IT Internal Audit: Checklist, Process, And Best Practices

An IT internal audit is a structured review of an organization's technology systems, processes, and controls to evaluate their effectiveness. It spans hardware inventory, software and licenses, access controls, IT policies, change management, and vendor contracts.

As IT environments grow more complex, internal audits have become one of the most effective mechanisms organizations have to stay in control. A 2025 survey by Unisphere Research found that 62% of companies were audited by a major software vendor in 2024, up from 40% the year before. Of those audited, 32% incurred financial liabilities exceeding $1 million. Running an IT internal audit first is how organizations avoid becoming part of that statistic.

What is an IT audit? Step by Step Process!

Key takeaways

• An IT internal audit reviews systems, controls, assets, access permissions, and documentation across equal domains: hardware, software, access, policies, change management, and vendor contracts.
• The process follows four phases: planning, fieldwork, analysis, and reporting.
• A structured checklist organized by domain makes audits faster and more defensible.
• InvGate Asset Management centralizes inventory and compliance data so IT teams can stay audit-ready year-round.
• Internal audits help organizations catch control gaps before external auditors do.

What is an IT internal audit?

An IT internal audit is a structured review conducted by the organization's own audit team, or independent internal auditors, to evaluate IT systems, controls, and processes from the inside.

It covers hardware assets, software and licenses, access controls and permissions, IT policies and documentation, Change Management processes, and vendor contracts. Its purpose is to ensure every layer of the IT environment is controlled, documented, and defensible before regulators, vendors, or external auditors initiate their own reviews.

IT internal audit vs. external audit

Why do IT departments need internal audits?

The biggest reason is control. By proactively reviewing IT systems and processes, organizations catch issues before they become costly, whether that means security gaps, compliance failures, or overspending on technology.

The financial exposure is real. The survey data cited above illustrates how quickly an unprepared IT environment turns into a liability. Unchecked access controls create insider threat exposure. Undocumented assets cannot be secured, patched, or decommissioned properly. Shadow IT introduces both security and compliance risk that the organization cannot manage if it does not know it exists.

The core benefits of running regular IT internal audits include:

• Preparedness for external audits. Ensure systems and documentation are ready before vendors or regulators step in.
• Reduced security exposure. Identify control gaps, such as unauthorized access, unmanaged endpoints, and misconfigured systems, before they are exploited.
• Cost optimization. Reclaim unused software licenses, retire end-of-life hardware, and eliminate redundant spend.
• Regulatory alignment. Demonstrate compliance with frameworks such as ISO 27001, NIST CSF, HIPAA, GDPR, or COBIT as applicable to your industry.
• Ownership clarity. Identify assets without a clear owner, a gap that creates both operational and security risk.
• Offboarding integrity. Confirm that access revocation procedures are working and that former employees no longer have active credentials or device assignments.

What does an IT internal audit cover?

A comprehensive IT internal audit spans multiple domains. Each domain addresses a different category of risk, and each requires its own evidence-gathering approach. No single domain takes priority over the others.

1. IT assets and hardware. The full inventory of physical and virtual assets: serial numbers, locations, responsible owners, lifecycle stages, warranty status, and end-of-life tracking. An asset no one knows exists is an asset no one is managing.

2. Software and licenses. Installations versus entitlements, shadow IT and unauthorized applications, vendor contracts and renewal dates, and underutilized licenses that are candidates for reclamation.

3. Access controls and user permissions. Who has access to what, and whether that access is still appropriate. This includes inactive accounts, former employees who retain credentials, users with local administrator privileges, and adherence to the least privilege principle.

4. IT policies and documentation. Formalized policies covering asset management, onboarding and offboarding, incident response, and business continuity, and evidence that those policies are actually followed, not just written.

5. Change Management controls. Whether IT changes are documented, reviewed, approved, and tested before deployment, and whether rollback procedures exist and are practiced.

6. Third-party and vendor controls. Active contracts, Service Level Agreement (SLA) obligations, compliance requirements placed on vendors, and contracts that have expired or are approaching renewal without a plan.

The IT internal audit process

An IT internal audit process follows a structured path to make sure the review is thorough and actionable. It begins with planning, moves through testing and analysis, and ends with documentation that management can act on.

