IT audit of a company: What it is and why you need it

Do you know the state of your company's IT infrastructure? Do you have an overview of all devices, licenses and security risks? If not, it is time for an IT audit. This is not bureaucracy. It is a practical tool that protects you from unpleasant surprises.

What is an IT audit

An IT audit is a systematic check of the company's entire IT infrastructure. The technician inspects all computers, servers, networks, software licences, backups, security and processes. The result is a report with specific findings and recommendations, ranked by priority.

This is not a one-off event but a regular process. Just as you attend medical check-ups, your IT infrastructure also requires regular inspections.

What an IT audit includes

Hardware and equipment

• Inventory of all desktop computers, laptops, servers, printers and network devices.
• Age and condition of hardware: which computers have reached the end of their service life?
• Compatibility with current operating systems.
• Drive and chassis condition: predicting faults before they occur.

Software and licences

• Overview of installed software on all stations.
• Licence check, have you paid for everything? Are you using any licences unnecessarily?
• Software version: are they updated?
• Unauthorised software: has something been installed that does not belong there?

Sit and connectivity

• Site topology: how is everything connected?
• Quality and speed of internet connection.
• Wi-Fi coverage and security.
• Firewall and its configuration.

Safety

• Antiviral protection: is it active and updated on all units?
• Password management, do employees use strong passwords? Is two-factor authentication enabled?
• Access rights: who has access to what?
• SPF, DKIM and DMARC for email domains.

Deposits and recovery

• Are deposits required? Where are they paid?
• How often should they be cleaned?
• Have deposits ever been tested by restoration?
• Is there a disaster recovery plan?

Typical findings of an IT audit

From our experience, the most common findings are in small businesses:

• Outdated systems: Windows without the latest security patches, outdated antivirus software.
• Missing or untested backups: The company assumes that deposits are being paid, but no one verifies this.
• Weak passwords and no 2FA: Password "firma123" for the shared account on all computers.
• Unassigned access rights: Former employees still have access to company systems.
• Missing documentation: No one knows where the server passwords are or who holds the keys to the server room.
• Outdated hardware: Computers older than 6 years that are slow and unreliable.
• Unused licences: The company pays for software that nobody uses.

How to prioritise correctly

A quality IT audit categorises findings by severity:

• Critical: Immediate threat, missing backups, open RDP port on the internet, admin account without a password. Address immediately.
• High: Significant risk, outdated systems, weak passwords. Resolve within 30 days.
• Medium: Room for improvement, missing monitoring, unused licences. Address within 90 days.
• Low: Recommendations for improvement, hardware upgrade, site optimisation. Plan for the budget.

How often to carry out an IT audit

We recommend carrying out an IT audit:

• Once a year: Complete audit of the entire infrastructure.
• When changing your IT supplier: A new supplier should begin with an audit to understand what they are working with.
• Following a safety incident: Determine what happened and how to prevent it in the future.
• Before major changes: Migration to the cloud, office relocation, merger with another company.

Cost and duration of an audit

For a company with 10-20 computers, a basic IT audit takes 1-2 days. The final report is typically ready within a week. Costs range from 5 000 to 20 000 Kč depending on the scope. This represents a fraction of the expenses you will save thanks to early problem detection.

Summary

An IT audit is not bureaucracy or an unnecessary expense. It is an investment in the stability and security of your company. It reveals problems before they cause damage and provides you with a clear plan of what to improve and in what order.