IT Audit Checklist for Small Business, With a Report Template

An IT audit checklist for a small business covers who holds admin access, what devices and software you own and whether they are still supported, whether backups actually restore, what you pay for against what you use, which vendors hold your data, whether anyone would notice an attack, and whether evidence exists for each answer. Work through it with read-only access, write down what you saw and where, and turn every gap into a dated fix with an owner.

This is the checklist behind our IT audit services, where findings are grouped under the six functions of NIST CSF 2.0 so anyone can check the report against a public framework. It is an operational review, not a SOC 2 report, a certification or a financial audit. If you want a shorter list of security basics to fix this month, start with our small business cybersecurity checklist.

Which areas does an IT audit checklist cover?

Seven areas, each answering a question an owner should be able to answer without calling the IT provider:

How do you audit admin access and accounts?

How do you audit devices, software and lifecycle?

How do you audit backups and recovery?

CISA's ransomware guide sets the standard to measure against: keep offline, encrypted backups of critical data and regularly test their availability and integrity in a disaster recovery scenario. A backup job that reports success is not a tested restore.

How do you audit licensing, vendors and contracts?

How do you audit monitoring, response and documentation?

Which framework should an IT audit follow?

For a small business, NIST CSF 2.0 is the most practical frame. It groups outcomes into six functions, Govern, Identify, Protect, Detect, Respond and Recover, and its categories map neatly onto the checklist: asset management (ID.AM) for inventory, identity management, authentication and access control (PR.AA) for accounts, cybersecurity supply chain risk management (GV.SC) for vendors, and incident recovery plan execution (RC.RP) for restores. CISA's Cross-Sector Cybersecurity Performance Goals, now in version 2.0 and aligned to the same functions, offer a short set of high-impact practices that small and medium-sized organizations can start with.

If you run an ISO 27001 management system, its internal audit under clause 9.2 covers the whole system, and ISO 19011:2026 gives guidance on managing audit programmes; our ISO 27001 checklist includes an internal audit checklist.

What goes in an IT audit report?

A report that cannot be acted on is a filing exercise. Use this structure:

Here is an illustrative findings table for a fictional 30-person office. It describes no client and no real result.

How do findings become a remediation plan?

1. Rank by risk, then effort. Fix high-risk, low-effort items first, such as a former employee's admin role.
2. Give every finding one owner and a date. A finding owned by everyone is owned by no one.
3. Group the work into 30, 90 and 365 days, so the budget for larger items can be planned.
4. Retest each fix and save the new evidence next to the original finding.
5. Run the checklist again each year, and after a provider change, an office move or a major system change.

What does NetSys review in an IT audit?

With your written authorization we ask for read-only administrator access, or a supervised screen-share, to your Microsoft 365 or Google Workspace tenant, firewall, backup console, device management tools and ticketing system. We review consoles, logs and exports, interview staff, and test a restore where you authorize one. Draft findings come to you for a fact check before the report is final, and the report is yours, written so your current provider, your staff or NetSys can act on it. There is no obligation to move your support to us. NetSys is not a CPA firm or a certification body, and this audit does not replace a formal audit or certification. A security risk assessment, which asks how an attacker would get in, is a separate scope.

Want a second opinion on what you pay for? Book a call and tell us your user count, locations and what prompted the question.

Frequently asked questions

What does an IT audit checklist cover?

Admin access and accounts, devices and software lifecycle, backup and recovery, licensing, vendors and contracts, monitoring and incident response, and documentation. Each check names how to verify it and the evidence to keep, so another person can confirm the result later.

Who should maintain the IT audit checklist?

A named owner in the business, usually the owner, the operations lead or a controller, keeps the checklist and the findings log. The IT provider supplies evidence and carries out fixes, but the business should own the list, because some findings are about the provider.

How do we validate the result of an IT audit?

Every finding should point to evidence someone else can re-check: a dated export, a report or a screenshot from the system itself. Retest each fix and save the new evidence beside the finding. Where it matters most, such as backups, prove it by restoring data, not by reading a status page.

How often should a small business do an IT audit?

Once a year is a sensible baseline, plus whenever something big changes: a new IT provider, a contract renewal, an office move, a cyber insurance application or the departure of the one person who knew how everything connects.

Is an IT audit the same as a SOC 2 audit?

No. A SOC 2 report is an attestation issued by a CPA firm. An IT audit is an operational review of your environment and your provider's work. It can help you prepare for formal audits, but it does not replace one.

Can we use this as an IT audit template in Excel?

Yes. Copy each checklist table into its own tab, add columns for status, owner and date, and use the findings table as the first tab. Keep the evidence files in a folder named by finding ID so the spreadsheet stays light.

Sources and further reading

• NIST: The Cybersecurity Framework (CSF) 2.0, February 26, 2024: the six functions and their categories, checked October 2026.
• CISA: Cross-Sector Cybersecurity Performance Goals 2.0: voluntary baseline practices aligned to CSF 2.0, checked October 2026.
• CISA #StopRansomware Guide (September 2023): offline, encrypted backups and restore testing, checked October 2026.
• Microsoft Lifecycle: Windows 10 Home and Pro: end of support on October 14, 2025, checked October 2026.
• ISO 19011:2026, Guidelines for auditing management systems, checked October 2026.