1. Planning

Define the scope: which systems, assets, applications, and controls will be reviewed. Align audit objectives with business goals and regulatory requirements.

Identify key risks in IT operations, including data breaches, access issues, license compliance, and undocumented assets. Review findings from previous internal audits to track whether prior recommendations were implemented.

2. Fieldwork

Gather evidence through interviews, system reviews, and technical tests. This phase verifies whether controls are operating as intended and highlights gaps.

For asset and software evidence, a platform like InvGate Asset Management centralizes inventory, access data, and compliance status in one place, reducing the manual effort of pulling data from scattered sources. Teams evaluating their tooling options can find a comparison in this IT audit software guide.

3. Analysis

Evaluate the evidence collected against the audit criteria: applicable frameworks, internal policies, and regulatory requirements. Identify control weaknesses, compliance gaps, and areas of operational inefficiency. This step produces the raw material for the report.

4. Reporting

Summarize results in a clear IT audit report, detailing risks, control effectiveness, and actionable recommendations. The report should identify responsible parties and timelines for remediation. It becomes the primary reference for follow-up work.

5. Follow-up

A follow-up review confirms that remediation plans were implemented and that the control gaps identified are actually closed. This step is what separates a mature audit program from one that produces reports nobody acts on.

IT internal audit checklist

A flat list of items is hard to execute and harder to defend. The checklist below is organized by domain so audit teams can assign ownership, scope specific reviews, and present findings in a structure that maps to the actual risk categories external auditors use.

1. Audit planning

• Define scope, objectives, and success criteria for this audit cycle.
• Review findings from previous internal audits and confirm remediation status.
• Assign audit roles and responsibilities across IT, compliance, finance, and legal.
• Align scope with applicable regulatory frameworks: ISO 27001, NIST CSF, COBIT, HIPAA, GDPR, or others relevant to your industry.
• Establish evidence collection methods (system exports, interviews, direct review).
• Set timelines and communicate audit schedule to process owners.

2. IT asset and hardware inventory

Maintaining a complete, current hardware inventory is the foundation of any IT internal audit. Without it, every subsequent check, from software compliance to access controls, is built on unreliable data.

• Confirm a complete hardware inventory exists: serial numbers, make/model, location, assigned owner, lifecycle stage.
• Flag assets without an assigned owner.
• Validate warranty status and identify assets in end-of-life state.
• Reconcile inventory records against physical assets or network discovery data.
• Review chain of custody for hardware that has changed hands.
• Confirm disposal documentation for decommissioned equipment.

InvGate Asset Management centralizes hardware inventory with owner, location, and lifecycle data, and generates exportable reports with a few clicks. Discovery runs via agents and network scanning, so the inventory reflects actual environment state. The IT asset audit guide covers the full step-by-step process for auditing assets specifically.

3. Software and license compliance

• Audit software installations against licenses acquired (true-up analysis).
• Identify shadow IT and software installed without IT authorization.
• Review vendor contracts and upcoming renewal dates.
• Flag underutilized or unused licenses for potential reclamation.
• Confirm software versions and check for unsupported or end-of-life versions.
• Review software entitlements against deployment rights (per-seat, per-device, per-user).

The software license audit process covers this domain in full detail.

4. Access controls and user permissions

Access control gaps are among the most common findings in IT internal audits. They are also among the easiest to miss without a systematic review.

• Review active accounts against current employee roster and flag accounts belonging to former employees.
• Verify application of least privilege principle across systems and applications.
• Audit users with local administrator privileges.
• Review service accounts and shared credentials.
• Confirm offboarding procedures include timely revocation of all access.
• Check multi-factor authentication (MFA) enforcement on critical systems.

InvGate Asset Management includes native filters for assets with local privileged users and last logged user data, giving auditors a direct way to identify access anomalies without pulling data from multiple sources.

5. IT policies and documentation

• Confirm all IT policies are formalized, current, and version-controlled.
• Verify existence of an IT Asset Management (ITAM) policy and onboarding/offboarding procedures.
• Review incident response procedures and confirm they have been tested.
• Confirm business continuity and disaster recovery plans exist and are current.
• Validate that policy acknowledgment records exist for staff.

