Start with the number that should worry everyone. According to Flexera’s 2026 report on IT asset management, only 36% of IT teams say they have complete visibility of their technology estate. A year earlier it was 43%. Visibility is getting worse, not better.

Meanwhile the estate keeps growing. The average mid-market company now runs more than 250 SaaS applications. That is more software subscriptions than it has laptops. Nobody sat down and decided that. It accumulated.

This is where the phrase shadow IT comes in, and it is worth being fair about it. Shadow IT is not usually rebellion. It is a marketing team that needed a design tool on Tuesday and could not wait six weeks for procurement. The tool works. The problem is that it now holds customer data, it renews automatically, and it exists in no register anywhere.

The audit version of this problem is simple to state. If a system is not on your list, then:

• Nobody patches it
• Nobody reviews who has access to it
• Nobody cancels it when the team stops using it
• Nobody knows it exists when the data protection questions start

You cannot govern what you cannot see. Everything else in this article assumes you have solved this first, and most organisations have not.

This is the part that turns an audit from an inconvenience into a budget event.

Software licensing is deliberately complicated. Major vendors — Oracle, IBM, Microsoft and SAP are the ones that come up again and again — sell software under rules that are hard to apply and easy to breach by accident. Then they check.

The pattern is fairly consistent across the industry:

• Most large enterprises face a formal licence review every three to five years from at least one major vendor. Across a full portfolio of big vendors, something is being reviewed somewhere almost every year.
• One analysis puts unplanned compliance payments by Fortune 500 companies at around $2.4 billion a year.
• Oracle and SAP account for a disproportionate share of those payments compared with their share of deals.
• Median Oracle settlements for mid-market firms have been reported around $1.8 million. For Microsoft 365, over-deployment of premium E5 features is reported as the single biggest source of true-up findings, with median settlements of roughly $300,000 to $500,000 for estates of 1,000–5,000 seats.

Read that last one again, because it is the most ordinary way to get caught. Nobody pirated anything. Somebody enabled a feature that turned out to sit in a higher tier, across a few thousand accounts, for two years.

Two practical things are worth knowing.

First, a claim is an opening position, not a bill. Reported experience is that claims traded into a renewal negotiation often settle for something like 10 to 30 cents on the claimed dollar. The first letter is not the final number. Panic is expensive.

Second, most licence exposure is self-inflicted and findable. Common causes are dull: virtualisation that quietly multiplied the number of processors a database is deemed to run on, test environments licensed as if they were nothing, leavers still holding paid seats, and features switched on by default.

The defence is not clever. It is knowing your own position before someone else tells you what it is.

Licences are the money you might owe. This is the money you are definitely wasting.

Flexera’s 2026 cloud report puts cloud waste at 29% of cloud spend — and notably, that figure went up, ending five years of gradual improvement. Other estimates land around 27%. Organisations without a cost management practice waste somewhere in the region of 32–40%; mature ones get it down to 15–20%, which is better but still not small.

The causes are unglamorous. Idle compute is the biggest single bucket, followed by machines provisioned far larger than they need to be. Servers that someone started for a test in 2023 and never turned off. GPU fleets running at 30–40% utilisation because they were sized for a peak that happens twice a month.

SaaS has the same disease. One report puts SaaS waste at around 30% of spend — unused seats, two tools that do the same job bought by two departments, subscriptions for a project that ended.

Put a real number on it. A company spending £5 million a year on SaaS is likely burning something like £1.5 million on software nobody opens.

An audit that only checks security will walk straight past all of this. A good IT audit does not. Wasted money is a control failure like any other: it means purchases are being made without oversight, and nothing checks whether they are still needed.

Start with the number that should worry everyone. According to Flexera’s 2026 report on IT asset management, only 36% of IT teams say they have complete visibility of their technology estate. A year earlier it was 43%. Visibility is getting worse, not better.

Meanwhile the estate keeps growing. The average mid-market company now runs more than 250 SaaS applications. That is more software subscriptions than it has laptops. Nobody sat down and decided that. It accumulated.

