IT audit services
Understand your technology before investing in more of it
A structured assessment of your users, access, email, devices, backups and vendors — delivered as findings, risks and a prioritised roadmap you can act on with or without us.
For companies who suspect something is wrong with their technology but cannot yet say what, or where the risk actually sits.
- Deliverable
- A written report, not a sales conversation
- Commitment
- Standalone work — no obligation to continue
- Scope
- Agreed in writing before the audit starts
| Low impact | Medium impact | High impact | |
|---|---|---|---|
| Likely | Monitor | Schedule | Act now |
| Possible | Accept | Monitor | Schedule |
| Unlikely | Accept | Accept | Monitor |
Independent by design
The audit is a deliverable in its own right. You can act on it internally, with another provider, or with us.
Evidence, not opinion
Findings reference what was observed in your environment, so each one can be verified.
Prioritised, not exhaustive
A list of 80 issues is not useful. Findings are ranked by risk and business impact.
The business problem
Most technology spending decisions are made without knowing the current state.
A new tool gets bought to solve a problem nobody has measured. A security concern gets raised and nobody can say whether it applies. Meanwhile former employees still have access somewhere, the backups have never been restored as a test, and the only person who knows how the domain is configured left last year.
Unknown current state
Nobody can produce a list of systems, accounts and who has access to what.
Risk that is felt, not measured
A general sense that something is exposed, with no way to prioritise it.
Spending on the wrong layer
New software bought while the underlying access and backup problems remain.
Single points of failure
One person holds the knowledge, and there is no documentation behind them.
Vendor sprawl
Domains, hosting, email, devices and connectivity spread across providers nobody tracks.
Unverified backups
Backups configured at some point and never tested against an actual restore.
Audit areas
What gets reviewed.
The audit covers the areas below. Scope is confirmed in writing before we start, and anything excluded is stated rather than left ambiguous.
Identity and access
- Users and accounts
- Access levels and privileges
- Former employee access
- Multi-factor authentication
- Shared credentials
Systems and data
- Email configuration and security
- Devices and endpoints
- Cloud storage and sharing
- Backups and restore testing
- Existing software inventory
Infrastructure and risk
- Domains and DNS
- Connectivity
- Security configuration
- Documentation
- Vendor dependencies
- Operational risks
Deliverables
What you receive.
Five documents, written for two audiences: a summary a non-technical owner can act on, and detail a technical person can implement.
Current-state assessment
An inventory of systems, accounts, devices, vendors and how they are configured today.
Risk summary
What is exposed, what it would affect, and what the realistic consequence would be.
Priority matrix
Findings placed by likelihood and business impact, so sequencing is not a matter of opinion.
Recommended improvements
Specific actions per finding, with the effort and dependency for each one stated.
Technology roadmap
A sequence over the coming quarters, separating what to fix now from what to plan for.
Handover walkthrough
A session to go through the findings, so the report is understood rather than filed.
The report
What the document actually looks like.
Every finding is written the same way: what was observed, why it matters, what the risk is, and what to do. No finding is included without a recommendation, and no recommendation is included without a reason.
Written for the decision maker
The summary is readable by an owner or director without translation from a technical person.
Yours to keep
The report and its inventory belong to you, including if you never work with us again.
- 1. Executive summary Non-technical
- 2. Current-state inventory Systems and accounts
- 3. Findings by area Evidence and impact
- 4. Risk and priority matrix Ranked
- 5. Recommended actions With effort estimates
- 6. Technology roadmap Sequenced by quarter
- 7. Appendix Configuration detail
Fit
Who this service is for.
A good fit when
- You are considering managed IT and want to know the current state before committing.
- A security or compliance question has been raised and you need a factual answer.
- IT has been handled informally for years and nobody has documented it.
- You are about to invest in new systems and want to sequence it sensibly.
- A key technical person is leaving, or has already left.
Probably not the right service when
- You already know the problem and simply need it fixed — that is a project or managed service.
- You need a formal regulatory certification; an audit informs that work but does not replace a certifying body.
Process
How an audit runs.
Scope
We agree what is in and out, what access is required, and what the deliverables will be.
Discovery
Interviews with the people who use and manage the systems, and read-only review of configuration.
Analysis
Findings are documented with evidence, then ranked by likelihood and business impact.
Report
The five deliverables are written and reviewed internally before they reach you.
Walkthrough
A session to go through findings and priorities, and to answer the questions the report raises.
Engagement models
How this is contracted.
Standalone audit
A one-off assessment with a fixed scope and a fixed set of deliverables.
- No recurring commitment
- Report is yours to use
- Best before any decision
Audit then remediation
The audit first, then a separate quoted project for the fixes you approve.
- Findings priced individually
- You choose what proceeds
- Best when problems are expected
Audit into managed IT
The audit becomes the onboarding baseline for continuing coverage.
- No duplicate discovery
- Scope built from findings
- Best when you already want a provider
Why ZitDevs
How we keep the audit credible.
No manufactured urgency
Findings are ranked honestly. Where something is low risk, the report says so instead of inflating it.
No obligation attached
Recommending ourselves for remediation is optional, and the report is written so another provider could execute it.
Read-only where possible
Discovery uses read access wherever it can, and any change is agreed before it is made.
Confidentiality first
Terms are agreed in writing before discovery, and access is limited to the people performing the audit.
FAQ
Questions about IT audits.
Answers are written for this service. Where a figure depends on your situation, we say so instead of publishing an average.
What is an IT audit?
A structured review of the technology a business depends on — users and access, email, devices, cloud storage, domains, connectivity, backups, security configuration, documentation and vendor dependencies — delivered as findings, ranked risks and a prioritised roadmap.
How long does an audit take?
It depends on the number of users, systems and vendors, and on how much documentation already exists. We give a duration with the scope, before starting, rather than publishing an average that may not apply to you.
Do we have to give you administrative access?
Where full review requires it, yes, and it is agreed in writing beforehand. Wherever read-only access is sufficient, that is what we ask for. Any change to your environment during the audit is proposed and approved first.
Is this a cybersecurity audit?
It includes a security assessment of configuration, access and email protection, which is what most businesses need first. It is not a penetration test or a regulatory certification; if you need either, we will say so and scope it separately.
Can you audit Microsoft 365 or Google Workspace specifically?
Yes. A platform-specific audit covering users, licences, groups, sharing, mail flow, security settings and retention can be scoped on its own.
Are we obliged to hire ZitDevs afterwards?
No. The audit is standalone work. The report is written so that your own team or another provider can implement it.
Who reads the report?
It is written for two audiences: an executive summary for the owner or director, and detailed findings for whoever will implement them.
What if you find something serious?
Anything urgent is raised as soon as it is found rather than held back for the report, along with what we recommend doing immediately.
Find out what you are actually running.
Tell us how many people you have and which platforms you use. We will come back with an audit scope, duration and the deliverables you would receive.
The form is preselected for IT audits and asks about your platforms and team size.