In practice, IT audit services is bought by a business holding its systems to a control framework at the moments a program is most anxious and least able to say what it needs: before a license, before an examination, after a finding. The seller's value is judgement about what the regulator expects; the buyer's leverage is knowing the program in numbers first, because an engagement scoped from the register is smaller, cheaper and better than one scoped from a brochure. This page walks what to bring to IT audit services, what the engagement should change, what must come back at the end, and where the free sheets on this site work the program's own figures, with no account, so the first meeting starts from them.
What to bring
The register's numbers: obligations, controls per obligation, evidence items per control, minutes per item, reviewers and their hours. The obligations register sheet on this site returns the items, the hours and the months to a full attestation. For a business holding its systems to a control framework the record behind those numbers is the controls, the tests, the vulnerabilities, the incidents and the access reviews; bring it as a count, not a folder. A provider of IT audit services who can read the sheet and say which obligations are over-evidenced and which are bare has found the engagement's value in the first hour.
A service, monthly
A compliance service is bought monthly, and the month is mostly reminders and reports: evidence due, attestations due, cases aging, trainings outstanding. Ask what the service does in a month, and compare its month-end report with the sheets on this site worked from the program's own figures; if the outstanding lists are not shrinking, the service is not doing the job it was hired for.
Assurance and remediation cannot come from the same supplier
Whoever built or operates a control cannot provide independent assurance about it, and a monthly service that both fixes and audits has quietly dropped the independence you were buying. Small organizations resolve this two ways: buy the build from one firm and the audit from another, or keep the audit internal with a reviewer who did not do the work. Either is defensible and cheaper than discovering the conflict when a customer's auditor asks who tested what. Write which arrangement you have chosen into the register beside the control, because that is the question that gets asked.
What the engagement should change
The count of obligations actually owed, the controls that satisfy several at once, the evidence each control needs and no more, the audit days per year, the gap rate and the hours per gap. Each is an input to a sheet on this site, so the before and after of the engagement is a pair of worked sheets rather than a slide. For IT compliance the sheet to start with is the IT control-testing sheet. Ask for the before and after in that form; a provider who promises maturity rather than numbers is promising a feeling.
What must come back
The register, in a form the program keeps updating without the provider: obligations, controls, evidence templates, an audit plan the program can run itself next year, and the attestations with who signed them. A deliverable that lives only in the provider's portal is a subscription to the provider. The guide this page supports covers the questions for a regulatory compliance consultant in detail. Attestvio Pro keeps the register under the client's own name and exports it; the sheets stay free.
Questions people ask about IT audit services
What does IT audit services cost?
Providers quote after scoping and this site publishes no figure for them. The number that matters is the fee against the reviewer hours and audit days the engagement removes, which the free sheets on this site work from your own program.
How do I scope IT audit services?
From the register: obligations, controls, evidence items, reviewer hours and the months to attestation, worked on the free obligations register sheet and brought to the first meeting.
Does Attestvio provide IT audit services?
No. Attestvio is software that keeps the register, evidence and attestations and works the arithmetic; it gives no view on what a regulation requires. The sheets make any provider's engagement scoped and checkable.