IT Audits & Controls Assessments
We test whether the IT controls your organization relies on are designed sensibly and actually operating the way your policies claim. Scope is agreed in writing before we begin, and every conclusion is supported by evidence we can show you.
Engagements cover access lifecycle, privileged access, change management, IT operations, backup and restore, vendor oversight and the application controls that matter to your reporting or regulatory obligations.
When this helps
Scope & deliverables
How accounts are requested, approved, provisioned, reviewed and removed, and how administrative rights are controlled.
Whether changes to systems and applications are authorized, tested and traceable.
The day-to-day disciplines that keep systems available and recoverable.
Third parties and in-scope applications that affect your data or reporting.
Testing design asks whether a control, if performed as described, would address the risk. Testing operating effectiveness asks whether it was actually performed throughout an agreed period. Operating-effectiveness conclusions depend on the period, the population available and the sample tested, so a clean result applies to that scope and period, not to your environment forever. Where records do not exist for a period, we report that limitation rather than infer a pass.
How we work
Step 01
Agree objectives, in-scope systems, the control list, the period under review and who provides evidence.
Step 02
Interview control owners, document how each control is performed and confirm the design against your policies.
Step 03
Request populations, select samples, inspect evidence and record every test in a workpaper.
Step 04
Share draft findings with owners, confirm facts, remove misunderstandings and rate the remaining issues by risk.
Step 05
Deliver the report and remediation plan, then walk leadership through priorities and optional retest timing.
Working together
How we use enquiry information is set out in our privacy policy.
FAQ
No. We are not a CPA firm and do not issue audit opinions on financial statements. We perform IT controls assessments that management, or your financial auditors, can use as input. Where your external auditor tests IT general controls, our work helps you prepare and remediate rather than replace their testing.
Most engagements run between two and six weeks of elapsed time. The main drivers are the number of in-scope systems, how quickly complete populations arrive and whether control owners are available for walkthroughs.
Usually not. Read-only or evidence-level access is enough for most testing, and in many engagements your team exports the evidence instead. We agree the access model in writing before fieldwork.
We report it as a scope limitation with the reason, for example that logs were not retained for the period. We do not record an untested control as effective.
Yes, as a separate remediation engagement. When we have performed the assessment we will state that clearly so you can decide whether independence matters for your purposes, for example when a third party relies on the report.
Retesting is available once the control has operated long enough to produce evidence. We agree the retest period and scope separately.
Keep Exploring
Tell us which systems and period you need covered and we will come back with a scope, timeline and evidence list.
Subscribe to receive the latest business insights, technology updates, company news, and useful ideas delivered to your inbox.
We respect your privacy. Unsubscribe at any time.
