IT Internal Audit: Checklist, Process, And Best Practices

An IT internal audit is a structured review of an organization's technology systems, processes, and controls to evaluate their effectiveness. It spans hardware inventory, software and licenses, access controls, IT policies, Change Management, and vendor contracts.

This guide covers what an IT internal audit includes, how it differs from an external audit, and the six phases of the process, including physical verification of the inventory. It closes with a checklist organized by domain, what the audit report should contain, and how InvGate Asset Management keeps the asset evidence ready before the audit starts.

What is an IT audit? Step by Step Process!

Key takeaways

• An IT internal audit reviews systems, controls, assets, access permissions, and documentation across six domains: hardware, software, access, policies, Change Management, and vendor contracts.
• The process follows six phases: planning, fieldwork, physical verification, analysis, reporting, and follow-up.
• A structured checklist organized by domain makes audits faster and more defensible.
• InvGate Asset Management centralizes inventory and compliance data and runs physical audits with QR codes and Radio-Frequency Identification (RFID), so IT teams can stay audit-ready year-round.
• Internal audits help organizations catch control gaps before external auditors do.

What is an IT internal audit?

An IT internal audit is a structured review conducted by the organization's own audit team, or independent internal auditors, to evaluate IT systems, controls, and processes from the inside.

It covers hardware assets, software and licenses, access controls and permissions, IT policies and documentation, Change Management processes, and vendor contracts. Its purpose is to ensure every layer of the IT environment is controlled, documented, and defensible before regulators, vendors, or external auditors initiate their own reviews.

IT internal audit vs. external audit

The two audits look at the same environment from different sides, and the internal one is what prepares an organization for the external one. An operational audit is a third type, centered on how efficiently processes run, so the table below compares only the first two.

Standards and frameworks behind an IT internal audit

Internal audit functions that follow The Institute of Internal Auditors (IIA) work under the Global Internal Audit Standards, in effect since January 9, 2025. The IIA complements them with Topical Requirements, and two already apply to IT: Cybersecurity, effective February 5, 2026, and Third-Party, effective September 15, 2026.

Both apply whenever an internal audit provides assurance on that topic, so an IT internal audit that reviews security controls or third-party vendors needs to cover their requirements. The control frameworks the audit maps to have moved too: ISO 27001 is now in its 2022 version, and the Cybersecurity Framework (CSF) from the National Institute of Standards and Technology (NIST) reached version 2.0 in 2024, adding a Govern function.

Why do IT departments need internal audits?

The biggest reason is control. By proactively reviewing IT systems and processes, organizations catch issues before they become costly, whether that means security gaps, compliance failures, or overspending on technology.

Exposure builds quietly between audits. Unchecked access controls create insider threat exposure. Undocumented assets cannot be secured, patched, or decommissioned properly. Shadow IT introduces both security and compliance risk that the organization cannot manage if it does not know it exists.

The core benefits of running regular IT internal audits include:

• Preparedness for external audits. Ensure systems and documentation are ready before vendors or regulators step in.
• Reduced security exposure. Identify control gaps, such as unauthorized access, unmanaged endpoints, and misconfigured systems, before they are exploited.
• Cost optimization. Reclaim unused software licenses, retire End-of-Life hardware, and eliminate redundant spend.
• Regulatory alignment. Demonstrate compliance with frameworks such as ISO 27001, NIST CSF, the Health Insurance Portability and Accountability Act (HIPAA), the General Data Protection Regulation (GDPR), or COBIT as applicable to your industry.
• Ownership clarity. Identify assets without a clear owner, a gap that creates both operational and security risk.
• Offboarding integrity. Confirm that access revocation procedures are working and that former employees no longer have active credentials or device assignments.

What does an IT internal audit cover?

A comprehensive IT internal audit spans multiple domains. Each domain addresses a different category of risk, and each requires its own evidence-gathering approach. No single domain takes priority over the others.

