Client one-pager, information systems audit

Information systems audit — what it is and why you need it

What it is. An IS audit examines the controls around the systems your business depends on: who has access and whether that access is still appropriate, how changes get into production, whether backups work when tested, how incidents are handled, and whether the system's own records can be trusted. Some of our clients need one because a regulator requires it; others because the business has outgrown the point where the IT manager can hold it all in their head.

What we need from you. A list of your applications and who owns each; user access lists with roles, and the joiner and leaver records for the period; your change management log; your backup policy and the last restoration test; your incident register; your password and access policies as configured, not as written; and contracts with any hosting or software provider. We also need your IT team's time — typically [two to three] hours a day while we are on site.