Most companies order an IT audit in one of two situations: somebody outside demands a document, or a decision worth several hundred thousand is due and nobody can say what the company actually runs. An audit fixes nothing by itself, but without one you end up fixing what is most visible rather than what hurts most.
Before you read on: our free preliminary review is not the same thing as an audit, and it is usually enough. Below we set out how they differ and when paying more genuinely makes sense, because that is the first question we get. Fixing what turns up lives on separate pages: security, backups, the network and ongoing IT support. When an industry is not among those described here, we start from the four differentiating questions and only then from the hardware.
Almost everyone who lands here asks this, because we offer the free review across the whole site. The difference is not one of quality but of depth, and of whether a document is produced that you can show to somebody.
Thirty minutes on what you have and what gets in the way, plus a look at whatever is visible from outside. Within one working day you get a single page: risks ordered by urgency, each with the consequence and a price range for fixing it. No NDA, no commitment, and it stays with you even if we go no further.
We go into the systems, review configurations, collect data from devices and talk to the people who work on them. The result is a signed report you can point to in a contract, in a security questionnaire or in front of a board. It is paid and quoted up front, because it takes from a few days to a few weeks.
If you order a remediation project from us within sixty days of the audit, we take its price off the value of that project. The point is that the audit should not be a separate cost to justify, while still being something you can buy on its own and implement with anyone.
For most companies up to twenty or thirty workstations the free review is enough, and we say so plainly instead of selling an audit to everyone who asks. A full audit makes sense when a document is needed for somebody outside, or when the environment is large enough that a conversation and a glance will not support any responsible conclusion. In such a review we are mainly interested in four questions: which program is irreplaceable, when it must not be touched, which regulations reach you and which data may not leave the building.
Four reasons companies come to us. They share one thing: a decision or a deadline where you need to know rather than assume.
Changing IT firms without recording the state on day one ends with every failure six months later turning into an argument about whether we found it broken. An audit at the start protects both sides, and along the way it surfaces passwords nobody has and services still billed to a former employee card.
A larger client sends a questionnaire, an insurer asks about controls before issuing a policy, and the new cybersecurity rules require you to show somebody is in charge. In each case what is needed is a dated document, not an assurance that everything works.
Before replacing servers, moving to the cloud or rolling out a new system, it is worth knowing what the real bottleneck is. The most common scene we meet is a company ready to buy a more powerful server when the problem is a disk in the array or one badly written database query.
One admin or one friendly contractor held the whole thing in their head and stopped answering the phone. An audit is then simply the reconstruction of that knowledge: what stands where, what it connects to, who has access and what the company pays for every month.
There is also a case where we advise against an audit: when it is already clear what is broken and the money stretches either to the diagnosis or to the repair. Then repair it. We do end conversations with the line that an audit would be spending at the wrong time for you, and we treat that as a normal part of this service. Another reason is a client security questionnaire, and the firms that bring us those most often are software houses selling to large companies.
The worst possible outcome of an audit is a fat document nobody reads and nothing follows from. So the report has three parts and each answers a different question.
What we found, ordered by what can hurt soonest rather than by technical area. Each item carries a short note on the consequence and a price range for fixing it, so that a budget can be built from it rather than just a list of objections.
What stands where, how it is connected, who holds which access, which contracts and subscriptions are running and when vendor support ends. Companies often value this part above the recommendations, because it usually exists nowhere except in somebody memory.
The fixes laid out over time, separating what has to happen now from what can safely wait for the next hardware refresh. Without that an audit turns into a wish list for which there is never a simultaneous budget.
Honestly about the conflict of interest: the audit is done by a firm that may then want to sell the implementation, and that is a real risk worth keeping in mind with any provider. We handle it by writing reports that describe the problem and the available routes rather than a specific quote, and by leaving the document with you in full, so you can price it with anyone. Where something works well, we write that it works well. A list where everything is red usually says more about the seller than about the company.
