Sound familiar?
- You inherited IT from a previous supplier with no documentation
- Nobody can say how many laptops the business owns
- An insurer or customer wants proof of your security controls
- Former staff may still have working accounts
- You are preparing for Cyber Essentials and want to know the gaps
- Costs keep creeping up and you want to know where the money goes
Key facts
- We list every device with its operating system, update status and encryption
- We check MFA coverage and who holds Global Administrator rights in Microsoft 365
- We review Microsoft Secure Score and unused or misassigned licences
- We test that backups exist and can actually be restored
- We check SPF, DKIM and DMARC records on your email domain
- Findings are ranked red, amber and green with a suggested fix for each
- Audits are quoted upfront at a fixed price
What an IT audit checks
Our audit looks at the whole picture, not just security. The main areas are:
- Devices: every PC, laptop, Mac, tablet and phone, with operating system version, update status, BitLocker or FileVault encryption, antivirus status and age.
- Accounts: who has a Microsoft 365 or Google Workspace account, who is a Global Administrator, who has MFA, and whether leavers still have access.
- Microsoft 365 configuration: security defaults or Conditional Access, legacy authentication, external sharing in SharePoint and OneDrive, mailbox forwarding rules and audit logging.
- Backups: what is backed up, where, how often, and whether a restore has ever been tested.
- Network: router and firewall firmware, open ports, Wi-Fi security, guest network separation and any devices exposed to the internet.
- Email domain: SPF, DKIM and DMARC records, which affect both spoofing and deliverability.
- Licences and costs: unused Microsoft 365 licences, duplicate subscriptions and software coming up for renewal.
- End-of-life: anything running Windows 10, Windows Server 2016 or older, or hardware out of warranty.
How the audit works
- Kick-off call: we learn how the business works, what software you rely on and what worries you.
- Access: you give us read-only or admin access to Microsoft 365 and the router, and run a small inventory tool on each PC, or we connect remotely to do it.
- Review: we gather data, check Microsoft Secure Score, look at sign-in logs and test a backup restore.
- Report: a plain-English document with each finding rated red, amber or green, why it matters and what fixing it would involve.
- Walk-through: a call to go through the report and agree priorities.
Most audits are done remotely. If we need to see a comms cabinet or check cabling, we tell you upfront and include it in the quote.
What we typically find
Every business is different, but a few findings come up again and again in small business audits:
- Accounts belonging to staff who left months or years ago, still signing in.
- Several people with Global Administrator rights who only needed to reset passwords.
- MFA turned on for some users but not others, or still relying on text messages, which Microsoft is retiring for most Entra ID users from 1 February 2027.
- A NAS or server backup that has been failing silently.
- Inbox rules forwarding mail to personal addresses.
- A DMARC record set to p=none and never looked at again.
- PCs that cannot run Windows 11 still in daily use.
None of these is unusual, and most are cheap to fix once you know about them.
We also look for single points of failure: the one person who knows the domain registrar login, the router password written on the router, or the accounts software licence tied to a former director's email address. These are not technical faults, but they can stop a business just as effectively when that person is unavailable. The report lists them alongside the technical findings.
After the audit
You own the report and can act on it yourself, give it to another supplier, or ask us to fix the findings. Quick wins such as removing old accounts and turning on MFA are often done within a few hours. Bigger items, such as replacing a server or rolling out Intune, are quoted separately. If your main concern is security, our security audit goes deeper on that side, and our Cyber Essentials readiness service maps findings to the scheme's controls.
Cost
IT audits are quoted upfront at a fixed price based on the number of users, devices and sites. Fixing the findings afterwards is £45 an hour + VAT, or part of the included hours on a monthly plan. The Complete plan at £99 a month + VAT adds IT and Microsoft 365 helpdesk support and 3 hours of work each month. Request an audit quote.
Frequently asked questions
What is an IT audit?
An IT audit is a structured check of your devices, accounts, Microsoft 365 settings, backups, network and licences. dijitul gives you a plain-English report ranking each finding by risk, with what it would take to fix. It is quoted upfront at a fixed price.
How long does an IT audit take?
For a small business, the data gathering usually takes a few days of elapsed time, mostly done remotely while you keep working. The report and walk-through follow shortly after. dijitul gives you a timeline with the quote.
Is an IT audit the same as Cyber Essentials?
No. Cyber Essentials is a government-backed certification scheme with a set of required controls. An IT audit is broader and also covers costs, backups and end-of-life equipment. dijitul can map audit findings to Cyber Essentials controls so you know the gaps before applying.
Do you need to visit our office?
Usually not. dijitul carries out most IT audits remotely, using admin access to Microsoft 365 and the router plus an inventory tool on each PC. If something genuinely needs eyes on site, such as cabling, we tell you upfront and include it in the quote.
Can we use the audit report with another IT company?
Yes. The report is yours. You can fix the findings yourself, pass it to another supplier, or ask dijitul to do the work. There is no obligation to buy anything after the audit.
How much does an IT audit cost?
dijitul quotes IT audits upfront at a fixed price based on your number of users, devices and sites. Fixes afterwards are £45 an hour + VAT or come out of the included hours on a Business or Complete plan.
Related
Tell us what you need
We scope it, give you a clear fixed quote and do the work. No jargon.