1. IT assets and hardware. The full inventory of physical and virtual assets: serial numbers, locations, responsible owners, lifecycle stages, warranty status, and End-of-Life tracking. An asset no one knows exists is an asset no one is managing.
2. Software and licenses. Installations versus entitlements, shadow IT and unauthorized applications, vendor contracts and renewal dates, and underutilized licenses that are candidates for reclamation.
3. Access controls and user permissions. Who has access to what, and whether that access is still appropriate. This includes inactive accounts, former employees who retain credentials, users with local administrator privileges, and adherence to the least privilege principle.
4. IT policies and documentation. Formalized policies covering Asset Management, onboarding and offboarding, incident response, and business continuity, and evidence that those policies are followed in practice.
5. Change Management controls. Whether IT changes are documented, reviewed, approved, and tested before deployment, and whether rollback procedures exist and are practiced.
6. Third-party and vendor controls. Active contracts, Service Level Agreement (SLA) obligations, compliance requirements placed on vendors, and contracts that have expired or are approaching renewal without a plan.

The IT internal audit process

An IT internal audit process follows a structured path to make sure the review is thorough and actionable. It begins with planning, moves through fieldwork, physical verification, and analysis, and ends with a report and a follow-up that management can act on.

1. Planning

Define the scope: which systems, assets, applications, and controls will be reviewed. Align audit objectives with business goals and regulatory requirements.

Identify key risks in IT operations, including data breaches, access issues, license compliance, and undocumented assets. Review findings from previous internal audits to track whether prior recommendations were implemented.

2. Fieldwork

Gather evidence through interviews, system reviews, and technical tests. This phase verifies whether controls are operating as intended and highlights gaps.

For asset and software evidence, IT audit software that centralizes inventory, software compliance status, and device-level signals in one place reduces the manual effort of pulling data from scattered sources. The less evidence has to be assembled by hand, the more of the fieldwork goes into testing controls.

3. Physical verification

Records only show what the system expects to find. Physical verification checks them against what is on site: the team walks each location, scans the asset tags, and compares what it finds with what the inventory expects at that location.

The comparison produces three lists worth reporting: assets found where expected, assets missing from the location, and assets that turned up without being expected there. Fixing those records before the analysis keeps every later check on reliable data, and a physical inventory is also the only way to verify devices that never connect to the network, such as monitors, docks, and spare stock.

4. Analysis

Evaluate the evidence collected against the audit criteria: applicable frameworks, internal policies, and regulatory requirements. Identify control weaknesses, compliance gaps, and areas of operational inefficiency. This step produces the raw material for the report.

5. Reporting

Summarize results in a clear IT audit report, detailing risks, control effectiveness, and actionable recommendations. The report should identify responsible parties and timelines for remediation. It becomes the primary reference for follow-up work.

6. Follow-up

A follow-up review confirms that remediation plans were implemented and that the control gaps identified are actually closed. This step is what separates a mature audit program from one that produces reports nobody acts on.

IT internal audit checklist

A flat list of items is hard to execute and harder to defend. The checklist below is organized by domain so audit teams can assign ownership, scope specific reviews, and present findings in a structure that maps to the actual risk categories external auditors use.

1. Audit planning

• Define scope, objectives, and success criteria for this audit cycle.
• Review findings from previous internal audits and confirm remediation status.
• Assign audit roles and responsibilities across IT, compliance, finance, and legal.
• Align scope with applicable regulatory frameworks: ISO 27001, NIST CSF, COBIT, HIPAA, GDPR, or others relevant to your industry.
• Confirm which IIA Topical Requirements apply to the engagement, such as cybersecurity or third-party risk.
• Establish evidence collection methods (system exports, interviews, direct review).
• Set timelines and communicate audit schedule to process owners.

2. IT asset and hardware inventory

Maintaining a complete, current hardware inventory is the foundation of any IT internal audit. Without it, every subsequent check, from software compliance to access controls, is built on unreliable data.

• Confirm a complete hardware inventory exists: serial numbers, make/model, location, assigned owner, lifecycle stage.
• Flag assets without an assigned owner.
• Validate warranty status and identify assets in End-of-Life state.
• Reconcile inventory records against physical assets or network discovery data.
• Run a physical audit per location and resolve missing and unexpected assets.
• Review chain of custody for hardware that has changed hands.
• Confirm disposal documentation for decommissioned equipment.

InvGate Asset Management centralizes hardware inventory with owner, location, and lifecycle data, and its discovery runs through the Agent and network scanning, so these checks start from the actual state of the environment. Each of them is also part of a broader IT asset audit, which runs from discovery to reconciliation and can be repeated between internal audit cycles.

