IT audit for Adelaide businesses
Sometimes a quick look isn't enough. A buyer wants due diligence, an insurer wants proof, a big client sends a security questionnaire, or the board wants to know exactly what the business owns. An IT audit gives you the full picture in writing: every device, licence, account and supplier, measured against a recognised standard, with a costed plan to close the gaps.
Last updated
From $3,500 (ex GST) for a single-site business of up to about 10 staff. That's roughly three to four days of our time, spread over two to three weeks. Every business is different, so call us and we'll work out the scope and price together. See all our prices
The short answer
An IT audit is a formal, documented review of a business's technology. It lists every device, licence, account and supplier, checks security controls against a named standard such as the Essential Eight, collects evidence for each finding and ends with a costed improvement plan. WaTo Consulting runs IT audits for Adelaide businesses that need answers on paper for insurers, clients, buyers or a board.
What's the difference between an IT audit and a health check?
A health check is a quick snapshot that ranks risks so you know what to fix first. An audit goes further. We record the evidence behind each finding (screenshots, settings exports, registers), map your controls to a standard like the Essential Eight, and produce documents you can hand to someone else. It takes longer and costs more, which is why we usually suggest a health check first unless someone is specifically asking for an audit.
What you get
Asset register
Every computer, server, phone, printer and network device, with age, warranty, operating system and who uses it.
Licence and subscription list
Every software subscription and licence you pay for, who has it, and the ones nobody is using.
Access review
Every account with access to your systems, admin rights, multi-factor authentication status and outside suppliers with remote access.
Standards gap report
Your controls measured against the Essential Eight, with each gap explained and the evidence attached.
Network diagram
A current drawing of your internet, firewall, switches, Wi-Fi and servers, so the next person isn't guessing.
Backup and recovery test
A documented restore test, with how long it took and what you'd lose if it happened today.
Costed improvement plan
Fixes grouped by urgency with rough costs, spread over a time frame your budget can handle.
Who needs an IT audit
- Businesses being bought, sold or merged that need technology due diligence.
- Firms answering a client or government tender that asks about the Essential Eight.
- Practices handling health, legal or financial records that need to show the work behind their privacy obligations.
- Boards and owners who want an independent, written view of IT risk.
- Businesses taking over from a provider who left very little documentation behind.
How the audit runs
- We agree the scope. Which sites, systems and standard we're measuring against, and who the report is for. That decides how deep we go. Usually under an hour.
- We collect the facts. Inventory scans, admin portal exports, a walk through the office and network cupboard, and short interviews with the people who use the systems. About a day on-site, plus a day of remote exports and scans.
- We test the controls. Backups get a test restore, logins get checked for multi-factor authentication, and update and protection status is confirmed device by device. Part of the on-site and remote days above.
- We write it up. A summary for owners, the detailed findings with evidence, the registers and the diagram, all in one pack. One to two days. This is where most of the time goes.
- We present the plan. We walk you through the findings and the costed plan. You can act on it with us, with your own team or with another provider. An hour or two, in person or on a call.
Why WaTo for an IT audit
- Adelaide-based and running business IT since 2001, so the audit is done by people who fix these systems for a living.
- We write for two readers: a short summary owners can act on, and detail your technicians can follow.
- Plain about what a standard actually requires and what's optional, so you don't overspend chasing a score.
- The registers and diagram are yours to keep and update, which saves time at every future review.
Why an audit costs more than a health check
What changes the price
IT audit questions
How long does an IT audit take?
For a small business with one site, expect two to three weeks from the first meeting to the final report. Most of that is elapsed time; the work on-site is usually a day or two. Multi-site businesses take longer.
Why is an audit so much more than a health check?
Because it's several times the work. A health check finds and ranks the problems. An audit also documents everything, with evidence, against a standard, so someone outside the business can rely on it. Most of the extra cost is the registers, the diagram, the evidence and the write-up.
Will we be certified after the audit?
No. There's no official certificate for the Essential Eight. The audit tells you which maturity level you meet and what's missing. If a client asks for a formal certification scheme, we'll tell you which one fits and help you prepare.
Does the audit cover the new ASD Essentials?
The Australian Signals Directorate published ASD Essentials in October 2026 as the successor to the Essential Eight. It's aimed mostly at government and large organisations for now, and ASD says to keep current uplift programs going. We measure against the Essential Eight and note where the newer guidance changes things.
Is an IT audit a penetration test?
No. A penetration test is an authorised, simulated attack that tries to break in. An audit checks how your systems are set up and run. If a pen test makes sense for you, we'll say so and help you scope it with a specialist.
Related services
Guides on this topic
- IT health check, IT audit or penetration test: which do you need?
- What is the Essential Eight?
- The IT documentation every small business should keep
- Cyber insurance IT readiness: what to have in order first
Sources & references
Need your IT documented properly?
Tell us who's asking for the audit and why. We'll suggest the right scope and give you a fixed price.
Mon to Fri, 8:30am to 5pm
