Internal IT Audit for In-House Teams, With a 12-Month Plan and an IT General Controls Checklist

Updated: November 2026. IIA, ISACA and NIST dates and every CSF 2.0 subcategory checked against the publishers' pages on 11 November 2026.

Sooner or later an auditor, a client or an insurer asks IT to prove its controls work, and the proof is spread across consoles, tickets and inboxes. Gathering it in audit week stalls the team, while a year-round plan makes evidence a by-product of normal work. This internal IT audit guide covers who can audit IT, what auditors ask for in 2026, a 12-month plan and an IT general controls checklist with a test for every row.

TL;DR

• What it is. A planned, evidence-based review, run from inside the company, of whether IT controls are designed well and working.
• Who audits. Internal audit, a reviewer swap inside IT, or an outsider who didn't build the control.
• What's new. Two IIA Topical Requirements, cybersecurity and third parties, took effect in 2026.
• Plan the year. Rotate the audit areas through four quarters, with leaver checks and restore tests every quarter.
• Test each control. 19 IT general controls, each with a test, a sample and the evidence to keep.

What Is an Internal IT Audit?

An internal IT audit is a planned review, run by people inside the company, that tests whether IT controls are designed well and working. It runs on evidence, such as tickets, exports and logs, and a yes in a meeting doesn't count.

Its core is IT general controls, or ITGCs: the controls over access, change and operations that every system sits on. Financial auditors know them from COSO 2013, whose Principle 11 covers general controls over technology: infrastructure, security management, and acquisition, development and maintenance. That's as far into SOX territory as this guide goes.

Internal IT Audit vs External Audit and Self-Assessment

Four kinds of review get called an IT audit, split by who runs them and who trusts the result.

A self-assessment finds gaps but proves little, because the team grades its own work.

The vendor license audit is the odd one out, since the publisher runs it on its own terms. Our software license audit guide covers that process, so licensing is one row here (AS-3).

Who Audits IT Without an Internal Audit Department

Audit guides tend to assume an internal audit team. If your IT department is three people, you probably don't have one, so pick one of three models.

On 8 July 2026, the IIA replaced its Three Lines Model position paper with a Statement of Position. Internal audit stays the independent third line, and if the chief audit executive takes on second-line duties, safeguards must protect that independence.

In a small team, nobody audits a control they built or run. Swap areas instead: whoever owns access audits change, and the other way round, with a note of who reviewed what. Our guide to IT department ownership helps settle who owns which area.

An MSP can be the outside reviewer for areas it doesn't run, since a report on its own patching has no independence in it. Our co-managed IT split guide shows where to draw that line.

What Internal Audit Will Ask IT For in 2026

The IIA's Global Internal Audit Standards took effect on 9 January 2025. They have 5 domains and 15 principles, and every internal audit function is expected to conform.

Topical Requirements add baselines for specific risks, each effective 12 months after issue. One applies to an assurance engagement when its topic is in scope, and internal audit documents any exclusion.

The Cybersecurity Topical Requirement took effect in February 2026. It covers how cyber governance, risk management and controls are designed and put in place. It doesn't force a cyber audit, but it applies whenever cyber turns up as a risk inside another audit.

That's likely. In the IIA's Risk in Focus 2026-27 survey of 3,285 chief audit executives and directors, published 15 September 2026, cybersecurity was the top global risk. 80% put it in their top five risks, and 75% in their top five areas for audit time and effort.

The IIA's own episode on cybersecurity fundamentals for internal auditors, published 22 October 2026, covers the requirement's three areas in about 7.5 minutes. It also touches on observing a tabletop exercise, and why a confident answer isn't evidence.

The easiest evidence is the kind normal work leaves behind: a ticket with the approval in it, a scheduled export, a log. Our IT compliance evidence guide covers capturing it as you go.

In r/ITManagers, a poster said every audit or customer review stops work while the team gathers screenshots and exports. The top reply says that happens when evidence isn't an output of normal operations, and that an owner plus a cadence fixes it. Another keeps a rolling folder of audit evidence and refreshes it quarterly.

Plan the Year From an IT Audit Universe

An audit universe is the list of everything you could audit. For IT, start with the six checklist areas. Rank each by its impact if it fails, how fast it changes and how long since its last audit. Internal audit plans by risk the same way. Here's our example ranking.

Leaver checks (AC-2), a restore test (OP-1) and re-tests of last quarter's findings (GV-2) run every quarter. Move an area up if it has never been audited or has an open finding.

Under ISO 27001, this plan can serve as the clause 9.2 audit programme once it also states methods, responsibilities and reporting.

Internal IT Audit Checklist

The checklist covers 19 IT general controls in six areas, each with a test, a starting sample, the evidence to keep and two mapping columns.