IT governance frameworks provide useful context for the standards that should inform these policies.

6. Change Management controls

• Verify that a formal change management process exists and is documented.
• Confirm all infrastructure and configuration changes in the review period were documented, approved, and tested.
• Review the change log for unauthorized or undocumented changes.
• Confirm rollback procedures exist and have been practiced.
• Check that emergency changes follow an expedited but documented process.

7. Vendor and Contract Management

• Review all active IT vendor contracts for currency and completeness.
• Confirm SLA terms and verify whether SLAs were met in the review period.
• Identify contracts that have expired or are within 90 days of renewal without a renewal decision.
• Review third-party compliance obligations and confirm vendors meet the security and compliance requirements your contracts specify.
• Document any vendor changes, such as acquisitions or product retirements, that may affect contract terms.

How to perform an IT internal audit with InvGate Asset Management

InvGate Asset Management: 5-minute demo

Most IT teams do not struggle with knowing what to audit. They struggle with having the data ready when it is time to audit. The challenge is maintaining an accurate, current view of all the IT assets across an environment that changes every day. Here is how InvGate Asset Management supports each phase of the audit process.

Want to see how it works in your environment? Start a 30-day free trial or contact sales to learn more.

1. Build a complete, auto-updated inventory

InvGate Asset Management offers multiple ways to populate the inventory: the InvGate Asset Management Agent, network discovery, integrations with platforms like Microsoft Intune, Jamf, AWS, and Azure, and manual import via CSV. All methods feed a single record, so hardware, software, and cloud resources live in the same place.

The inventory updates automatically as the environment changes. There is no manual refresh cycle, and no separate spreadsheet to maintain alongside the platform.

2. Track hardware through its full lifecycle

Every asset record includes general, financial, and operational data: acquisition cost, depreciation, warranty expiration, end-of-life date, location, and assigned owner. Teams can also define custom lifecycle stages for specific asset types.

This makes it possible to see not just where a device is today, but what it costs, when it expires, and what comes next.

3. Monitor hardware health

For devices running the InvGate Asset Management Agent, the platform evaluates hardware conditions and surfaces a status indicator on each asset profile: Safe, Warning, or Critical. The indicator also shows which condition or conditions triggered the status.

Teams can configure Health rules to monitor things like average CPU, RAM, or disk usage, disk encryption status, pending reboots, and time since the last agent update.

4. Detect and manage software

The Agent detects installed software across all managed devices and pulls installation data, usage, and costs. That information is compared against active vendor contracts to surface inconsistencies, such as installations without a valid license or licenses that are unused.

The Authorization Policies module complements this by letting IT teams classify software as approved, under review, or prohibited. Unauthorized installations are flagged automatically, giving auditors a documented record of what was detected and when.

Recommended reading

Centralize IT Vendors, Contracts, And Assets in One Platform

Read Article

5. Create and print QR codes for physical asset inspection

InvGate Asset Management generates QR codes for any asset in the inventory, whether IT or non-IT. Each code links directly to the asset's live record and can be printed individually or in bulk.

This is especially useful for devices that do not run an agent, such as monitors, peripherals, and networking equipment, where physical inspection is the only reliable way to verify presence and condition.

6. Configure automations

The platform includes native automations for common scenarios: stock minimum alerts, warranty expiration notifications, contract renewal reminders, and depreciation rule triggers. Teams can also build custom rules combining events, conditions, and actions for any process specific to their organization.

This keeps the team a step ahead of renewals and lifecycle transitions without anyone having to check a dashboard manually.

7. Reports and dashboards

InvGate Asset Management supports automated reports with custom criteria that are sent to the right people on a regular schedule. Teams can also build dashboards with charts for a quick read on the state of the IT ecosystem.

For an IT internal audit, a dashboard can be configured specifically around the indicators the audit covers, so the data is always visible and ready, not assembled on demand.

IT internal audit best practices

Treat audits as a continuous process, not an annual event. Point-in-time audits capture a snapshot. Continuous asset monitoring, regular access reviews, and quarterly checks on high-risk domains keep the organization audit-ready and surface issues before they compound.

1. Document findings and track remediation to closure. An audit report that sits in a folder is not a completed audit. Assign owners, set deadlines, and track remediation through to verification. A follow-up audit confirms the gaps are actually closed.