This is where the phrase shadow IT comes in, and it is worth being fair about it. Shadow IT is not usually rebellion. It is a marketing team that needed a design tool on Tuesday and could not wait six weeks for procurement. The tool works. The problem is that it now holds customer data, it renews automatically, and it exists in no register anywhere.

The audit version of this problem is simple to state. If a system is not on your list, then:

• Nobody patches it
• Nobody reviews who has access to it
• Nobody cancels it when the team stops using it
• Nobody knows it exists when the data protection questions start

You cannot govern what you cannot see. Everything else in this article assumes you have solved this first, and most organisations have not.

This is the part that turns an audit from an inconvenience into a budget event.

Software licensing is deliberately complicated. Major vendors — Oracle, IBM, Microsoft and SAP are the ones that come up again and again — sell software under rules that are hard to apply and easy to breach by accident. Then they check.

The pattern is fairly consistent across the industry:

• Most large enterprises face a formal licence review every three to five years from at least one major vendor. Across a full portfolio of big vendors, something is being reviewed somewhere almost every year.
• One analysis puts unplanned compliance payments by Fortune 500 companies at around $2.4 billion a year.
• Oracle and SAP account for a disproportionate share of those payments compared with their share of deals.
• Median Oracle settlements for mid-market firms have been reported around $1.8 million. For Microsoft 365, over-deployment of premium E5 features is reported as the single biggest source of true-up findings, with median settlements of roughly $300,000 to $500,000 for estates of 1,000–5,000 seats.

Read that last one again, because it is the most ordinary way to get caught. Nobody pirated anything. Somebody enabled a feature that turned out to sit in a higher tier, across a few thousand accounts, for two years.

Two practical things are worth knowing.

First, a claim is an opening position, not a bill. Reported experience is that claims traded into a renewal negotiation often settle for something like 10 to 30 cents on the claimed dollar. The first letter is not the final number. Panic is expensive.

Second, most licence exposure is self-inflicted and findable. Common causes are dull: virtualisation that quietly multiplied the number of processors a database is deemed to run on, test environments licensed as if they were nothing, leavers still holding paid seats, and features switched on by default.

The defence is not clever. It is knowing your own position before someone else tells you what it is.

Licences are the money you might owe. This is the money you are definitely wasting.

Flexera’s 2026 cloud report puts cloud waste at 29% of cloud spend — and notably, that figure went up, ending five years of gradual improvement. Other estimates land around 27%. Organisations without a cost management practice waste somewhere in the region of 32–40%; mature ones get it down to 15–20%, which is better but still not small.

The causes are unglamorous. Idle compute is the biggest single bucket, followed by machines provisioned far larger than they need to be. Servers that someone started for a test in 2023 and never turned off. GPU fleets running at 30–40% utilisation because they were sized for a peak that happens twice a month.

SaaS has the same disease. One report puts SaaS waste at around 30% of spend — unused seats, two tools that do the same job bought by two departments, subscriptions for a project that ended.

Put a real number on it. A company spending £5 million a year on SaaS is likely burning something like £1.5 million on software nobody opens.

An audit that only checks security will walk straight past all of this. A good IT audit does not. Wasted money is a control failure like any other: it means purchases are being made without oversight, and nothing checks whether they are still needed.

Start with the number that should worry everyone. According to Flexera’s 2026 report on IT asset management, only 36% of IT teams say they have complete visibility of their technology estate. A year earlier it was 43%. Visibility is getting worse, not better.

Meanwhile the estate keeps growing. The average mid-market company now runs more than 250 SaaS applications. That is more software subscriptions than it has laptops. Nobody sat down and decided that. It accumulated.

This is where the phrase shadow IT comes in, and it is worth being fair about it. Shadow IT is not usually rebellion. It is a marketing team that needed a design tool on Tuesday and could not wait six weeks for procurement. The tool works. The problem is that it now holds customer data, it renews automatically, and it exists in no register anywhere.

The audit version of this problem is simple to state. If a system is not on your list, then:

• Nobody patches it
• Nobody reviews who has access to it
• Nobody cancels it when the team stops using it
• Nobody knows it exists when the data protection questions start

You cannot govern what you cannot see. Everything else in this article assumes you have solved this first, and most organisations have not.

