Technology audit · what to fix, in what order, and who should lead it

Technology audit: what it covers

A technology audit looks at the whole of a business’s technology, not one system. It asks whether what you have can support the plan, what it really costs, where the risks sit, and whether the right people are in charge of it. The person who runs it should have held the seat: a CTO for a product or software business, a CIO or IT Director where technology supports the operation.

Architecture

How the systems fit together, where they depend on each other, and what breaks first as usage grows. The audit names the parts that are hard to change and the parts that only one person understands.

Code and delivery

How work gets from an idea to production: code quality, testing, release process, and how often changes fail. It also checks who owns the code. Under UK law a contractor or agency usually keeps the copyright in what it writes unless the contract says otherwise, so the Intellectual Property Office’s guide to ownership of copyright works is worth reading before the audit asks for the contracts.

Infrastructure and cloud cost

Hosting, environments, monitoring and the monthly bill: what is running, who uses it and what could be switched off or resized. The NCSC’s cloud security guidance sets out how to choose, configure and use cloud services securely, and the audit checks your set-up against it.

Security

Access, patching, configuration, incident response and supplier risk. The NCSC’s 10 Steps to Cyber Security is a sound frame for a medium or large organisation. For a smaller one, Cyber Essentials is the minimum standard the government recommends, and a growing number of organisations require it of suppliers bidding for work.

Data

What personal and business data you hold, where it lives, who can reach it and how long you keep it. The ICO’s guide to accountability and governance expects you to be able to show how you comply with UK GDPR, with records of processing, written contracts with processors and a record of breaches. The audit checks whether that evidence exists.

Suppliers, contracts, team and roadmap

Which suppliers you depend on, when their contracts renew and how hard they are to leave. Whether the team has the skills the plan needs, and where one person holds knowledge nobody else has. Finally, whether the roadmap is realistic for the team and the budget you have.

What you get from a technology audit: findings in order, and a leadership recommendation

The main output is a prioritised findings report. Each finding says what the practitioner found, the evidence, the risk or cost of leaving it, and what to do about it. Findings are ranked so the first page tells the board what to fix now, what can wait and what to stop spending on.

The second output is a leadership recommendation: who should own the work that follows. Sometimes the answer is the current team with a clearer brief. Often it is a senior technology leader, and the report says which route fits. A fractional CTO or CIO suits a business that needs senior judgement for part of the week. An interim leader suits a large programme or an empty seat. A permanent hire suits a business that needs an owner every day; see our CTO headhunter page for that route.

The report should also be something the board can use. The NCSC’s Cyber Security Toolkit for Boards helps a board ask the right questions about cyber risk, and a good audit answers them in plain English. If the audit is a step towards a raise or a sale, read our page on technology due diligence as well.