"System audit" means two things, and people mix them up. In IT it is an independent check of an information system: its controls, data integrity and whether it supports the business. In quality and compliance work it is an audit of a management system, such as an ISO 9001 quality system, against its standard. Decide which one you mean first, then scope the work.
Last reviewed: 17 October 2026. Facts checked. We ran web searches on information systems audit definitions and on process versus system audit. We opened no ISACA page, and the ICMAI IS audit presentation we tried returned a 404 error. The IT definition and the type lists below come from secondary search summaries (course notes, an ISACA Journal article snippet) and sources differ on how they group the types. The management-system meaning comes from general ISO 19011 practice, which we did not open. Treat the lists as common practice, not a standard.
Two meanings of system audit
| IT or information systems audit | Management system audit | |
|---|---|---|
| Subject | Applications, infrastructure, data, IT processes | Quality, environment, safety or other management system |
| Measured against | Control frameworks, policies, laws | The standard, for example ISO 9001, and the organisation's own procedures |
| Typical user | CFO, CIO, regulator, statutory auditor | Quality head, certification body |
| Output | Findings on controls and risk | Conformities and nonconformities |
The IT version is the one most searchers want. Common definitions describe an independent evaluation of an organisation's information systems environment, including controls, to check that it safeguards assets, keeps data integrity and meets goals efficiently.
What a system audit is not
- It is not a process audit. A process audit checks one process end to end. A system audit checks the set of processes, controls and technology as a whole. See our process audit guide.
- It is not only a cybersecurity audit. Security is one part of the scope. Our IT audit vs ITGC vs cybersecurity audit post shows the split.
- It is not a financial audit, although IT controls matter to one.
Scope of an IT system audit
Choose from the areas below based on risk.
- Governance. IT strategy, roles, policies, vendor oversight.
- Access. Who can log in, who can approve, who can change master data.
- Change management. How code, configuration and data fixes move into production.
- Operations. Backups, job scheduling, incident handling, recovery.
- Application controls. Input checks, calculations, interfaces, reports, approvals built into the software.
- Data. Quality, completeness, retention, privacy.
- Security. Network, endpoints, logging, vulnerability handling.
- Continuity. Disaster recovery and business continuity tests.
Types of system audit
Sources group these differently. A common grouping is:
- General controls audit. Access, change, operations. See ITGC testing.
- Application controls audit. Controls inside one system, such as an ERP module.
- Development or implementation audit. Review of a project before go-live.
- Operations audit. Day-to-day running of data centres or cloud services.
- Compliance audit. Adherence to a law or contract.
- Security and privacy audit.
- Management system audit. Against a standard such as ISO 27001 or ISO 9001. See ISO internal audit step by step.
Steps to run a system audit
1. Set the objective and scope
Name the system, the version, the locations and the period. Say what is out of scope.
2. Understand the system
Collect architecture diagrams, user lists, interface lists and policies. Interview owners.
3. Assess risk
List what could go wrong: unauthorised changes, bad data, outages, fraud. Rank by impact.
4. Plan the tests
Write a programme linking each risk to a test. The audit programme generator gives a format.
5. Test
Typical tests are inspecting user access lists, reviewing change tickets, re-performing a calculation, and running data analysis on full populations.
6. Evaluate
Judge which gaps matter. Separate design gaps from operating gaps.
7. Report and follow up
Rate findings, agree actions and track them. See the IT audit checklist.
System audit checklist
- System, version and scope named
- Owner and key users identified
- Risks listed and ranked
- Access reviewed, including leavers and privileged users
- Change records sampled
- Backups and recovery evidence seen
- Key application controls re-performed
- Data quality checks run
- Findings rated and owners agreed
- Follow-up dates set
Frequently Asked Questions
What is the difference between a system audit and a process audit?
A process audit examines one process. A system audit examines the whole system, meaning the technology and the many processes and controls around it.
Is a system audit the same as an IT audit?
In most searches, yes. Some sources treat IT audit and information systems audit as slightly different in breadth. Agree the definition before you start.
What standards guide a system audit?
For IT, auditors use frameworks such as COBIT or ISO 27001 and professional guidance from bodies like ISACA. For management systems, ISO 19011 gives audit guidance. We did not open these documents, so confirm current versions.
How often should a system audit be done?
Set the frequency from risk. High-risk or heavily changed systems need more attention than stable ones.
Can a system audit use continuous techniques?
Yes. Scripts can test full populations of access or transactions. See our continuous audit guide.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error