This is the part that turns an audit from an inconvenience into a budget event.

Software licensing is deliberately complicated. Major vendors — Oracle, IBM, Microsoft and SAP are the ones that come up again and again — sell software under rules that are hard to apply and easy to breach by accident. Then they check.

The pattern is fairly consistent across the industry:

• Most large enterprises face a formal licence review every three to five years from at least one major vendor. Across a full portfolio of big vendors, something is being reviewed somewhere almost every year.
• One analysis puts unplanned compliance payments by Fortune 500 companies at around $2.4 billion a year.
• Oracle and SAP account for a disproportionate share of those payments compared with their share of deals.
• Median Oracle settlements for mid-market firms have been reported around $1.8 million. For Microsoft 365, over-deployment of premium E5 features is reported as the single biggest source of true-up findings, with median settlements of roughly $300,000 to $500,000 for estates of 1,000–5,000 seats.

Read that last one again, because it is the most ordinary way to get caught. Nobody pirated anything. Somebody enabled a feature that turned out to sit in a higher tier, across a few thousand accounts, for two years.

Two practical things are worth knowing.

First, a claim is an opening position, not a bill. Reported experience is that claims traded into a renewal negotiation often settle for something like 10 to 30 cents on the claimed dollar. The first letter is not the final number. Panic is expensive.

Second, most licence exposure is self-inflicted and findable. Common causes are dull: virtualisation that quietly multiplied the number of processors a database is deemed to run on, test environments licensed as if they were nothing, leavers still holding paid seats, and features switched on by default.

The defence is not clever. It is knowing your own position before someone else tells you what it is.

Licences are the money you might owe. This is the money you are definitely wasting.

Flexera’s 2026 cloud report puts cloud waste at 29% of cloud spend — and notably, that figure went up, ending five years of gradual improvement. Other estimates land around 27%. Organisations without a cost management practice waste somewhere in the region of 32–40%; mature ones get it down to 15–20%, which is better but still not small.

The causes are unglamorous. Idle compute is the biggest single bucket, followed by machines provisioned far larger than they need to be. Servers that someone started for a test in 2023 and never turned off. GPU fleets running at 30–40% utilisation because they were sized for a peak that happens twice a month.

SaaS has the same disease. One report puts SaaS waste at around 30% of spend — unused seats, two tools that do the same job bought by two departments, subscriptions for a project that ended.

Put a real number on it. A company spending £5 million a year on SaaS is likely burning something like £1.5 million on software nobody opens.

An audit that only checks security will walk straight past all of this. A good IT audit does not. Wasted money is a control failure like any other: it means purchases are being made without oversight, and nothing checks whether they are still needed.

Start with the number that should worry everyone. According to Flexera’s 2026 report on IT asset management, only 36% of IT teams say they have complete visibility of their technology estate. A year earlier it was 43%. Visibility is getting worse, not better.

Meanwhile the estate keeps growing. The average mid-market company now runs more than 250 SaaS applications. That is more software subscriptions than it has laptops. Nobody sat down and decided that. It accumulated.

This is where the phrase shadow IT comes in, and it is worth being fair about it. Shadow IT is not usually rebellion. It is a marketing team that needed a design tool on Tuesday and could not wait six weeks for procurement. The tool works. The problem is that it now holds customer data, it renews automatically, and it exists in no register anywhere.

The audit version of this problem is simple to state. If a system is not on your list, then:

• Nobody patches it
• Nobody reviews who has access to it
• Nobody cancels it when the team stops using it
• Nobody knows it exists when the data protection questions start

You cannot govern what you cannot see. Everything else in this article assumes you have solved this first, and most organisations have not.

This is the part that turns an audit from an inconvenience into a budget event.

Software licensing is deliberately complicated. Major vendors — Oracle, IBM, Microsoft and SAP are the ones that come up again and again — sell software under rules that are hard to apply and easy to breach by accident. Then they check.