2. Align scope with the regulatory frameworks that apply to your industry. ISO 27001, NIST CSF, COBIT, HIPAA, and GDPR each have specific control requirements. Scoping audits against the relevant framework makes findings more actionable and the organization's compliance posture more defensible.

3. Use tools that maintain data between audit cycles. Manual inventory collection before every audit introduces error and lag. Tools that maintain a live, accurate view of assets, software, and configurations dramatically reduce the fieldwork burden and improve evidence quality.

4. Involve finance, legal, and security in planning. IT audits touch software contracts, data protection obligations, and risk management decisions that go beyond the IT department. Cross-functional involvement in planning produces better scope alignment and faster remediation decisions.

5. Keep prior audit findings in scope. One of the clearest signals of a mature audit program is that findings from previous cycles are reviewed and tracked, not treated as closed the moment a remediation plan is written.

Common IT internal audit challenges

Even well-run IT teams run into the same recurring obstacles when audit time arrives. Recognizing them in advance is half the battle.

1. Incomplete or outdated inventory. The audit starts with the inventory. If the asset database has not been updated since the last audit cycle, every subsequent check, from software compliance to access controls, is built on unreliable data. This is the most common reason audits take longer than planned.

2. Fragmented documentation. Data in spreadsheets, ownership information in email threads, contracts in a shared drive that no one fully controls. When evidence lives in disconnected systems, gathering it under audit pressure is slow, error-prone, and stressful. This is the scenario often called "audit panic," the rush to assemble documentation when an external auditor or vendor notification arrives.

3. No clear asset ownership. Assets without an assigned owner cannot be properly secured, maintained, or decommissioned. During an audit, unowned assets create ambiguity about who is responsible for their compliance status.

4. Shadow IT that was not detected. Unauthorized software and unmanaged devices are by definition invisible to manual inventory processes. Without automated discovery, shadow IT stays invisible until a vendor audit or security incident surfaces it.

5. No follow-through on prior findings. If remediation plans from the last audit were never completed, the same gaps will appear in this one. Recurring findings signal to external auditors that the internal audit function is not driving real change.

6. Audit scope that is too narrow. An IT internal audit that only covers one or two domains misses the hardware, access, policy, and vendor areas that external auditors will review. A narrow scope produces a false sense of readiness.

IT internal audit report

The audit report is the primary deliverable of the process. A well-structured report serves both as a management communication tool and as evidence of audit program maturity for external reviewers.

A complete IT internal audit report should include an executive summary with high-level findings and the most critical recommendations, written for stakeholders who will not read the full document. It should also cover scope and methodology, findings by domain with risk ratings, specific and actionable recommendations for each finding, responsible parties and remediation timelines, the status of prior audit findings, and an appendix with supporting evidence and data sources.

Reports should be shared with IT leadership, the compliance function, and where applicable, the audit committee or executive sponsor. Findings rated critical or high should have remediation timelines that are tracked, not just documented.

FAQs

What is an IT internal audit?

An IT internal audit is a structured review of an organization's IT systems, controls, assets, and processes, conducted internally to identify risks, verify compliance, and improve operational effectiveness before an external auditor or regulator steps in.

What does an IT internal audit include?

A complete IT internal audit covers hardware asset inventory, software and license compliance, access controls and user permissions, IT policies and documentation, change management controls, and vendor and contract management.

How often should an IT internal audit be performed?

Most organizations run a comprehensive IT internal audit once a year, with focused reviews on high-risk areas every quarter. Regulated industries may require more frequent reviews to meet compliance schedules.

What is the difference between an internal and external IT audit?

An internal audit is conducted by the organization's own team to improve controls and maintain readiness. An external audit is performed by regulators, vendors, or independent third parties, is typically mandatory, and focuses on proving compliance to outside stakeholders.

How do you prepare for an IT internal audit?

Preparation starts with maintaining a current, complete asset inventory, documenting IT policies and procedures, reviewing access controls, and tracking the remediation status of findings from prior audits. Teams that use asset management tools to maintain continuous visibility spend significantly less time in the evidence-gathering phase and arrive at audit time already prepared.