IT audit for a small business: what does it cover?

An IT audit takes stock of a company's IT: what exists, how it is configured, and what poses a risk. For a small business, it is often the starting point for a change of provider, a cyber insurance application or simply putting things back in order.

An IT audit for a small business does not need to be bulky. It must be clear, cover the right areas and lead to concrete actions, ranked by priority. The aim is not to find someone to blame, but to know where things stand.

What does an IT audit cover?

Depending on the context, the audit can also include telephony, multifunction printers, access granted to outside suppliers or data protection under the nFADP. The scope is set at the start, in writing, so that the report answers the right questions.

• Inventory: computers, servers, printers, network equipment and phones, with their age and condition.
• Security: updates, endpoint protection, multi-factor authentication, administrator accounts, e-mail filtering.
• Backups: what is backed up, where, for how long, and the date of the last restore test.
• Network: firewall, Wi-Fi, network segmentation, remote access.
• Licenses: Microsoft 365 and business software, including licenses assigned to inactive accounts.
• Documentation: who holds the access, where the passwords are, what is written down and what is not.

Preparing for the audit

The earlier these are gathered, the less time the audit takes and the more reliable the findings. Let staff know too: a few conversations with them often reveal habits that the documentation knows nothing about.

• Current contracts: provider, carrier, licenses, maintenance.
• Administrator access, or failing that, the list of people who hold it.
• Existing documentation, even if incomplete.
• Significant incidents from recent months.

How does an IT audit work?

How long it takes depends on the size of the fleet and the state of the documentation. The steps, however, stay the same. Much of the checking can be done remotely or outside busy hours, to keep disruption low.

What deliverables should you expect?

You must be able to use the report freely and pass it on to another provider. It must be usable by any provider, not only by the one who wrote it. A report limited to screenshots from automated tools, or that ends with nothing but a sales offer, falls short of that.

• An inventory of hardware, software and accounts.
• A list of risks, each described in plain terms, with its possible impact.
• Concrete, realistic recommendations for each risk.
• A management summary that can be read without technical knowledge.

Prioritizing risks, then taking action

Not all findings carry the same weight. Each risk is ranked by likelihood and impact: business interruption, data loss, a breach of personal data under the nFADP. Recognized frameworks such as the CIS Controls or the NIST Cybersecurity Framework, which SysPros relies on in cybersecurity, help place the company against established practice.

Start with high risks that are easy to fix: turn on multi-factor authentication, test a restore, close an unnecessary access. Heavier work is then planned into the following years' budget. An audit remains a snapshot at a given date: take stock again after every significant change.