How we work
IT audit process: from the first meeting to the report with evidence
Five steps, the same in every review. Before we start you know in writing what is reviewed, what is left out and when it is delivered.
Updated on Reviewed by José María Salido
30-minute meeting
You tell us what you have running and what worries you. We look at what to review first.
Scope and timeline in writing
You get a document with the systems and checks that are included, what is left out and the delivery date. Nothing is added without your approval.
Read-only access
You give us read-only access to what is listed in the scope: the repository (where the code lives), the server or the platform.
Expert review
An automated AI tool goes through the known review points. Then senior developers verify every finding, discard the false ones and rank the real ones by impact. AI has a lot of data; the knowledge belongs to people, and they are the ones who verify, direct and review the systems.
Report and results meeting
Every finding with its evidence and its priority, explained to your team in a meeting, and a one-page summary for leadership.
What we need from your team for the IT audit
- The repository or the URL of what needs reviewing
- Read-only access to the systems in scope
- One person on your team to answer questions
- Your written approval of the scope, before we start
Confidentiality and access
- We work with read-only access: the review looks and measures
- We only enter the systems listed in the written scope
- We change nothing in production without your approval
What happens after the report
The fix is separate and only if you ask. Your team can apply it with the list and the evidence, or another provider can, or we can. We recommend repeating the review every three months: it is compared with the previous one and you see what changed.
Start with a single system
The first review covers one system: the one about to go to production or the one that worries you most. Scope and timeline are fixed in writing before we start.
One system
Reviewed end to end: code, architecture, data, server and monitoring. You get its state on one page and the list of what to fix first.
Everything built with AI
If you want to go on, the 360 review: the same method and the same report for each system, and a single page for leadership.
Every quarter
Your systems change every week. The review is repeated every three months and compared with the previous one: you see what was closed and what is new.
You move to the next step only if you want to.
Two free resources for before the meeting
The sample report shows what you receive. The checklist lets you see for yourself whether what your team has built with AI is ready for production.
Frequently asked questions
Is the IT audit done by a tool or by people?
Both, in that order. An automated AI tool goes through the known review points and then senior developers verify every finding. In this health check, AI brings the volume and people bring the judgment.
How do you conduct an IT audit, and what are the 4 steps of an audit?
In short: plan, examine, report and follow up. Our health check has five steps, the ones on this page: meeting, scope and timeline in writing, read-only access, review of each system, and a report with each finding, its evidence and its priority.
Is the first meeting free, and what do I get afterward?
Yes, the 30-minute meeting is free. In it we look at which systems you have and what is worth reviewing first. Afterward you get the scope and the timeline in writing, before we start.
How long does an audit take, and what does the cost depend on?
Both depend on how many systems the health check covers and how large they are. We go over them in a 30-minute meeting, and the scope and the timeline arrive in writing before we start.
Do we have to give you access to the repository?
Yes, if the review includes code. Access is read-only and limited to what is listed in the written scope. We change nothing.
What about the confidentiality of our code?
We work with read-only access and only on the systems in the written scope. If your company needs a non-disclosure agreement, say so in the meeting: it is settled before any access is given.
Request your free meeting
Fill in the form and we email you to set a day and a time. It is 30 minutes to see what you have and what to review first.