IT audit plan generator
Your key facts produce a first annual plan in a minute: which topics come first, in which quarter, with how many auditor days. As a table and as an Excel file.
Free, no account. Your inputs stay in your browser and are not transmitted.
Example: mid-sized organisation under NIS2
120 auditor days, 20% reserve, Microsoft environment, cloud services and larger IT projects. With these inputs the generator produces this for 2027:
| Start quarter | Audit topic | Auditor days | Why |
|---|---|---|---|
| Q1 | NIS2: Access management | 15 | NIS2 link |
| Q1 | BSI baseline protection: Backup and recovery | 10 | NIS2 link |
| Q2 | Patch and vulnerability management | 10 | NIS2 link |
| Q2 | Business continuity management | 10 | NIS2 link |
| Q2 | Change management | 10 | NIS2 link |
| Q3 | Privileged access | 10 | NIS2 link |
| Q3 | Security incidents and reporting | 10 | NIS2 link |
| Q4 | Logging and monitoring | 10 | NIS2 link |
| Q4 | Cloud use and outsourcing | 10 | NIS2 link, Cloud and outsourcing |
Not planned because capacity is too low: Supplier management, Network security and segmentation, IT asset and configuration management, Email security, IT governance and IT strategy, ISMS under ISO/IEC 27001, Cryptography and key management, Active Directory and Entra ID, Security awareness and training, Remote access and mobile working, IT projects, Data protection: technical and organisational measures, Endpoint and mobile device security, Software asset management, Archiving and GoBD.
The rules behind the plan
- Every topic comes from our library of sample audit programs and starts with a base weight. Patch management, privileged access, change management, backup, business continuity, security incidents and data protection count double because they affect almost every organisation.
- If NIS2 or DORA applies, the related topics get 3 additional points, the program for the regulation itself 2 more. For NIS2 the mapping is the same as in the scope check. For DORA we also include backup, business continuity, patch and change. We count critical facilities as NIS2 too and treat the evidence audit like the program for the regulation.
- Your other inputs give matching topics 2 points unless they already have regulation points. Topics such as SAP, data centre or NIS2 only appear if they apply to you.
- The highest scores come first and early in the year. If a topic no longer fits, a smaller one moves up. The reserve stays unplanned. With equal scores the library order applies, which is not a professional judgment.
Reference values per audit: 6 auditor days up to 250 employees, 10 up to 2,000 and 16 above. Broad topics such as ISMS, DORA or SAP use a factor of 1.5. These are our assumptions, not a requirement.
What the draft does not do
- It does not replace a risk assessment: it knows neither your audit objects nor earlier findings, incidents or the last audit date.
- It does not assess whether NIS2 or DORA applies to you and does not set a mandatory audit cycle.
- A topic may cover several audits or systems for you. You need to adapt auditor days and scope. Without NIS2, only privileged access and Active Directory remain for access rights, so add further topics yourself.
- All information without warranty. For presenting it to a committee you need your own justification.
From draft to an approved annual plan
In ProAuditMap you maintain your audit objects and rate them with a configurable risk model. The application proposes the annual plan from them; annual planning is included from the Team plan. Each audit gets a complete audit package.
View sample package Request a test View sample audit programs