Introduction — what an audit does (and doesn’t)
An independent IT audit gives your organisation a clear, vendor‑neutral view of what you run today, where the risks and inefficiencies really are, and a prioritised plan you can act on without adding complexity.
It doesn’t try to sell tools, force a one‑size‑fits‑all checklist, or drown decision‑makers in technical minutiae.
What you’ll get (outcomes)
- A condensed report in plain English (or French, you choose): risks, gaps, quick wins.
- A prioritised action plan balancing risk, impact, effort and cost.
- Pragmatic recommendations you can execute internally, with current suppliers or with new, more suited providers.
- Optional handover and lightweight governance if you prefer ongoing support.
How the audit runs (simple 4‑step flow)
Step 1: Initial Consultation (free, flexible video call)
A conversation to understand your organisation, goals and constraints. We’ll discuss what you’re running today, where pain points show up and which audit scope makes sense. Prior to the appointment, a mutual Non Disclosure Agreement can be signed to protect confidentiality.
- Format: 30‑minute video call (Teams/Zoom).
- Outcome: shared understanding, next step agreed (scope, inputs, scheduling).
- No obligation. No sales pitch.
Book your consultation → /contact
Step 2: Contract & Scope
We confirm scope, pricing, timeline, responsibilities, and the practicalities (access, data protection, stakeholder time).
- Pricing: fixed scope where feasible, or day‑rate with a cost cap.
- Timeline: scheduled around staff availability; remote when possible, on site when necessary.
- Access: read‑only and scoped; no privileged access required for assessment.
- Deliverables: report and prioritised action plan (risk, impact, effort, cost).
Confirm your scope and start date → /contact
Step 3: Audit Execution
We run a vendor‑neutral assessment. Remote‑first to minimise disruption; on‑site only when it adds real value (workshops, environment walk‑throughs). During the initial consultation, we will define together the scope that matches your situation. Here are some options we will discuss together:
PEOPLE
- Internal staff: who does what, strengths/skills, gaps, training needs.
- External providers: roles, accountability, service fit.
- End‑users: real needs, satisfaction, pain points and friction in daily work.
NETWORK
- Inter‑site connectivity, switching, LAN/VLAN/MAN/WAN.
- Wi‑Fi and remote access (VPN/portal).
- Internet links → read the guide Connectivity planning and failover
- Security and identity assessments → read the article Network segmentation checks we include and our guide to Connectivity planning and failover
Option: inspect services over IP (print, VoIP, CCTV/streaming, other critical services).
PLATFORM
- Servers and platforms (location, physical access, power/cooling).
- Logs, roles, capacity/right‑sizing, policies and standards.
- Cloud review: on‑prem virtualisation vs real cloud, governance and controls.
FINANCE
- Overall cost picture; cost‑per‑user; contracts, subscriptions, amortisation.
- Opportunities to reduce recurring spend without compromising reliability.
RESILIENCE
- Backup, continuity and recovery readiness → read the article Continuity objectives assessed in audits
- Restore procedures and tests.
SECURITY
- Access control and identity, internal policies/charter.
- External access paths; firewall/proxy posture; endpoint protection (AV/EDR).
Step 4: Report and Recommendations
You receive a concise report and prioritised action plan. Each action explains why it matters, what to do and who/what is affected.
- Executive summary (plain English or French, for decision‑makers).
- Prioritised plan (risk • business impact • effort • cost).
- Technical appendix (evidence, key configurations, diagrams where useful).
- Next steps can include:
- Delegated IT (lightweight governance and KPIs),
- Assistance with recruitment or team structure,
- Coordination with existing providers,
- Project support for migrations or fixes.
How we prioritise work (no jargon, just value)
We use a simple model that balances four dimensions:
- Risk: likelihood + impact if nothing changes.
- Business impact: how much the action helps users, service continuity, compliance or cost control.
- Effort: time/complexity for your team or provider.
- Cost: licences, services, or project effort.
What we avoid (by design)
- Vendor bias: no reseller targets, no hidden incentives.
- Intrusive scans unless requested and scheduled.
- Thick reports nobody reads: we keep it concise and actionable.
After the audit: 3 typical paths
- Execute internally: we remain available for clarifications.
- Coordinate with your providers: we validate decisions when needed.
- Delegate governance: retain us for lightweight, regular leadership → /delegated-it.
Frequently asked (short answers)
Will this disrupt operations? We schedule short sessions, remote‑first; on‑site only when it adds clear value.
How do you price? Fixed scope where feasible, or day‑rate with a cap; hybrid possible.
Can you work with existing suppliers? Yes, we stay vendor‑neutral and coordinate.
What do you need from us? Read‑only access, basic inventory, and a few stakeholder conversations.