Riyadh | +966‑557400202 | hala@nazztec.com.saGlobalSaudi ArabiaEnglishالعربية
Audit & Assurance

Preparing for an IT Audit: A Checklist for IT and Security Leaders

Audits go badly when evidence is hunted for at the last minute. A practical checklist for IT general controls, evidence and the findings auditors raise most often.

4 min readNAZZTEC Editorial Team
Preparing for an IT Audit: A Checklist for IT and Security Leaders — cover illustration

Key takeaways

  • Agree scope, criteria and timetable with the auditor early.
  • Maintain an evidence library mapped to controls throughout the year.
  • IT general controls — access, change, operations — attract the most findings.
  • Respond to findings with root cause, owner and realistic dates.

Know the type of audit

  • Internal audit — independent assurance for management and the audit committee.
  • External financial audit — auditors rely on IT general controls supporting financial systems.
  • Certification audit — ISO 27001, ISO 22301, ISO 20000 and similar.
  • Regulatory review — NCA, SAMA, CST or sector regulators assessing compliance with their frameworks.
  • Customer audit — contractual rights to assess you as a supplier.

IT general controls auditors test

AreaTypical tests
Access managementJoiner/mover/leaver timeliness, privileged access, periodic reviews
Change managementApproval, testing, segregation of duties, emergency changes
IT operationsBackups, job monitoring, incident management
SecurityLogging, vulnerability management, endpoint protection
Third partiesSupplier assurance, contracts, access

The evidence library

Keep a structured repository where each control has its policy, procedure, owner and dated evidence. Samples auditors commonly request include user listings with review sign-offs, change tickets with approvals, backup logs with restore tests and incident records.

Pre-audit checklist

  • Confirm scope, criteria, period under review and sampling approach.
  • Nominate an audit coordinator and control owners.
  • Run a self-assessment against the criteria.
  • Close quick wins and document compensating controls.
  • Prepare system walkthroughs and data extracts.
  • Brief control owners on how to answer questions factually.

Most common findings

  • Leavers with active accounts beyond the agreed SLA
  • Access reviews performed but not evidenced, or not acted upon
  • Emergency changes without retrospective approval
  • Backup restores never tested
  • Policies out of date or not approved

Responding to findings

Agree the facts, identify root cause, assign an owner and set realistic dates. Track actions in a single register and report progress to the audit committee. Repeat findings damage credibility more than the original issue.

Building a year-round evidence calendar

MonthEvidence activity
MonthlyLeaver reconciliation, backup reports, vulnerability metrics
QuarterlyAccess reviews, policy exceptions, supplier reviews
Semi-annuallyRestore tests, incident exercises
AnnuallyPolicy reviews, risk assessment, DR test

Next step: our Audit & Assessment team runs pre-audit readiness reviews and regulator-ready assessments.

Frequently asked questions

How early should we start preparing?
Ideally evidence is maintained continuously. For a specific audit, start structured preparation six to eight weeks ahead.
Can we challenge an audit finding?
Yes, with evidence. Discuss draft findings factually before the final report is issued.
What is the difference between a gap assessment and an audit?
A gap assessment is advisory and identifies improvements; an audit provides independent assurance against defined criteria.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
Keep reading

More insights

Talk to the team behind this briefing

Tell us what you are working on. A senior NAZZTEC consultant will come back within one business day with a practical view.

Book a Free Consultation All insights

We respond to every enquiry within one business day.