The mapping is ours, at subcategory level, and neither NIST nor ISO has reviewed it. We checked each ISO/IEC 27001:2022 pair against a third-party mapping listed in NIST's CSF 2.0 Reference Tool. NIST doesn't check non-NIST mappings for correctness or endorse them. Pairs marked "ours" aren't in that mapping.

Firewall, email and endpoint checks live in our security audit guide, linked in the testing section.

Access

AC-2 runs every quarter, because a leaver missed in January is still a working login in March. Our guide to role-based access shows how groups make AC-1 and AC-4 faster to test.

Change

For CH-1 walkthroughs, the IIA's IT change management audit tool, dated 19 March 2026, lists sample questions to borrow. CH-2 reuses the CH-1 sample, so one pull of tickets tests both.

Operations

OP-1 needs a restore on record, and the same quarterly restore covers RC.RP-03. Our restore testing guide covers what a test should include.

OP-2 is measured against your policy's deadline, so write the deadline first. Our patch policy guide covers setting one.

Assets and Licensing

AS-1 compares the inventory you keep with a discovery scan nobody edited. Our asset lifecycle guide covers the record from purchase to disposal.

Third Parties and SaaS

TP-1 tests your vendor register, and TP-2 catches the apps that skipped it, AI tools included. Our vendor risk program guide covers ranking suppliers by criticality.

Governance

GV-2 closes the loop, since a finding counts as closed only after a re-test. For GV-1, our policy vs procedure guide helps when a policy reads like a runbook.

How to Test Each Control

Every row names a test method. There are four, from weakest to strongest.

Inquiry alone isn't enough evidence, so pair it with another method.

Each control gets two tests. A test of design asks whether the control would stop the problem if it ran as written. A test of operating effectiveness asks whether it did run, every time, across the audit period. An approval step skipped for urgent changes passes the first and fails the second.

In r/sysadmin, an admin asked whether an audit finding mattered. Guest DHCP requests were relayed to the internal server through switch ACLs, and the auditors found no vulnerability. Top replies agree it probably works but depends on the configuration staying right. The fix they suggest is serving guest DHCP from the firewall.

That's a design finding. The control passes today, and the auditor is asking whether it survives the next configuration mistake.

Fix the audit period first, such as the last quarter, and sample across all of it. The checklist's sample sizes are our starting points, so agree yours with whoever audits. ISACA's IT audit framework, ITAF, got a free 5th edition on 26 February 2026, its first update since 2020. Its updated guideline 2208 covers IT audit sampling.

When a test fails, write it up as a finding and rate it. Our guide to security audit steps covers the condition, criteria, cause, effect and recommendation format, the rating levels and the nine procedure steps.

Mapping to NIST CSF 2.0, ISO 27001 and COBIT

The mapping columns let one test answer two frameworks. The CSF 2.0 column cites subcategories from NIST CSWP 29, published 26 February 2024, which has 6 functions, 22 categories and 106 subcategories.

ISO/IEC 27001:2022 has 93 Annex A controls, and clause 9.2 requires internal audits of the management system at planned intervals. They check that the system meets your own requirements and the standard's and works in practice. The auditors have to be objective and impartial, and results go to the relevant managers.

COBIT 2019, ISACA's governance framework, has 40 governance and management objectives. MEA04 Managed Assurance, new in COBIT 2019, covers assurance work like this audit. ISACA's own page still listed COBIT 7 as coming in November 2026 when we checked on 11 November, so COBIT 2019 is the current version.

COBIT stays out of the checklist columns to keep the tables readable. If you run it, our IT governance framework guide covers stacking it with CSF.

Internal IT Audits in a Co-Managed Setup

When an MSP runs part of IT, the evidence splits: the MSP exports what its tools record, and the company signs off on decisions. Here's our starting split, and the contract decides who supplies each row.

Put a right-to-audit clause in the contract: what you can request, how fast, and who pays for the time. Our co-managed tool stack guide covers the shared tools that make those exports routine.

An MSP's SOC 2 Type 2 report can cover the rows it runs, if its scope includes that service and its period overlaps yours. Check the controls it expects you to run on your side, too. Our guide to SOC 2 reports covers what to read.

OpenFrame is open, AI-native infrastructure for IT and security, where Fae resolves support requests and Mingo runs IT operations, for $1 per device per month with a 14-day free trial. Flamingo builds OpenFrame, which isn't a GRC or audit tool and doesn't score controls.

Start With Access in Q1

An internal IT audit works as a year-round plan: pick who audits, rank the universe and give each quarter one focus. Test every control with a method, a sample and evidence that normal work already produces. Next, score the wider security program with our NIST CSF self-assessment.