The pattern is fairly consistent across the industry:

• Most large enterprises face a formal licence review every three to five years from at least one major vendor. Across a full portfolio of big vendors, something is being reviewed somewhere almost every year.
• One analysis puts unplanned compliance payments by Fortune 500 companies at around $2.4 billion a year.
• Oracle and SAP account for a disproportionate share of those payments compared with their share of deals.
• Median Oracle settlements for mid-market firms have been reported around $1.8 million. For Microsoft 365, over-deployment of premium E5 features is reported as the single biggest source of true-up findings, with median settlements of roughly $300,000 to $500,000 for estates of 1,000–5,000 seats.

Read that last one again, because it is the most ordinary way to get caught. Nobody pirated anything. Somebody enabled a feature that turned out to sit in a higher tier, across a few thousand accounts, for two years.

Two practical things are worth knowing.

First, a claim is an opening position, not a bill. Reported experience is that claims traded into a renewal negotiation often settle for something like 10 to 30 cents on the claimed dollar. The first letter is not the final number. Panic is expensive.

Second, most licence exposure is self-inflicted and findable. Common causes are dull: virtualisation that quietly multiplied the number of processors a database is deemed to run on, test environments licensed as if they were nothing, leavers still holding paid seats, and features switched on by default.

The defence is not clever. It is knowing your own position before someone else tells you what it is.

Licences are the money you might owe. This is the money you are definitely wasting.

Flexera’s 2026 cloud report puts cloud waste at 29% of cloud spend — and notably, that figure went up, ending five years of gradual improvement. Other estimates land around 27%. Organisations without a cost management practice waste somewhere in the region of 32–40%; mature ones get it down to 15–20%, which is better but still not small.

The causes are unglamorous. Idle compute is the biggest single bucket, followed by machines provisioned far larger than they need to be. Servers that someone started for a test in 2023 and never turned off. GPU fleets running at 30–40% utilisation because they were sized for a peak that happens twice a month.

SaaS has the same disease. One report puts SaaS waste at around 30% of spend — unused seats, two tools that do the same job bought by two departments, subscriptions for a project that ended.

Put a real number on it. A company spending £5 million a year on SaaS is likely burning something like £1.5 million on software nobody opens.

An audit that only checks security will walk straight past all of this. A good IT audit does not. Wasted money is a control failure like any other: it means purchases are being made without oversight, and nothing checks whether they are still needed.

Every organisation has one. The system that only Marek understands. The application that runs on a Windows version that stopped receiving patches years ago. The database everything depends on that nobody dares touch.

The cost of this is far larger than people assume. Estimates vary but they all point the same way: legacy maintenance absorbs somewhere between 40% and 60% of a typical IT budget, and in some organisations up to 80%. McKinsey has put technical debt at 20–40% of technology budgets. Left alone, technical debt grows roughly 20% a year, because every new thing you build on top of the old thing gets harder.

There is a security angle too, and it is the reason legacy shows up as an audit finding rather than a finance one. Unsupported systems cannot take security patches. They frequently cannot support modern controls like multi-factor authentication or zero-trust network access. So an old system is not just slow and expensive — it is a permanent hole in every control you have implemented everywhere else.

Auditors ask three questions here, and they are good questions to ask yourself:

1. What are you running that the vendor no longer supports?
2. What is the plan, with a date on it?
3. If the answer is “no plan”, who accepted that risk, and do they know they accepted it?

That third question is where most conversations get uncomfortable. Risk that nobody has formally accepted is risk that will land on somebody by surprise.

Here is something that never makes a headline but shows up in almost every audit report: your naming and documentation conventions.

It sounds trivial. It is not.

If your servers are called srv-prod-01, NewServer2, test-kasia, and db3-DO-NOT-DELETE, then nobody can answer basic questions from the list alone. Which of these are production? Which hold customer data? Who owns test-kasia, and is the person who created it still employed here?

Good practice in configuration management is dull and effective: one standard naming convention for everything — hardware, software, services, environments — where the name tells you the function, the environment, and the owner. No cryptic names. No initials of the person who happened to build it.