3. Software and license compliance

• Audit software installations against licenses acquired (true-up analysis).
• Identify shadow IT and software installed without IT authorization.
• Review vendor contracts and upcoming renewal dates.
• Flag underutilized or unused licenses for potential reclamation.
• Confirm software versions and check for unsupported or End-of-Life versions.
• Review software entitlements against deployment rights (per-seat, per-device, per-user).

Reconciling installations against entitlements is the core of a software license audit, the same exercise a vendor runs when it audits the organization. Running it internally first leaves time to fix gaps before anyone outside asks.

4. Access controls and user permissions

Access control gaps are among the most common findings in IT internal audits. They are also among the easiest to miss without a systematic review.

• Review active accounts against current employee roster and flag accounts belonging to former employees.
• Verify application of least privilege principle across systems and applications.
• Audit users with local administrator privileges.
• Review service accounts and shared credentials.
• Confirm offboarding procedures include timely revocation of all access.
• Check multi-factor authentication (MFA) enforcement on critical systems.

InvGate Asset Management flags Windows computers with local privileged users and records the last logged user on each device, which gives auditors a starting point for access anomalies at the endpoint level. Account, MFA, and service credential reviews run in the identity provider.

5. IT policies and documentation

• Confirm all IT policies are formalized, current, and version-controlled.
• Verify existence of an IT Asset Management (ITAM) policy and onboarding/offboarding procedures.
• Review incident response procedures and confirm they have been tested.
• Confirm business continuity and disaster recovery plans exist and are current.
• Validate that policy acknowledgment records exist for staff.

Policies hold up better in an audit when they trace back to a recognized IT governance framework. Each control then has a documented reason to exist.

6. Change Management controls

• Verify that a formal Change Management process exists and is documented.
• Confirm all infrastructure and configuration changes in the review period were documented, approved, and tested.
• Review the change log for unauthorized or undocumented changes.
• Confirm rollback procedures exist and have been practiced.
• Check that emergency changes follow an expedited but documented process.

7. Vendor and Contract Management

• Review all active IT vendor contracts for currency and completeness.
• Confirm SLA terms and verify whether SLAs were met in the review period.
• Identify contracts that have expired or are within 90 days of renewal without a renewal decision.
• Review third-party compliance obligations and confirm vendors meet the security and compliance requirements your contracts specify.
• Document any vendor changes, such as acquisitions or product retirements, that may affect contract terms.

IT internal audit report

The audit report is the primary deliverable of the process. A well-structured report serves both as a management communication tool and as evidence of audit program maturity for external reviewers.

A complete IT internal audit report should include an executive summary with high-level findings and the most critical recommendations, written for stakeholders who will not read the full document. It should also cover scope and methodology, findings by domain with risk ratings, specific and actionable recommendations for each finding, responsible parties and remediation timelines, the status of prior audit findings, and an appendix with supporting evidence and data sources.

Reports should be shared with IT leadership, the compliance function, and where applicable, the audit committee or executive sponsor. Findings rated critical or high need remediation timelines that someone tracks to closure.

IT internal audit best practices

Treat audits as a continuous process. Point-in-time audits capture a snapshot, while continuous asset monitoring, regular access reviews, and quarterly checks on high-risk domains keep the organization audit-ready and surface issues before they compound.

1. Document findings and track remediation to closure. An audit report that sits in a folder is not a completed audit. Assign owners, set deadlines, and track remediation through to verification. A follow-up audit confirms the gaps are actually closed.
   
   
2. Align scope with the regulatory frameworks that apply to your industry. ISO 27001, NIST CSF, COBIT, HIPAA, and GDPR each have specific control requirements. Scoping audits against the relevant framework makes findings more actionable and the organization's compliance posture more defensible.
   
   
3. Use tools that maintain data between audit cycles. Manual inventory collection before every audit introduces error and lag. Tools that maintain a live, accurate view of assets, software, and configurations dramatically reduce the fieldwork burden and improve evidence quality.
   
   
4. Involve finance, legal, and security in planning. IT audits touch software contracts, data protection obligations, and risk management decisions that go beyond the IT department. Cross-functional involvement in planning produces better scope alignment and faster remediation decisions.
   
