IT audit

An audit answers a question few businesses can settle alone: what, today, can stop your activity, and for how long? The answer rarely lies in a discussion of hardware; it lies in the dependencies nobody has documented.

So we look at the whole: network, workstations, servers, backups, access, mail, power supply, and the point most often forgotten — who holds the passwords. Infrastructure that exists only in one person’s memory is a risk, whatever the quality of the equipment.

The deliverable is a written document, ordered by risk and costed in consequences rather than in technical references. "The server has no spare disk" helps nobody decide; "if this disk fails, you are stopped for as long as it takes to import another" allows a judgement.

That document is yours and you can have it executed by anyone, including somebody other than us. It is the condition that obliges us to write a defensible audit rather than a disguised quote.

Parts availability changes everything. Equipment whose replacement has to be imported takes the business out for weeks, which turns a theoretical risk into a real stoppage. So we rank risks by time to restore service, not by probability of failure.

Power is the second point. Outages, brief drops and voltage variation damage hardware slowly and cause failures wrongly blamed on software. A missing or badly sized UPS appears in most of our audits.

Finally, knowledge often rests on one person. A technician leaving takes the passwords, the logic of the network and the history of interventions with them. Documenting here is less a good practice than insurance against a departure.