The same applies to the register itself, the CMDB or asset list. The recurring finding here is not that organisations lack one, but that theirs is wrong. It was accurate on the day it was built and has decayed ever since, because updating it is nobody’s actual job. An inventory that is 60% correct is arguably worse than none, because people trust it.

Two habits fix most of this:

• Discover automatically, do not type manually. Anything maintained by hand will drift.
• Audit the register itself, regularly. Check that what is in the list exists, and that what exists is in the list. Both directions.

If you look into IT governance you immediately hit a wall of standards, and most explanations are written for people who already understand them. The short version:

COBIT is about what should be controlled and how IT connects to business goals. It is the governance layer. Think of it as the map.

ITIL is about how you actually run IT services day to day — incidents, changes, requests, service desks. It is the operating manual.

ISO/IEC 27001 is about information security specifically, and it is the one you can be certified against. It is the security certificate customers ask for.

ISO/IEC 19770 is the one people forget: software and IT asset management. It defines four processes — inventory, deployment, operations and retirement. It matters most where you have heavy on-premises licensing. It is worth noting that it was designed for a world of installed software, so for a mostly-SaaS estate its tagging mechanics matter less than plain discovery and knowing which identity is consuming which licence.

ITAF, from ISACA, is the framework auditors themselves work to. Its fifth edition is the current one and it is the reason several things in the next section are changing.

These are not competitors. The sensible reading is that COBIT sets the goals, ITIL provides the methods, and ISO 27001 provides the certificate. Organisations that reach real maturity tend to use all of them, lightly, rather than one of them religiously.

A word of warning, though. Frameworks are a way to organise thinking, not a substitute for it. A binder full of policies that describe a company you do not work at is worse than a single page that is true.

Security is not the whole audit, but it is not nothing either, and the findings are remarkably consistent year to year.

Access is too broad. Developers with production database rights. QA staff who can reach live systems. Access granted for one project and never withdrawn.

Shared accounts. Four people using one admin login produces an audit trail that identifies nobody.

Leavers who never left. The gap between a resignation date and an account being disabled is easy for an auditor to measure and awkward to explain.

And above all, missing evidence. This is the big one. One estimate suggests around 71% of organisations would fail their first compliance audit as they currently operate — largely because they cannot prove what they do. There is a documented case of a company with strong controls in place that stalled its audit because twelve months of access reviews lived across three spreadsheets, two Slack threads and a Drive folder.

The rule auditors apply is unforgiving but logical: if you cannot show a control was working, they treat it as though it was not. Doing the work and keeping no record counts as not doing the work.

Audit practice is moving, and three shifts are worth knowing about because they change what you need to be ready for.

Sampling is being replaced by full testing. Auditors used to take forty items out of forty thousand and reason from the sample. Analytics now allow testing of the whole population. The bad month is no longer likely to fall outside the sample.

Annual is becoming continuous. A yearly review made sense when infrastructure changed yearly. With cloud and daily deployments, a snapshot from March says very little about June. Dashboards and automated checks are replacing the annual scramble, which is more work to set up and much less painful to live with.

The scope now includes the ecosystem. Your control environment is cloud providers, SaaS vendors, APIs and third parties. Auditing only what sits in your own building tests a shrinking share of your actual risk.

There is also a genuinely new problem that has arrived faster than the profession’s answer to it. AI can now produce documents, signatures and metadata that look entirely authentic. One auditor described opening a routine document during an engagement — correct format, plausible content, signatures in place — that had been generated end to end by AI. The old working principle of “trust but verify” assumed forgery was hard. It is not any more.

The practical consequence for anyone being audited is straightforward: evidence pulled directly from a system, carrying its own timestamps and its own trail, is worth far more than a document somebody typed up. Screenshots pasted into a slide deck are on their way to worthless.

And AI is arriving on the other side of the table too, doing the full-dataset testing and anomaly hunting that used to take weeks. The enthusiasm is running ahead of the governance, which is an odd look for the audit profession: roughly 90% of professionals believe colleagues are already using AI at work, but only about 22% say it has delivered the return they expected.

