a report last month tells you little about this month. Start at the base.
| Order | Area | Question it answers |
|---|---|---|
| 1 | Scope and inventory | What systems matter? |
| 2 | Governance | Who is in charge, and by what rules? |
| 3 | Access | Who can do what? |
| 4 | Change management | How do changes get into production? |
| 5 | Operations | Do jobs run and fail safely? |
| 6 | Backup and recovery | Can we get data back? |
| 7 | Security monitoring | Would we notice an attack? |
| 8 | Third parties | Do vendors weaken the controls? |
1. Scope and inventory
- List the applications, databases, servers and networks that support finance and operations.
- Rank them by risk: which hold money, personal data or regulatory records?
- Identify which are hosted by a vendor.
Evidence: system list, network diagram, data flow overview.
2. Governance
- IT policies exist, are approved and are current.
- Roles and responsibilities are defined, including who owns each system.
- A risk assessment covers IT, and results are reported to management.
- Budget and staffing are enough for the work.
Evidence: policy documents, org chart, committee minutes.
3. Access controls
- A joiner gets access only after approval, based on role.
- A leaver loses access quickly. Compare HR leaver lists to active accounts.
- Privileged and administrator accounts are few, named and reviewed.
- Passwords and multi-factor settings meet policy.
- Access is reviewed at set intervals. See user access review and segregation of duties.
- Shared and default accounts are removed or controlled.
Evidence: user lists from the system, HR leaver list, approval tickets.
4. Change management
- Every change has a request, approval, testing and sign-off.
- Test and live environments are separate.
- Developers cannot move their own code into production.
- Emergency changes are approved afterwards and logged.
- A sample of changes traces from ticket to deployment.
Evidence: change tickets, release logs, test results.
5. IT operations
- Scheduled jobs are monitored and failures are followed up.
- Incidents are logged, classified and closed.
- Patches and updates are applied on a plan.
- Interfaces between systems are reconciled, so data does not drop or double.
Evidence: job logs, incident register, patch reports.
6. Backup and recovery
- Backups run on schedule and failures are handled.
- Copies are stored away from the main site.
- Restore tests have been done and recorded.
- A disaster recovery plan exists and has been tested. Our business continuity and disaster recovery audit checklist helps here.
Evidence: backup logs, restore test reports, recovery plan.
7. Security monitoring
- Network and endpoint protection are in place and updated.
- Logs are collected and someone reviews alerts.
- Vulnerability scans and penetration tests are done and findings tracked.
- Staff receive security awareness training.
- Personal data is protected. See the DPDP compliance checklist.
Evidence: scan reports, alert reviews, training records.
8. Third parties
- Vendors that host or support key systems are listed.
- Contracts cover security, data return and audit rights.
- Vendor assurance reports are reviewed.
Use the vendor management audit checklist and the ITGC audit workbook.
Testing tips
- Ask for system-generated lists, not lists the IT team types for you.
- Test the whole population where you can, not just a sample.
- Check that a control worked all year, not only on the day you tested.
- Report findings with the business risk in plain words.
Common findings
- Leavers' accounts still active
- Shared administrator passwords
- Changes made straight to live systems
- Backups taken but never restored in a test
- No one reviews the logs that exist
Frequently Asked Questions
What is an IT audit?
A review of whether IT systems and controls keep data secure, accurate and available.
What are the main areas of an IT audit?
Governance, access, change management, operations, backup and recovery, and security.
What is the difference between IT audit and ITGC audit?
An ITGC audit is a subset that tests the general controls over systems that support financial reporting. An IT audit can be wider.
How long does an IT audit take?
It depends on the number of systems and the depth of testing. Scope it by risk first.
Who should perform an IT audit?
A person with technical knowledge who is independent of the IT team being audited.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error