When an IT internal audit begins, teams often gather documents before agreeing what each item is intended to demonstrate. The result can be a large folder that still leaves basic questions unanswered.
A better preparation method connects every evidence request to the control objective, review period and responsible owner. The approach below is an operational suggestion; the auditor determines the actual evidence and sampling needed for the engagement.
Describe who performs the activity, how often it occurs, what information is used and how exceptions are resolved. "Access is reviewed regularly" does not explain whether all relevant users are covered or whether identified removals happen.
For a periodic access review, identify the systems, the population date, the reviewers and the completion record. Include how changes arising from the review were followed through.
If you provide an export, explain its source, filters, extraction date and period covered. Keep evidence of how completeness was established where relevant. An unexplained spreadsheet makes it difficult to know what is missing.
Agree any sensitive-data handling arrangements with the audit team. Provide the information required for the objective through the approved channel, rather than placing unnecessary personal or production data in an unrestricted folder.
A finding in a control review does not automatically mean the review failed. The important questions include whether the issue was recognised, assessed and acted on appropriately.
Keep the original observation, decision, action and completion evidence linked. Do not replace the initial record with a polished version that hides the sequence.
| Index field | Purpose |
|---|---|
| Control and owner | Explains responsibility and the expected activity |
| Period and population | Shows what the evidence covers |
| Evidence reference | Makes the supporting record retrievable |
| Exceptions and response | Explains departures and their treatment |
| Limitations | Makes gaps in coverage explicit |
Ask someone outside the process to follow an access removal or production change from start to finish. If they cannot identify the approval, action and review, clarify the evidence structure before sending the pack.
Do not create retrospective records that pretend an activity happened earlier. If evidence is missing, explain that honestly and agree how the gap will be assessed.
ProtectifyAI supports IT internal audit and technology assurance. A focused scoping discussion can establish which controls matter most and what evidence will make the review efficient.
It should contain the audit scope and criteria, control owners, sampled evidence, interviews, findings, risk ratings, management responses and corrective-action tracking.
Sample size should be risk-based and sufficient to test whether the control is designed and operating consistently; one convenient example rarely supports a strong conclusion.
Independence should be protected. If the same team built the controls, use a suitably independent reviewer or clearly disclose and manage the limitation.
Bring your evidence structure to a scoping discussion and we'll help you close the gaps before fieldwork.
Book a working session →