IT project audit program.
How to audit whether an IT project is steered in an orderly way, considers security and data protection from the start and moves into operation with tested acceptance and data migration.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether an IT project is run with a clear mandate, a suitable organisation and effective control of time, budget, scope and risks. It also assesses whether information security and data protection requirements are included, tests and acceptance are documented, data is migrated completely and correctly and operations are handed over properly.
Scope
- One selected ongoing or recently completed IT project
- Project mandate, project organisation, planning, reporting and change control
- Security and data protection requirements, testing, acceptance, data migration and handover to operations
- Out of scope: the technical correctness of individual design decisions
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A binding method with phases and decision points applies to projects. | ISO 21502:2020; ISO/IEC 27001:2022 Annex A 5.8 | Read the method and check for the selected project whether the defined decision points were passed. | Project management handbook, evidence of phase decisions |
| 2 | An approved project mandate describes objective, benefit, scope, budget and deadlines. | ISO 21502:2020 | Read the mandate and business case and check approval by the sponsor. | Project mandate, business case, approval note |
| 3 | The project organisation with sponsor, steering committee and project management is defined and works demonstrably. | ISO 21502:2020 | Check the project organisation chart and steering committee minutes for decisions and escalations. | Project organisation chart, steering committee minutes |
| 4 | Information security is anchored in the project: protection needs and security requirements are determined early. | ISO/IEC 27001:2022 Annex A 5.8 and 8.26 | Check whether protection needs and security requirements are documented and assessed by the security officer. | Protection needs assessment, security requirements, information security statement |
| 5 | Data protection by design is considered; where required, a data protection impact assessment has been carried out. | Art. 25 and 35 GDPR | Trace the involvement of data protection and review the threshold check or impact assessment. | Statement of the data protection officer, threshold check, impact assessment |
| 6 | Project risks, including information security risks, are recorded, assessed and followed up with actions and owners. | ISO 21502:2020; ISO/IEC 27001:2022 Annex A 5.8 | Check the risk list for currency and trace actions and status for three risks. | Risk list, status reports |
| 7 | Progress, budget and deadlines are measured regularly and reported to the sponsor. | ISO 21502:2020 | Analyse status reports with planned versus actual comparison of costs and dates. | Status reports, project plan, budget overview |
| 8 | Changes to project scope are requested, assessed and approved. | ISO 21502:2020 | Check change requests for assessment of cost, time and risk and for approval. | Change requests, approvals |
| 9 | Testing and acceptance follow documented criteria; security testing is included. | ISO/IEC 27001:2022 Annex A 8.29 | Review test concept, test results and acceptance record and assess open defects at acceptance. | Test concept, test records, acceptance record |
| 10 | Data migrations are checked for completeness and correctness; legacy data remains analysable for the retention period. | GoBD para. 142 | Check the migration concept and reconciliation evidence such as totals and record counts and clarify the handling of the legacy system. | Migration concept, reconciliation records, legacy data concept |
| 11 | Handover to operations goes through the change process with operating documentation and owners. | ISO/IEC 27001:2022 Annex A 8.32 | Check the handover record and the change request for go-live. | Handover record, operations manual, change request |
| 12 | The project is formally closed; lessons learned and benefit realisation are evaluated. | ISO 21502:2020 | Read the closure report and check whether a benefit review is planned or done. | Closure report, lessons learned, benefit review |
Documents to request
- Project management handbook
- Project mandate and business case
- Steering committee minutes and status reports
- Risk list and change requests
- Protection needs assessment and security requirements
- Data protection statement and, where applicable, impact assessment
- Test concept, test records and acceptance record
- Migration concept with reconciliation evidence
Typical findings
- The project mandate was never formally approved.
- The steering committee meets rarely and takes no documented decisions.
- Security and data protection are involved only shortly before go-live.
- Scope changes are implemented without assessment.
- Acceptance is given despite open severe defects.
- The data migration is not reconciled, legacy data cannot be read after shutdown.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing