What Auditors Actually Look for When They Review Your IT Policies

Behind every audit are three simple questions. Here is what reviewers really check, where small businesses lose points, and how to be ready.

By aNetworks, Inc. | August 10, 2026 | 8-minute read

Auditors are consistent about what they want. Knowing the pattern makes the whole process calmer.

For most small businesses, an IT audit does not start with a regulator. It starts with a cyber insurance questionnaire, a client's security review before they will sign, or a compliance requirement like HIPAA, SOC 2, or PCI. Whatever the trigger, the person reviewing your policies is looking for the same handful of things every time. Once you know the pattern, the whole process gets a lot less intimidating.

Strip away the jargon and every policy review comes down to this:

1. Does it exist, and is it current? The policy is written down, has an owner, was approved by leadership, and shows a recent review date. Auditors treat an undocumented control as one that does not exist.
2. Does practice match the policy? If the policy says access is reviewed quarterly, they will ask to see the last few reviews. Reality has to match the paper.
3. Can you prove it? They want artifacts, not assurances. Tickets, logs, checklists, sign-offs, training records. If you cannot show it, it did not happen as far as the audit is concerned.

Coverage matters. Reviewers work from a checklist, and gaps stand out. Expect them to look for policies covering:

• Access control and least privilege, including how accounts are created and, just as important, removed.
• Onboarding and offboarding so new hires get the right access and departing staff lose it promptly.
• Authentication, passwords, and multi-factor authentication.
• Data handling: classification, retention, and secure disposal.
• Acceptable use of company systems and devices.
• Incident response, with evidence it has actually been tested.
• Backup and disaster recovery, including tested restores, not just backups that run.
• Change management for systems and software.
• Vendor and third-party risk for the outside services that touch your data.
• Security awareness training, with records of who completed it.
• Logging, monitoring, and encryption of data at rest and in transit.

The findings are remarkably consistent. If you fix only a few things before an audit, make it these:

• Former employees or old vendors still have active accounts. This is the single most common finding.
• The policy describes something you do not actually do, so practice and paper disagree.
• No evidence that access is reviewed, even if the policy says it is.
• Multi-factor authentication is missing on email or other critical systems.
• Backups run but restores have never been tested.
• There is an incident response plan on paper that no one has ever walked through.
• Training happens informally, with no record of who did it.
• Policies are years old, with no owner and no review date.

The fastest way to fail an audit is a great policy that nobody follows.

This is the part that surprises people. Auditors spend less time reading your policy and more time asking you to prove it runs. Start keeping the artifacts now, because you cannot manufacture a year of history the week before a review:

• Onboarding and offboarding checklists, completed and dated.
• Access review records with who reviewed and when.
• Training completion logs.
• Backup restore test results.
• Change and incident tickets showing the process in action.
• Version history and leadership approval dates on the policies themselves.

1. Inventory the policies you have, and note the ones you are missing.
2. Give every policy an owner, a review date, and leadership sign-off.
3. Walk each policy against reality. Where they disagree, either fix the practice or fix the policy so they match.
4. Collect your evidence in one place so you are not scrambling when someone asks.
5. Actually test the big ones: run your incident response plan and restore a backup at least once.
6. Close the obvious gaps first, starting with offboarding and multi-factor authentication.

None of this requires an enterprise compliance team. It requires the basics written down, followed, and evidenced. If you would rather not build and maintain that on your own, getting audit-ready is a core part of what a managed cyber security partner does. If you have an audit or an insurance renewal coming up, talk to us or call 781-871-0709 and we will help you get ahead of it.

What do IT auditors look at first?

Whether your policies exist in writing, are current with an owner and a recent review date, and match what you actually do. Undocumented controls are treated as if they do not exist.

What is the most common IT audit finding?

Access that was never removed when an employee left or a vendor was dropped, followed closely by policies that describe practices the business does not actually follow.

Do we need every IT policy written down?

Yes. Auditors treat an undocumented control as nonexistent. If a control is not written down and backed by evidence, it does not count during a review.

How often should IT policies be reviewed?

At least once a year, with a named owner and a documented review and approval date. Policies that are years old with no owner are an immediate red flag.

What usually triggers an IT audit for a small business?

Most often a cyber insurance application or renewal, a client or partner security review before a contract, or a compliance requirement such as HIPAA, SOC 2, or PCI.