What Is IT Audit and Assurance? A Plain-English Guide

"Audit and assurance" is one of those phrases that gets used constantly and explained rarely. The two words are related but they are not the same thing, and knowing the difference changes what you should ask for.

What Is an IT Audit?

An IT audit is a structured, independent review of how your technology and its controls actually work. Someone looks at what is meant to be in place, checks whether it really is, and reports the gaps with evidence behind them.

A typical IT audit covers access control, change management, system configuration, data protection, backup and recovery, supplier arrangements and monitoring. A security-focused version narrows in on threats and defensive controls, which is what most people mean when they say cyber security audit.

The defining features are independence and evidence. An audit is not someone's opinion of your setup. It is a test against a defined standard, with findings you can show to a third party.

What Is Assurance?

Assurance is the outcome, not the activity. It is the level of confidence that a control is working as intended, and it is expressed as a judgement rather than a checklist tick.

Assurance answers a different question. An audit asks "is this control in place?" Assurance asks "how confident can leadership be, on an ongoing basis, that this control keeps working?" A control that passed an audit in March and drifted in June was compliant, but it was never assuring.

This is why the term cyber controls assurance exists. It describes the continuous side: monitoring the controls that matter, catching drift, and being able to state a defensible position at any point rather than only on audit day.

Audit vs Assurance: The Practical Difference

• Timing: an audit is a point in time. Assurance is continuous.
• Output: an audit produces findings. Assurance produces confidence, usually reported to leadership or a board.
• Question answered: audit asks what is true today. Assurance asks whether it will still be true next quarter.
• Trigger: audits are often triggered by certification, a client, an insurer or an incident. Assurance is a standing management activity.

Both matter. An audit without assurance means you fix things once and drift back. Assurance without audit means you are monitoring your own homework with nobody checking the marking.

The Three Lines Model, Without the Jargon

Larger organisations often describe this using the "three lines" model, and it is genuinely useful even at SME scale:

1. First line: the people running the systems. They operate the controls day to day.
2. Second line: the oversight function. Risk, compliance, or in a smaller business, whoever owns security. They set expectations and monitor.
3. Third line: independent audit. Someone with no stake in the answer checks the first two lines are telling the truth.

In a 30-person business, the first two lines are often the same person and the third line does not exist internally. That is not a failure, it is a resourcing reality, and it is the usual reason an external audit adds value: it supplies the independence you cannot manufacture in-house.

Internal vs External Audit

Internal audit is carried out by your own organisation. It is cheaper, more frequent and useful for catching drift, but it carries the obvious limitation that you are assessing yourself.

External audit is carried out by an independent party. It costs more and happens less often, but the findings carry weight with clients, insurers and certification bodies precisely because you did not produce them.

Most SMEs land on a sensible split: internal self-assessment quarterly using something like our cyber security audit checklist, with an external audit annually or ahead of a certification or major client review.

Where Compliance Fits

Compliance is a third thing again. It means meeting a defined requirement, whether that is GDPR, Cyber Essentials, ISO 27001 or the NCSC CAF. Audit is often how compliance gets demonstrated, and assurance is how it gets maintained between assessments.

It is entirely possible to be compliant and insecure, which is why we do not treat certification as the finish line. It is also possible to be secure and unable to prove it, which fails you in a client due diligence questionnaire. The point of audit and assurance together is to close both gaps.

Who Actually Needs This?

You probably need a formal IT audit if you are pursuing certification, responding to client or insurer security questionnaires, operating in a regulated or public sector supply chain, have recently grown or acquired systems quickly, or have had an incident and need an honest baseline.

You probably need ongoing assurance if security is now a board-level topic, if you hold sensitive data, or if you have already done an audit and want the improvements to stick.

Getting Started

If the terminology has been getting in the way, the practical route is simple. Establish a baseline with an independent review, turn the findings into a prioritised plan, then decide what needs continuous monitoring.

Our free cyber health check gives you an initial view in a few minutes, and the cyber security audit service covers what a full review involves. For maintaining the position afterwards, see audit readiness and compliance support.