IT governance and IT strategy audit program.
How to audit whether IT is steered from the business strategy, management exercises its accountability and objectives, risks and resources are directed in a traceable way.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether an approved IT strategy is derived from business objectives and whether roles, committees, policies, metrics and reporting lines enable effective direction of IT by management. It also assesses whether management approves and oversees the cybersecurity risk management measures and receives training on them.
Scope
- IT strategy, IT committees and decision processes of the organisation
- Roles of management, IT leadership, information security and control functions
- Budget and resource planning, metrics and reporting to management
- Out of scope: the technical audit of individual projects or systems
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | An IT strategy exists, is derived from the business strategy, approved by management and reviewed regularly. | DORA Art. 6(8) | Read the strategy, check approval and date, and trace its derivation from business objectives for three objectives. | IT strategy with approval, business objectives, record of the last review |
| 2 | Management approves the cybersecurity risk management measures and oversees their implementation. | NIS2 Directive Art. 20(1); § 38(1) BSIG | Review minutes of management meetings for the last twelve months for approvals, reports and decisions on security. | Meeting minutes, decision papers, status reports |
| 3 | Roles, responsibilities and authorities for IT and information security are defined and filled. | ISO/IEC 27001:2022 Annex A 5.2; DORA Art. 5(2)(c) | Reconcile organisation chart, committee charters and job descriptions; note gaps and overlaps. | Organisation chart, committee charters, role descriptions |
| 4 | The organisation has defined how much IT risk it is prepared to bear, and this tolerance is aligned with its risk appetite. | DORA Art. 6(8)(b) | Read the risk tolerance document and check whether thresholds are actually used in decisions and reports. | Risk tolerance statement, risk report with thresholds |
| 5 | Metrics are defined, measured and reported for IT and information security objectives. | DORA Art. 6(8)(c) | Review the metrics catalogue and trace measurement method, data source and last reporting for three metrics. | Metrics catalogue, metrics report, data sources |
| 6 | Budget and resources for IT, security and skills are planned and reviewed regularly. | DORA Art. 5(2)(g) | Review budget plan and actuals and check whether security and training needs are shown. | Budget plan, budget report, resource plan |
| 7 | A framework of policies is approved, communicated and reviewed at set intervals. | ISO/IEC 27001:2022 Annex A 5.1 | Analyse the policy register: approval, owners, date of last review. | Policy register, approval notes |
| 8 | Members of management attend training on cyber risks regularly. | NIS2 Directive Art. 20(2); § 38(3) BSIG | Request attendance records for management and check training content on risk assessment and impact. | Attendance records, training material |
| 9 | Management is informed regularly about major incidents, provider contracts and planned changes regarding critical providers. | DORA Art. 5(2)(i) | Check reports to management for the last four quarters for this content. | Management reports, distribution lists, minutes |
| 10 | A target architecture is described, and investments and projects are aligned with it. | DORA Art. 6(8)(d) | Compare target architecture and project portfolio and trace the justification for three initiatives. | Target architecture, project portfolio, decision papers |
| 11 | Governance of IT and information security is reviewed independently, for example by internal audit. | ISO/IEC 27001:2022 Annex A 5.35; DORA Art. 6(6) | Review the audit plan and reports of the last two years and follow up the status of actions. | Audit plan, audit reports, action tracking |
| 12 | Incompatible duties, such as operating and controlling the same systems, are segregated. | ISO/IEC 27001:2022 Annex A 5.3 | Check IT role design for conflicts and trace compensating controls for remaining conflicts. | Role descriptions, conflict matrix, evidence of compensating controls |
Documents to request
- IT strategy with approval and evidence of review
- Organisation chart and charters of IT committees
- Risk tolerance statement
- Metrics catalogue and metrics reports
- IT budget plan and budget report
- Policy register
- Reports to management for the last four quarters
- Training records of management
Typical findings
- The IT strategy is outdated or has never been approved by management.
- Management receives no regular reports on cyber risks.
- Metrics are defined but not measured or not reported.
- Risk tolerance is not described, decisions lack a yardstick.
- Members of management have not attended training on cyber risks.
- Policies are not reviewed, owners are not named.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing