One word for very different engagements
Asking the price of an IT audit without specifying its scope is like asking the price of a survey without saying what needs surveying. The same term covers engagements that have neither the same duration, nor the same depth, nor the same usefulness.
At one extreme, an automated scan run across the network produces a report in half a day. At the other, a full review of the infrastructure, backups, directory, access rights and contracts takes several days of analysis and interviews. In between, there are audits targeted at a specific area, which answer a clearly identified question rather than a general need for visibility.
This confusion explains most disappointments. A company that commissions an audit expecting an action plan sometimes receives a list of technical vulnerabilities with no priorities; conversely, a company that wanted to check one specific point is offered an oversized full review.
The parameters that set the price
The cost of an audit is almost always calculated from the time required, which itself depends on a few concrete factors.
The number of workstations and servers gives the initial order of magnitude, but it matters less than people think: going from thirty to fifty similar workstations changes little in the analysis. What weighs more is how heterogeneous the estate is, the presence of an Active Directory with its history of accumulated exceptions, the number of business applications, and the existence of remote sites or home working.
The state of existing documentation plays an underestimated role. Auditing a documented infrastructure, whose diagrams, contracts and procedures are known, goes much faster than reconstructing a reality nobody has written down for eight years. It is often this point, more than size, that explains a price gap between two comparable companies.
Finally, the expected depth shapes everything else. An assessment that lists and ranks does not require the same work as an actual verification, where a backup restore is really tested or the real permissions on file shares are examined rather than the declared ones.
What separates a useful audit from just another report
The real quality criterion is not the size of the document handed over. A hundred-page report generated by a tool, listing hundreds of findings without any ranking, takes up more space than it adds value.
An actionable audit has four characteristics. It starts from a business question rather than a technical inventory: what does the company risk, where are its dependencies, what happens if a given component fails. It ranks findings by real impact on the business, not by a generic score. It proposes concrete actions, estimated in effort and ordered in time. And it clearly separates what is urgent, what can wait for the next budget and what deserves no action at all.
That last point is telling. An auditor who finds nothing to set aside and recommends dealing with everything is producing a shopping list rather than a diagnosis.
Conflict of interest: a question to ask from the start
There is a structural bias in this trade: a provider that sells both the audit and the remediation has an objective interest in finding a lot to fix. It is not necessarily dishonest, but it deserves to be put on the table before you commission anything.
Several signals help you guard against it. An audit whose conclusions systematically point to the provider's own catalogue deserves a critical eye. A report that mentions no alternative solution, including those the provider does not sell, is incomplete. And an engagement invoiced at a token price, or even offered free of charge, is generally not an audit but a pre-sales phase.
The reverse is just as true: refusing on principle to let a provider carry out the remediation afterwards deprives the company of the knowledge gained during the audit, which costs time at the start. The sensible solution is to separate the two commitments explicitly, to obtain a deliverable that any other provider can use, and to keep the freedom to have the fixes carried out elsewhere.
What the quote should contain
Before comparing two proposals, a few items must appear in black and white, otherwise the prices cannot be compared.
The exact scope: which systems, which sites, which areas are covered, and above all which are not.
The way of working: read-only analysis, interviews, active tests, and the corresponding written authorisation.
The list of deliverables: report, prioritised action plan, verbal debrief, usable spreadsheets.
The estimated effort in days and the timetable.
What is explicitly excluded, in particular implementing the fixes.
Ownership of the report and whether another provider can reuse it.
A quote that announces a fixed price without detailing these points leaves complete latitude over the real depth of the work.
When to trigger it
Timing matters as much as budget. An audit commissioned at the wrong moment costs the same but delivers much less, because its conclusions arrive after the decisions have been made.
Several situations justify triggering it ahead of time rather than in reaction. A known deadline, such as an end of support or a hardware refresh, is better prepared on the basis of an assessment than on a hunch. Rapid headcount growth almost always exposes infrastructure choices designed for a previous size. A change of IT provider is the ideal moment to establish a documented starting point, before the knowledge leaves with the previous one. Finally, new regulatory obligations (NIS2 in the European Union, for example) or customer security requirements make it necessary to know where you stand before committing contractually.
Conversely, an audit commissioned after an incident mainly serves to understand what happened. It is useful, but it is a post-mortem analysis, not a preventive approach, and it takes place in a tense context that harms the quality of decisions.
The cost of not auditing
The calculation is rarely done this way round, yet it is the most telling. A company that does not know the state of its backups, the exposure of its directory or the age of its systems is not saving money: it is postponing an expense while accepting not to know when it will occur or how much it will cost.
The cost items are well known. A business interruption, whose daily cost almost always exceeds that of a full audit. Emergency remediation, systematically more expensive than planned action. Licences paid for unused services, which an inventory frequently reveals. And hardware replaced in a hurry rather than within a controlled cycle.
In many SMEs, the savings identified on contracts and licences are enough to cover part of the cost of the audit itself, without even counting the risk avoided.
Start with the right scope
For a company that has never had its IT audited, aiming for exhaustiveness from the outset is rarely the right choice. An audit targeted at the most critical point, backup and restore in most cases, brings more than a diluted general review.
The exercise also has a practical virtue: it lets you judge the provider's way of working on a limited engagement before going further. That is the logic of our IT audit and our Active Directory audit, both limited to a defined scope with an actionable deliverable, and both carried out remotely. The method is detailed in our article on the information system audit in five steps.