If this feels like a lot, it is. But the order of work is fairly clear, and it is not the order most people choose.

1. Build the list. Everything. Hardware, software, SaaS subscriptions, cloud accounts, domains, certificates. Discover it automatically where you can. This single step makes every other step possible, and skipping it makes every other step theatre.

2. Put a name on each item. One owner per system and per control. Not a team — a person. If the room goes quiet when someone asks who owns something, you have found a finding.

3. Check your licence position before someone else does. Especially for the big four vendors, and especially anywhere virtualisation is involved.

4. Look for the money. Unused seats, idle servers, duplicate tools, subscriptions for finished projects. This is the part of the audit that pays for the rest of it.

5. Write down what you are already doing. Most organisations do more than they can prove. Capture the evidence at the moment the work happens, in one place, with dates.

6. Then worry about frameworks. Not before. A framework applied to an estate you cannot see produces documentation, not control.

An IT audit is often treated as an exam to be survived, and there is a version of it that really is just that — a checklist, a week of stress, a report that goes in a drawer.

The more useful way to see it is as the one moment when somebody outside the day-to-day is required to ask the questions nobody has time for. What are we running? What are we paying for? Who is responsible? What happens when the person who understands this leaves?

Those questions are worth answering whether or not an auditor is coming. The organisations that handle audits well are rarely the ones with the most security tooling. They are the ones that already knew the answers.

Start with the number that should worry everyone. According to Flexera’s 2026 report on IT asset management, only 36% of IT teams say they have complete visibility of their technology estate. A year earlier it was 43%. Visibility is getting worse, not better.

Meanwhile the estate keeps growing. The average mid-market company now runs more than 250 SaaS applications. That is more software subscriptions than it has laptops. Nobody sat down and decided that. It accumulated.

This is where the phrase shadow IT comes in, and it is worth being fair about it. Shadow IT is not usually rebellion. It is a marketing team that needed a design tool on Tuesday and could not wait six weeks for procurement. The tool works. The problem is that it now holds customer data, it renews automatically, and it exists in no register anywhere.

The audit version of this problem is simple to state. If a system is not on your list, then:

• Nobody patches it
• Nobody reviews who has access to it
• Nobody cancels it when the team stops using it
• Nobody knows it exists when the data protection questions start

You cannot govern what you cannot see. Everything else in this article assumes you have solved this first, and most organisations have not.

This is the part that turns an audit from an inconvenience into a budget event.

Software licensing is deliberately complicated. Major vendors — Oracle, IBM, Microsoft and SAP are the ones that come up again and again — sell software under rules that are hard to apply and easy to breach by accident. Then they check.

The pattern is fairly consistent across the industry:

• Most large enterprises face a formal licence review every three to five years from at least one major vendor. Across a full portfolio of big vendors, something is being reviewed somewhere almost every year.
• One analysis puts unplanned compliance payments by Fortune 500 companies at around $2.4 billion a year.
• Oracle and SAP account for a disproportionate share of those payments compared with their share of deals.
• Median Oracle settlements for mid-market firms have been reported around $1.8 million. For Microsoft 365, over-deployment of premium E5 features is reported as the single biggest source of true-up findings, with median settlements of roughly $300,000 to $500,000 for estates of 1,000–5,000 seats.

Read that last one again, because it is the most ordinary way to get caught. Nobody pirated anything. Somebody enabled a feature that turned out to sit in a higher tier, across a few thousand accounts, for two years.

Two practical things are worth knowing.

First, a claim is an opening position, not a bill. Reported experience is that claims traded into a renewal negotiation often settle for something like 10 to 30 cents on the claimed dollar. The first letter is not the final number. Panic is expensive.

Second, most licence exposure is self-inflicted and findable. Common causes are dull: virtualisation that quietly multiplied the number of processors a database is deemed to run on, test environments licensed as if they were nothing, leavers still holding paid seats, and features switched on by default.

The defence is not clever. It is knowing your own position before someone else tells you what it is.

Licences are the money you might owe. This is the money you are definitely wasting.

