Guide · Systems audit
What a free IT systems audit should check
An IT audit is a one-time look at everything your company runs on, to find what is risky, broken or wasting money. This is the checklist we use, so you can judge any audit, ours included.
1. A list of everything you own
Most small companies cannot say how many domains, websites, cloud accounts, code repositories and paid subscriptions they have. An audit starts by writing that list. Everything after it depends on it, and the list alone is often the most useful thing you get.
2. Who can get in
- Two-step sign-in. Is it on for every account, or only for some people?
- Admin rights. How many people can change anything, and do they need to?
- Former staff. Are there still working accounts for people who left?
- Secrets in code. Passwords and keys left in a repository are a common way in.
- Open doors. Servers listening on ports that should be closed, and software with known fixes not yet installed.
3. Email and domain protection
Check that your domain publishes SPF, DKIM and DMARC records, and that nothing important is about to expire: the domain registration, the website certificate, the DNS provider account. Our guide to SPF, DKIM and DMARC explains what those three records do and how to read them.
4. Backups, tested
Knowing a backup exists is not enough. A good audit asks where each backup lives, how old the newest one is, and whether someone has restored from it into a separate place and confirmed the data is usable. A backup nobody has restored is a hope, not a backup.
5. Uptime and speed
Do your websites and services answer, from outside your network, at the times customers need them? Are pages slow enough to cost you visitors? Are errors being logged and read?
6. Money going out
Cloud servers nobody uses, machines far larger than the load needs, software seats for people who left. Each can be priced per month, and cutting them often covers part of what the audit would have cost.
7. A report you can act on
Findings should be ranked (red, amber, green), each with what it means for the business, what to do, and what it costs. A list of 200 technical warnings with no order is not an audit. You should finish with a short plan for the next 90 days.
What a good audit does not do
- It does not change your systems. Looking and fixing are separate steps, and fixes need your approval.
- It does not ask for more access than it needs. Read-only is enough to look.
- It does not lock you in. You should keep the report whether or not you hire the auditor.
Olodu's free audit
Olodu's free 7-day systems audit follows this checklist. It is read-only and needs no card or contract. You get a red/amber/green report with costs attached, and we offer to fix three items with your OK.