IT Audit

Every material business process now runs through systems, which means every material risk does too: who can access what, how changes reach production, whether backups would actually restore, and whether the reports management relies on say what everyone assumes they say. Most organisations discover the answers during an incident, an audit finding or a failed recovery — the three most expensive classrooms available.

Acumon's IT audits test those controls deliberately instead: partner-led, framework-based reviews of your IT general controls and key application controls, with findings graded by real risk and a remediation path your IT team and your board can both work from.

IT General Controls: the Foundation

IT general controls are the controls every system depends on: user access provisioning and removal, privileged account management, change and release management, job scheduling, backup and recovery, and vendor management for the platforms you outsource. When ITGCs are weak, nothing built on top of them can be trusted — including the financial reports your statutory auditor tests. Our review covers the full ITGC set, tested against evidence rather than assertion: leavers actually removed, changes actually approved, restores actually performed.

Application and Automated Controls

Beyond the foundations sit the controls inside your key applications: system-enforced approval limits, three-way matching, interface reconciliations between systems, and the calculations and reports management relies on. We identify the automated controls your critical processes depend on, test that they are configured as everyone believes, and trace data across the interfaces where errors most often hide. A surprising share of findings are controls that were switched off during an implementation and never switched back on.

Supporting Your Financial Audit

Statutory auditors increasingly test ITGCs, and weak results push them into expensive substantive work — or qualified control conclusions for regulated entities. An independent IT audit ahead of the financial audit finds and fixes those failures first. Because Acumon's audit practice sees ITGC testing from the statutory side, we know precisely what external auditors look for and report in a form they can use.

Outsourced IT and Cloud Platforms

Moving systems to the cloud moves the work but not the accountability. We review what your providers' assurance reports actually cover — and what they leave to you: the user access you still administer, the configurations you own, the data only you can classify. Where providers give you SOC or ISAE reports, we map their exceptions and carve-outs to your risks instead of letting the PDF sit unread in a compliance folder.

Reporting That Gets Actioned

IT audit reports fail when they read as either technical noise or generic best practice. Ours grade each finding by what could actually go wrong in your business, name an owner, and propose a proportionate fix — distinguishing the two findings that matter this quarter from the ten that can wait. Delivered partner-led under a CMIIA-qualified engagement lead, and sized to your organisation: a focused ITGC review for a mid-market firm, or a rolling programme feeding an audit committee.

What You Get With Acumon

• Full IT general controls review: access, change, operations, backup and recovery
• Privileged access and leaver-removal testing against evidence, not policy
• Key application and automated control testing for your critical processes
• Interface and data-flow reviews between core systems
• Pre-audit ITGC health checks that reduce statutory audit friction
• SOC / ISAE provider report reviews mapped to the risks you retain
• Findings graded by business impact, with owners and timescales
• Partner-led delivery by a CMIIA-qualified engagement lead

Why Acumon for IT Audit?

• Partner-led delivery by a Chartered Member of the Institute of Internal Auditors (CMIIA)
• Cross-sector IT risk experience with deep technical and audit expertise
• ERP experience across SAP, Oracle, Microsoft Dynamics and Sage
• Sister audit practice tests ITGCs on statutory audits — we know exactly what external auditors look for
• Flexible engagement models with rapid project mobilisation

Get a Fixed-Fee Quote

Tell us what you need and we'll come back within one business day with a clear scope and a fixed price — no hourly-rate surprises. Call 020 8567 3451 or use the form and we'll be in touch.