Sample audit programs for IT audit.
Audit objective, scope, audit steps with procedure and expected evidence, plus a document list and typical findings. A starting point for your next IT audit.
Last updated: 13 October 2026
What an audit program does
An audit program turns an audit objective into individual audit steps. Each step names a criterion, the procedure you use to assess it and the evidence you expect. This keeps the audit traceable and lets several auditors carry it out in the same way.
The samples on these pages are deliberately compact. They do not replace audit planning, but they give a sound start, even when a topic is new on your audit plan.
The samples at a glance
-
NIS2
NIS2: Access management
How to audit whether access rights are granted only to authorised people, reviewed regularly and withdrawn in time, including privileged accounts and multi-factor authentication.
13 audit steps
-
DORA
DORA: ICT third-party risk
How to audit whether a financial entity manages the risks arising from ICT service providers: strategy, register of information, pre-contract assessment, contract terms and exit.
14 audit steps
-
BSI baseline protection
BSI baseline protection: Backup and recovery
How to audit whether backups are complete, protected and actually recoverable, based on the IT baseline protection module CON.3 data backup concept.
13 audit steps
-
NIS2, ISO 27001
Patch and vulnerability management
How to audit whether vulnerabilities are detected, assessed by risk and fixed within defined deadlines, related to NIS2, the module OPS.1.1.3 and Annex A of ISO/IEC 27001.
13 audit steps
-
BSI 200-4, NIS2
Business continuity management
How to audit whether an organisation can continue or restore critical processes during disruptions, based on BSI standard 200-4 and the module DER.4.
14 audit steps
-
BSI, ISO 27001
Change management
How to audit whether changes to IT systems are requested, assessed, approved, tested and documented, and whether any change bypasses the procedure.
13 audit steps
-
ISO 27001, BSI, DORA
Logging and monitoring
How to audit whether security-relevant events are logged completely, retained in a protected way, evaluated and followed up in good time when something stands out.
12 audit steps
-
ISO 27001, DORA, BSI
Cloud use and outsourcing
How to audit whether cloud services are selected under a defined strategy, secured by contract, configured securely and monitored, and whether an exit remains possible.
12 audit steps
-
NIS2, ISO 27001, BSI
Privileged access
How to audit whether administrator and other privileged accounts are recorded, limited, specially secured and used in a traceable way.
12 audit steps
-
ISO 27001, NIS2
Supplier management
How to audit whether service providers and suppliers are selected by risk, bound by contract, monitored on an ongoing basis and properly offboarded when the relationship ends.
12 audit steps
-
NIS2, DORA, ISO 27001
Security incidents and reporting
How to audit whether security incidents are detected, classified, handled and reported to the competent bodies within the deadlines, and whether the organisation learns from them.
13 audit steps
-
ISO 27001, BSI
Network security and segmentation
How to audit whether networks are designed securely, separated into zones, controlled by firewalls and managed in operation and change.
12 audit steps
-
GDPR
Data protection: technical and organisational measures
How to audit whether the security of processing personal data is appropriate to the risk and whether the effectiveness of the measures is reviewed regularly.
12 audit steps
View sample: Data protection: technical and organisational measures
-
BSIG
Critical infrastructure: evidence audit
How to audit whether the risk management measures of an operator of critical facilities are implemented and evidenced so that the proof submitted to the Federal Office holds up.
11 audit steps
-
ISO 27001, BSI, NIS2
Secure software development
How to audit whether software is developed with defined security requirements, reviewed and tested, and whether source code and environments are protected.
12 audit steps
-
ISO 27001, DORA, NIS2
IT asset and configuration management
How to audit whether hardware, software, cloud resources and information assets are recorded completely, assigned to owners and kept current together with their dependencies.
12 audit steps
-
BSI, ISO 27001
Endpoint and mobile device security
How to audit whether desktops, laptops, smartphones and tablets are managed uniformly, hardened, encrypted and locked quickly when lost.
12 audit steps
-
BSI, ISO 27001, RFC
Email security
How to audit whether email domains are protected against spoofing, messages are encrypted in transit and phishing and malware are intercepted effectively.
12 audit steps
-
NIS2, DORA, BSIG
IT governance and IT strategy
How to audit whether IT is steered from the business strategy, management exercises its accountability and objectives, risks and resources are directed in a traceable way.
12 audit steps
-
ISO 27001, BSI
ISMS under ISO/IEC 27001
How to audit whether the information security management system meets the requirements of clauses 4 to 10 and works in daily practice, not only on paper.
13 audit steps
-
NIS2, BSI, ISO 27001
Cryptography and key management
How to audit whether encryption is used according to a concept with recognised algorithms and whether keys and certificates are protected across their whole life cycle.
12 audit steps
-
ISO 27001, BSI
Physical security of data centre
How to audit whether the data centre, server rooms and technical rooms are protected against unauthorised access, fire, water, overheating and power failure.
12 audit steps
-
BSI, ISO 27001, BSIG
Active Directory and Entra ID
How to audit whether the central directory services are protected against takeover, privileged rights stay tightly limited and recovery after an attack is possible.
13 audit steps
-
ISO 27001, BSI
Software asset management
How to audit whether software in use is recorded completely, properly licensed and used economically and whether the organisation is prepared for a vendor audit.
12 audit steps
-
BSI, ISO 27001, GoBD
SAP authorisations
How to audit whether authorisations in the SAP system are granted according to a concept, segregation of duties is maintained and critical rights, emergency access and changes to the production system are controlled.
13 audit steps
-
ISO 27001, GDPR, GoBD
IT projects
How to audit whether an IT project is steered in an orderly way, considers security and data protection from the start and moves into operation with tested acceptance and data migration.
12 audit steps
-
GoBD, AO, HGB
Archiving and GoBD
How to audit whether records relevant under German tax and commercial law are retained completely, immutably and readably for the whole period and whether the process documentation proves this.
12 audit steps
-
NIS2, ISO 27001, BSI
Security awareness and training
How to audit whether employees, managers and IT staff are made aware and trained regularly and in line with their tasks and whether this has a measurable effect.
13 audit steps
-
BSI, ISO 27001, NIS2
Remote access and mobile working
How to audit whether access from outside uses secured paths with strong sign-in, reaches only what is needed and whether working from home and on the move is governed.
12 audit steps
How to use them
The samples refer to laws, regulations and standards only as references and do not reproduce their text. They are working material and not legal advice. Adjust scope and depth to your organisation, your risks and the provisions that apply to you.
Article: how to write an IT audit program
Article: audit planning 2027 under NIS2 and DORA
Article: tracking audit findings under DORA, MaRisk and the IIA Standards
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
View a complete sample package View pricing Product overview