In practice, a it controls audit is a list of things to check and a number of days to check them in, and the second is decided by the first long before anyone opens the list. For a business holding its systems to a control framework, the checks run over the controls, the tests, the vulnerabilities, the incidents and the access reviews; every item is a sample to take, minutes to spend and a chance of a gap that costs hours to close. The compliance officer who works those figures before the audit is scoped budgets the audit and its aftermath together; the one who does not learns the aftermath's cost from the invoice. This page walks what a it controls audit covers, how to size its days, its expected gaps and its all-in cost, and where the free sheets on this site do that sizing from the program's own numbers, with no account.
What a it controls audit covers
For a business holding its systems to a control framework: the controls, the tests, the vulnerabilities, the incidents and the access reviews. Each is a control with evidence behind it, and a checklist is the list of controls with a sample size and a minutes-per-sample figure attached whether or not anyone wrote them down. The audit scope sheet on this site takes systems, controls, samples and minutes and returns the samples, the hours, the days and the coverage the days available give, so the checklist has a size before it has a date.
Gaps, remediation and the all-in cost
An audit finds gaps at a rate the last audit already measured, and every gap costs remediation hours. The audit sheets on this site for HIPAA, GDPR and PCI, and the IT control-testing sheet for a framework, take the item count, the gap rate, the hours per gap and the hourly cost and return the gaps expected, the remediation hours and the cost with the aftermath in it. For IT compliance the sheet to start with is the IT control-testing sheet. None of them publishes a benchmark rate; each works the program's own.
Sox it general controls, and what an ITGC walkthrough tests
General controls are the ones the application controls rely on, and the walkthrough follows four of them: who can get into the system and how that access was granted and removed, how a change reached production, how the jobs and interfaces that move data are monitored and recovered, and how the underlying operations are run. The reason they are tested first is dependency: if access is not controlled, no report the application produces can be relied on, so an exception here reaches every control above it. For a small finance stack the evidence is mostly already written by the tooling, and the work is showing that somebody reviewed it on a schedule.
What to do with the number
Take it to the budget conversation and to the consultant's proposal. A proposal whose audit days land far from the sheet's is sampling more or less than the program needs, and a budget that covers the assessment and not the remediation is half a budget. The guide this page supports covers the questions for a regulatory compliance consultant. Attestvio Pro keeps every audit with its findings and their remediation against the obligations it tested; the sheets stay free.
Why the search is it controls audit
The words in it controls audit are the words a business holding its systems to a control framework uses when the obligation has a name and the program does not yet have a number. The name is the regulator's, linked below; the number is the program's own, and it is the count of obligations, controls and evidence items behind IT compliance turned into reviewer hours on the obligations register sheet and into audit days on the audit scope sheet. A program that searches it controls audit and comes away with those two figures has done the first day of the work, and the paid plan on this site keeps what follows: the record, with owners, dates and the attestation that closes each period.
The change management controls sox asks for, and the evidence each leaves
Authorization before the work, a review by somebody other than the author, testing appropriate to the change, approval to release, and a record of what went live when. Each leaves a trace the tooling already writes, so the cheap version of this is to make the trace the evidence rather than writing a parallel form. What fieldwork finds is the change that skipped the path: an emergency fix applied directly, a configuration altered in a console, a report definition edited by the person who requested it. Write the emergency route into the policy with a mandatory record after the fact, and the sample stops producing exceptions.
Change management risks and controls, seen from the audit's sample
The risk is that something reaches production which nobody with the authority to say so agreed to, or which nobody other than its author looked at. The controls are the separation of those two people and the record that both happened. Fieldwork does not read the policy for this; it takes a set of changes from the period and follows each one back, so the control is only as good as the weakest change in the population. That is why a program with a clean policy and one unrecorded console edit reads worse than a program with a rough policy that everybody follows.
Questions people ask about it controls audit
How long does a it controls audit take?
Items times minutes over 60 for the hours, over the hours in an audit day for the days: the audit scope sheet on this site works it from your own systems, controls, samples and minutes with no account, and publishes no benchmark.
What does a it controls audit cost all in?
Assessment hours plus the expected gaps times the remediation hours per gap, times the hourly cost. The audit sheets on this site work it from your own gap rate; the worked examples run from $8,800 to $19,720 for the sizes entered.
Does Attestvio run the it controls audit?
No. Attestvio sizes it and keeps the findings and their remediation against the obligations; the audit itself is your assessor's or your own team's. The sheets are free either way.