Flexera’s 2026 cloud report puts cloud waste at 29% of cloud spend — and notably, that figure went up, ending five years of gradual improvement. Other estimates land around 27%. Organisations without a cost management practice waste somewhere in the region of 32–40%; mature ones get it down to 15–20%, which is better but still not small.

The causes are unglamorous. Idle compute is the biggest single bucket, followed by machines provisioned far larger than they need to be. Servers that someone started for a test in 2023 and never turned off. GPU fleets running at 30–40% utilisation because they were sized for a peak that happens twice a month.

SaaS has the same disease. One report puts SaaS waste at around 30% of spend — unused seats, two tools that do the same job bought by two departments, subscriptions for a project that ended.

Put a real number on it. A company spending £5 million a year on SaaS is likely burning something like £1.5 million on software nobody opens.

An audit that only checks security will walk straight past all of this. A good IT audit does not. Wasted money is a control failure like any other: it means purchases are being made without oversight, and nothing checks whether they are still needed.

Every organisation has one. The system that only Marek understands. The application that runs on a Windows version that stopped receiving patches years ago. The database everything depends on that nobody dares touch.

The cost of this is far larger than people assume. Estimates vary but they all point the same way: legacy maintenance absorbs somewhere between 40% and 60% of a typical IT budget, and in some organisations up to 80%. McKinsey has put technical debt at 20–40% of technology budgets. Left alone, technical debt grows roughly 20% a year, because every new thing you build on top of the old thing gets harder.

There is a security angle too, and it is the reason legacy shows up as an audit finding rather than a finance one. Unsupported systems cannot take security patches. They frequently cannot support modern controls like multi-factor authentication or zero-trust network access. So an old system is not just slow and expensive — it is a permanent hole in every control you have implemented everywhere else.

Auditors ask three questions here, and they are good questions to ask yourself:

1. What are you running that the vendor no longer supports?
2. What is the plan, with a date on it?
3. If the answer is “no plan”, who accepted that risk, and do they know they accepted it?

That third question is where most conversations get uncomfortable. Risk that nobody has formally accepted is risk that will land on somebody by surprise.

Here is something that never makes a headline but shows up in almost every audit report: your naming and documentation conventions.

It sounds trivial. It is not.

If your servers are called srv-prod-01, NewServer2, test-kasia, and db3-DO-NOT-DELETE, then nobody can answer basic questions from the list alone. Which of these are production? Which hold customer data? Who owns test-kasia, and is the person who created it still employed here?

Good practice in configuration management is dull and effective: one standard naming convention for everything — hardware, software, services, environments — where the name tells you the function, the environment, and the owner. No cryptic names. No initials of the person who happened to build it.

The same applies to the register itself, the CMDB or asset list. The recurring finding here is not that organisations lack one, but that theirs is wrong. It was accurate on the day it was built and has decayed ever since, because updating it is nobody’s actual job. An inventory that is 60% correct is arguably worse than none, because people trust it.

Two habits fix most of this:

• Discover automatically, do not type manually. Anything maintained by hand will drift.
• Audit the register itself, regularly. Check that what is in the list exists, and that what exists is in the list. Both directions.

If you look into IT governance you immediately hit a wall of standards, and most explanations are written for people who already understand them. The short version:

COBIT is about what should be controlled and how IT connects to business goals. It is the governance layer. Think of it as the map.

ITIL is about how you actually run IT services day to day — incidents, changes, requests, service desks. It is the operating manual.

ISO/IEC 27001 is about information security specifically, and it is the one you can be certified against. It is the security certificate customers ask for.

ISO/IEC 19770 is the one people forget: software and IT asset management. It defines four processes — inventory, deployment, operations and retirement. It matters most where you have heavy on-premises licensing. It is worth noting that it was designed for a world of installed software, so for a mostly-SaaS estate its tagging mechanics matter less than plain discovery and knowing which identity is consuming which licence.

ITAF, from ISACA, is the framework auditors themselves work to. Its fifth edition is the current one and it is the reason several things in the next section are changing.

