IT AUDIT

• What is the primary business function of the organization?

• How many employees, contractors, and third-party vendors have access to IT systems?

• Provide an organizational chart highlighting IT-related roles.

• How many staff members are in the IT department?

• Who is responsible for IT decision-making (e.g., CIO, IT Manager)?

• Are there dedicated roles for cybersecurity, compliance, or data management?

• Provide a list of critical IT systems (e.g., servers, databases, applications).

• Are all hardware and software assets documented in an inventory? If yes, attach the inventory.

• Are there documented IT policies (e.g., acceptable use, access control, incident response)?

• When were these policies last updated?

• How are policies communicated to employees?

• Is there a formal IT strategy aligned with business objectives? 

• How often is the IT strategy reviewed and updated?

• Is there a formal IT risk assessment process?

• How are identified risks prioritized and mitigated?

• Are user access rights defined based on roles (e.g., role-based access control)?

• Is multi-factor authentication (MFA) implemented for critical systems? If not, why?

• How often are user accounts and permissions reviewed?

• What firewalls, intrusion detection/prevention systems, or antivirus solutions are in place? Provide vendor and version details.

• Are network traffic logs maintained and monitored? If yes, how frequently?

• Have vulnerability scans or penetration tests been conducted in the past 12 months?

• Is there a formal patch management process for software and systems?

• How frequently are patches applied to critical systems?

• Provide the date of the most recent patch cycle.

• Where is sensitive data (e.g., customer information, financial records) stored?

• Is data encrypted at rest and in transit? If yes, specify encryption standards (e.g., AES-256).

• Are there policies for data classification (e.g., public, confidential)?

• What is the backup schedule for critical systems and data?

• When was the last backup test performed, and what were the results?

• Is there a documented disaster recovery plan? If yes, provide a copy.

• Who has access to sensitive data, and how is access monitored?

• Are there tools in place to detect unauthorized data access or exfiltration?

• Which regulations apply to the organization (e.g., GDPR, HIPAA, PCI-DSS)?

• Are there documented processes to ensure compliance with these regulations?

• Have there been any compliance violations or audits in the past 24 months?

• Are employees trained on IT security and compliance requirements?

• How frequently is training conducted, and what topics are covered?

• Provide records of the most recent training sessions.

• Is there a formal incident response plan for IT security breaches?.

• How are incidents documented and reported?

• Provide details of any security incidents in the past 12 months.

• Are all software licenses documented and up to date? If yes, provide a license inventory.

• How is obsolete hardware or software decommissioned?

• Are system performance metrics (e.g., uptime, response time) monitored? If yes, what tools are used?

• How are performance issues identified and resolved?

• Are third-party vendors with access to IT systems audited? If yes, provide the latest audit report.

• Are service-level agreements (SLAs) in place with IT vendors? If yes, provide copies.

• Have there been any significant changes to IT systems, processes, or personnel in the past 12 months? If yes, provide details.

• Are there planned IT initiatives (e.g., cloud migration, system upgrades)? If yes, describe.

Any additional information relevant to the IT audit that was not covered above.