   
5. Keep prior audit findings in scope. One of the clearest signals of a mature audit program is that findings from previous cycles stay open until a follow-up confirms the fix, even after a remediation plan is written.

Common IT internal audit challenges

Even well-run IT teams run into the same recurring obstacles when audit time arrives. Recognizing them in advance is half the battle.

1. Incomplete or outdated inventory. The audit starts with the inventory. If the asset database has not been updated since the last audit cycle, every subsequent check, from software compliance to access controls, is built on unreliable data. This is the most common reason audits take longer than planned.
   
   
2. Fragmented documentation. Data in spreadsheets, ownership information in email threads, contracts in a shared drive that no one fully controls. When evidence lives in disconnected systems, gathering it under audit pressure is slow, error-prone, and stressful. This is the scenario often called "audit panic," the rush to assemble documentation when an external auditor or vendor notification arrives.
   
   
3. No clear asset ownership. Assets without an assigned owner cannot be properly secured, maintained, or decommissioned. During an audit, unowned assets create ambiguity about who is responsible for their compliance status.
   
   
4. Shadow IT that was not detected. Unauthorized software and unmanaged devices are by definition invisible to manual inventory processes. Without automated discovery, shadow IT stays invisible until a vendor audit or security incident surfaces it.
   
   
5. No follow-through on prior findings. If remediation plans from the last audit were never completed, the same gaps will appear in this one. Recurring findings signal to external auditors that the internal audit function is not driving real change.
   
   
6. Audit scope that is too narrow. An IT internal audit that only covers one or two domains misses the hardware, access, policy, and vendor areas that external auditors will review. A narrow scope produces a false sense of readiness.

How to perform an IT internal audit with InvGate Asset Management

InvGate Asset Management: 5-minute demo

Most IT teams know what to audit. Where they lose time is having the data ready when the audit starts, because the environment changes every day. Here is how InvGate Asset Management supports each phase of the audit process, from the inventory to the physical audit.

1. Build a complete, auto-updated inventory

InvGate Asset Management offers multiple ways to populate the inventory: the InvGate Asset Management Agent, network discovery, integrations with platforms like Microsoft Intune, Jamf, AWS, and Azure, and manual import via CSV. All methods feed a single record, so hardware, software, and cloud resources live in the same place.

The inventory updates automatically as the environment changes. There is no manual refresh cycle, and no separate spreadsheet to maintain alongside the platform.

2. Track hardware through its full lifecycle

Every asset record includes general, financial, and operational data: acquisition cost, depreciation, warranty expiration, End-of-Life date, location, and assigned owner. Teams can also define custom lifecycle stages for specific asset types.

Warranty APIs fill in acquisition and warranty dates automatically for Dell, Lenovo, and IBM devices, and the Atlas AI Agent adds the End-of-Support date for computers, servers, and network equipment from the manufacturer's official sources. That way an auditor sees where each device is, what it costs, and when it stops being supported.

3. Monitor hardware health

For devices running the InvGate Asset Management Agent, the platform evaluates hardware conditions and surfaces a status indicator on each asset profile: Safe, Warning, or Critical. The indicator also shows which condition or conditions triggered the status.

Teams can configure Health rules to monitor average CPU, RAM, or disk usage and pending reboots. The same rules cover the security conditions an auditor asks about: antivirus or firewall deactivated, encryption not detected, operating system updates pending, and banned software detected.

4. Detect and manage software

The Agent detects installed software across all managed devices and collects installation and usage data. The Software Compliance module compares what is installed against what was acquired in each contract, surfacing installations without a valid license and licenses that go unused.

Authorization policies complement this by letting IT teams classify software as allowed, under review, or prohibited. Unauthorized installations are flagged automatically, giving auditors a documented record of what was detected and when.

Recommended reading

Centralize IT Vendors, Contracts, And Assets in One Platform

Read Article

5. Tag assets with QR codes and RFID

InvGate Asset Management generates QR codes for any asset in the inventory, whether IT or non-IT, individually or in bulk. Each code links to the asset's live record, and scanning it with a phone's camera opens that record in the browser.

For bulk reads, each asset can also carry an RFID tag whose code is stored in its record. InvGate's own tags put a QR code and an RFID inlay on one label, so a single QR scan links both, and the asset tagging program can start at receiving, before a device reaches its user.