These are not competitors. The sensible reading is that COBIT sets the goals, ITIL provides the methods, and ISO 27001 provides the certificate. Organisations that reach real maturity tend to use all of them, lightly, rather than one of them religiously.

A word of warning, though. Frameworks are a way to organise thinking, not a substitute for it. A binder full of policies that describe a company you do not work at is worse than a single page that is true.

Security is not the whole audit, but it is not nothing either, and the findings are remarkably consistent year to year.

Access is too broad. Developers with production database rights. QA staff who can reach live systems. Access granted for one project and never withdrawn.

Shared accounts. Four people using one admin login produces an audit trail that identifies nobody.

Leavers who never left. The gap between a resignation date and an account being disabled is easy for an auditor to measure and awkward to explain.

And above all, missing evidence. This is the big one. One estimate suggests around 71% of organisations would fail their first compliance audit as they currently operate — largely because they cannot prove what they do. There is a documented case of a company with strong controls in place that stalled its audit because twelve months of access reviews lived across three spreadsheets, two Slack threads and a Drive folder.

The rule auditors apply is unforgiving but logical: if you cannot show a control was working, they treat it as though it was not. Doing the work and keeping no record counts as not doing the work.

Audit practice is moving, and three shifts are worth knowing about because they change what you need to be ready for.

Sampling is being replaced by full testing. Auditors used to take forty items out of forty thousand and reason from the sample. Analytics now allow testing of the whole population. The bad month is no longer likely to fall outside the sample.

Annual is becoming continuous. A yearly review made sense when infrastructure changed yearly. With cloud and daily deployments, a snapshot from March says very little about June. Dashboards and automated checks are replacing the annual scramble, which is more work to set up and much less painful to live with.

The scope now includes the ecosystem. Your control environment is cloud providers, SaaS vendors, APIs and third parties. Auditing only what sits in your own building tests a shrinking share of your actual risk.

There is also a genuinely new problem that has arrived faster than the profession’s answer to it. AI can now produce documents, signatures and metadata that look entirely authentic. One auditor described opening a routine document during an engagement — correct format, plausible content, signatures in place — that had been generated end to end by AI. The old working principle of “trust but verify” assumed forgery was hard. It is not any more.

The practical consequence for anyone being audited is straightforward: evidence pulled directly from a system, carrying its own timestamps and its own trail, is worth far more than a document somebody typed up. Screenshots pasted into a slide deck are on their way to worthless.

And AI is arriving on the other side of the table too, doing the full-dataset testing and anomaly hunting that used to take weeks. The enthusiasm is running ahead of the governance, which is an odd look for the audit profession: roughly 90% of professionals believe colleagues are already using AI at work, but only about 22% say it has delivered the return they expected.

If this feels like a lot, it is. But the order of work is fairly clear, and it is not the order most people choose.

1. Build the list. Everything. Hardware, software, SaaS subscriptions, cloud accounts, domains, certificates. Discover it automatically where you can. This single step makes every other step possible, and skipping it makes every other step theatre.

2. Put a name on each item. One owner per system and per control. Not a team — a person. If the room goes quiet when someone asks who owns something, you have found a finding.

3. Check your licence position before someone else does. Especially for the big four vendors, and especially anywhere virtualisation is involved.

4. Look for the money. Unused seats, idle servers, duplicate tools, subscriptions for finished projects. This is the part of the audit that pays for the rest of it.

5. Write down what you are already doing. Most organisations do more than they can prove. Capture the evidence at the moment the work happens, in one place, with dates.

6. Then worry about frameworks. Not before. A framework applied to an estate you cannot see produces documentation, not control.

An IT audit is often treated as an exam to be survived, and there is a version of it that really is just that — a checklist, a week of stress, a report that goes in a drawer.

The more useful way to see it is as the one moment when somebody outside the day-to-day is required to ask the questions nobody has time for. What are we running? What are we paying for? Who is responsible? What happens when the person who understands this leaves?

Those questions are worth answering whether or not an auditor is coming. The organisations that handle audits well are rarely the ones with the most security tooling. They are the ones that already knew the answers.