Six areas we go through every time. Under each description there is a link to the page about fixing that area, because an audit ends where the work begins.
The age and load of the machines, the state of the disks, system versions and the dates vendor support ends. This is where we most often find hardware running out of warranty for two years that everyone had forgotten about.
Throughput, cabling quality, wireless coverage and whatever is exposed to the outside. Complaints about slow internet turn out surprisingly often to be a problem with one switch or one cable.
Accounts, permissions, second login factor, the state of endpoint protection and the access held by outside firms. We almost always find active accounts belonging to people who left the company long ago.
Not whether a backup is switched on, but whether anybody has ever come back from one and how many hours it took. If nobody has tried, we record that as the first finding in the report.
What the company actually holds against what it uses, and what it pays for with no reason. This is the one area where an audit can pay for itself before anything is repaired at all.
Every recurring charge in one place: links, hosting, subscriptions, service and hardware on instalments, together with the notice dates nobody usually remembers.
What we do not do: penetration tests with a report for an external auditor, or a legal GDPR compliance audit. The first we commission from a specialist team when it turns out to be needed, the second belongs to a law firm. We do check the technical side of what the national cybersecurity act and a typical client questionnaire ask about.
Four stages. We work remotely where we can and on site where somebody has to look inside the rack.
A conversation about why you want the audit and who it is for, because an audit for an insurer looks different from one before replacing a server room. Out of that comes the scope and the price, both up front, before anything begins.
Access, configurations, readings from devices and a visit to the server room and network points. We work so as not to hold people up, and we keep conversations with the team to about fifteen minutes per person.
Before writing the report we take the findings back to whoever runs IT, to check we have not misread something. A few things usually have an explanation that the configuration does not show.
We hand over the document and go through it with you point by point, usually in an hour. We would rather the decisions were made by someone who understands what is on the list than have the report reach a drawer after the first paragraph.
The pages people move on to after an audit.
It depends on the size of the environment and on who the report is for, so we give the price up front once the scope is set rather than as a range on a web page. The reference point is this: the preliminary review is free, and the price of a full audit comes off a remediation project ordered from us within sixty days.
From a few days in a small environment to a few weeks in a large one. It does not stop work, because most of it runs on reading configurations and remote access, apart from a visit to the server room and network points. From the team we usually need about fifteen minutes each, and that is the whole cost on your side.
Not to everything, but without access to configuration an audit turns into an interview, and then it may as well stay a free review. We work with read-only accounts wherever those suffice, we sign a confidentiality agreement and record what we were given, and the access is revoked when we finish.
That is not the purpose, and we say so at the start, because whether anyone talks to us honestly depends on it. Most of what we find comes from a shortage of time and budget rather than anyone incompetence. The report describes the state of the environment, it does not appraise people, and the best audits happen in companies where the in-house admin treats us as backing for arguments they have been making for two years.
No. The report stays with you in full, describing the problems and the available routes, so it can be priced with any contractor or implemented in-house. Deducting the audit price from a remediation project is an incentive, not a condition, and some clients order only the audit and leave it at that.
We do the technical part: who has access to the data, how it is protected, whether it can be restored and whether it is visible who did what. The legal assessment, meaning the grounds for processing, records of activities and processing agreements, belongs to a law firm or a data protection officer, and we do not pretend it is our field.
At that size the free review is usually enough and that is normally what we advise. A full audit starts to make sense once there is a server room of your own, several locations, shift work or a requirement from a client. If the conversation suggests an audit would be overkill for you, we will say so rather than take the order.
That is a result too, and it happens more often than the industry suggests. The report then states that the environment is in order, sets out the end-of-support dates for hardware and systems and says what to watch over the coming year. For a company that has to show something to a client or an insurer, such a document is worth exactly the same.
The first meeting takes 30 minutes and commits you to nothing. We will tell you straight whether we can help and what we would propose.
2019 - 2024 Interactive Workspace Ltd. - All rights reserved.