6. Run physical audits by location

Physical audits turn the physical verification phase into a scan. The team creates an audit for a location, walks it, and each read is matched against the assets the platform expects there, using QR codes from any phone or tablet, a supported Zebra RFID reader for bulk reads, or a manual load of IDs, hostnames, or serial numbers from the desktop.

The audit summary shows the assets in scope, how many were Found, how many are still Pending, and an Others group for everything read outside the expected set. Closing the audit turns the remaining Pending assets into Missing and records the result on each asset, so the asset explorer can filter by audit result, apply bulk fixes, and export the results to CSV or XLSX as audit evidence.

For lists that come from somewhere else, such as serial numbers from a vendor shipment or an auditor's sample, InvGate Asset Management can find assets from any external list. Pasting the identifiers returns every match in one search, ready for a bulk update.

7. Configure automations

The platform includes native automations for common scenarios: stock minimum alerts, warranty expiration notifications, contract renewal reminders, and depreciation rule triggers. Teams can also build custom rules combining events, conditions, and actions for any process specific to their organization.

This keeps the team a step ahead of renewals and lifecycle transitions without anyone having to check a dashboard manually.

8. Reports, dashboards, and audit trail

InvGate Asset Management supports automated reports with custom criteria that are sent to the right people on a regular schedule, and scheduled exports that feed business intelligence (BI) tools. Teams can also build dashboards around the indicators the audit covers, so the data is ready the moment fieldwork starts.

Each Configuration Item (CI) keeps a dated history of its changes, which gives auditors a trail to follow. Smart Recommendations add a check before the audit, flagging data quality issues such as assets missing acquisition cost or date, along with risk and compliance gaps.

Deployment and security

Regulated teams can run InvGate Asset Management in the cloud or on-premises, including air-gapped environments. The platform holds ISO 27001:2022 and SOC 2 Type II certifications, which matters when the audit tool itself falls inside the audit scope.

How Grupo Gigante cleared its IT audit observations

At Mexican conglomerate Grupo Gigante, an internal audit in 2022 left 11 observations on the organization's technology processes, including change and inventory processes with no formal structure. The team implemented InvGate Service Management integrated with InvGate Asset Management in three months, linking each device to its assigned employee from onboarding.

The result, as the Grupo Gigante case study reports, was zero audit observations, down from the 11 that started the project. The same integration supported a preventive maintenance program that reduced reported failures by 36%.

Conclusion

An IT internal audit is only as strong as the evidence behind it: a current inventory, software reconciled against entitlements, records checked against what is physically on site, and findings tracked until a follow-up confirms the fix. Organizations that keep that evidence current between cycles spend the audit on analysis, with far less time lost gathering data.

InvGate Asset Management keeps that evidence in one place, from discovery and software compliance to physical audits with QR codes and RFID. You can start a free trial for 30 days, or talk to Sales to review what your next IT internal audit will need.

Frequently Asked Questions

What is an IT internal audit?

An IT internal audit is a structured review of an organization's IT systems, controls, assets, and processes, conducted internally to identify risks, verify compliance, and improve operational effectiveness before an external auditor or regulator steps in.

What does an IT internal audit include?

A complete IT internal audit covers hardware asset inventory, software and license compliance, access controls and user permissions, IT policies and documentation, Change Management controls, and Vendor and Contract Management.

How often should an IT internal audit be performed?

Most organizations run a comprehensive IT internal audit once a year, with focused reviews on high-risk areas every quarter. Regulated industries may require more frequent reviews to meet compliance schedules.

What is the difference between an internal and external IT audit?

An internal audit is conducted by the organization's own team to improve controls and maintain readiness. An external audit is performed by regulators, vendors, or independent third parties, is typically mandatory, and focuses on proving compliance to outside stakeholders.

How do you prepare for an IT internal audit?

Preparation starts with maintaining a current, complete asset inventory, documenting IT policies and procedures, reviewing access controls, and tracking the remediation status of findings from prior audits. Teams that use Asset Management tools to maintain continuous visibility spend significantly less time in the evidence-gathering phase and arrive at audit time already prepared.

Should an IT internal audit include a physical inventory count?

Yes, whenever the scope includes hardware. Records only show what the system expects, and a physical count per location confirms which assets are on site, which are missing, and which turned up without being expected, so the findings rest on verified data.