What an IT audit includes and what it costs

Most mid-size companies order an IT audit for one of three reasons. Something went wrong, such as an outage, a breach or a failed project. Someone outside asks questions, such as a bank, an investor, an EU customer or a regulator. Or a new CFO or IT director wants to know what they have inherited.

The problem is the same each time. “IT audit” can mean a two-day checklist or a two-month investigation, and quotes vary to match. This guide explains what a proper IT audit includes, what you should get at the end, how long it takes and what drives the price.

The four types of IT audit

An IT audit is not one product. Most combine some of the four types below. Agree on which you need before comparing quotes.

1. Infrastructure audit. The auditor examines your network, servers, storage, backups and end-user hardware. What is out of support? What is a single point of failure? Can you actually restore your data, and how fast?

2. Security audit. This covers access rights, security policies, patching, logging and the configuration of firewalls and other protective systems. It often includes vulnerability scanning and, when agreed in writing, penetration testing. In a penetration test, a specialist tries to break in the way an attacker would.

3. Process audit. This looks at how people actually work with IT: requests, approvals, handoffs, change management and the service desk. It finds where work gets stuck or duplicated, and where the IT budget goes to projects the business does not value.

4. Compliance audit. This checks your controls against a specific standard or law. For companies in Ukraine and the EU, three come up most often:

• ISO/IEC 27001:2022. The international standard that specifies the requirements for an information security management system (ISMS). Its Annex A lists 93 controls grouped into four themes: organisational, people, physical and technological. Certificates issued against the older edition have expired: the transition deadline was 31 October 2025.
• NIS2. The EU directive on cybersecurity. It came into force in January 2023, and member states had until 17 October 2024 to transpose it into national law. As a general rule it applies to medium-sized and large entities in 18 critical sectors. Article 21 lists ten minimum measures, from risk analysis and incident handling to backup, supply chain security and multi-factor authentication. National laws differ. Portugal, for example, transposed NIS2 through Decree-Law 125/2025, which entered into force on 3 April 2026.
• GDPR. Article 32 requires appropriate security for personal data and a process for regularly testing and evaluating that security. A regular audit is one practical way to show that process exists.

A note for Ukrainian companies that sell to EU customers. NIS2 Article 21 covers supply chain security, including the relationship between an in-scope entity and its direct suppliers. Even if your company is outside NIS2, your EU customers may send you security questionnaires or ask for audit evidence. An independent audit report answers many of those questions at once.

What you should get at the end

The audit report is the product you pay for. A useful one contains:

• Findings with evidence. Each finding states what was checked, what was found and why it matters. “Backups are not tested” is a finding. “Backups could be improved” is not.
• A risk ranking. Findings are ranked by likelihood and business impact, so management knows what to fix first.
• A gap map for compliance audits. Each requirement or control of the chosen standard is marked as met, partly met or missing.
• Costs. An estimate of what the main risks could cost the business and what fixing them costs.
• A roadmap. Fixes grouped into what to do now, next quarter and next year, with owners and budget.
• A management summary. A few pages your board can read in minutes.

If the auditor’s sample report lacks these, so will yours.

How long an IT audit takes

Duration depends on scope more than on anything else. A typical audit runs in four phases:

1. Scoping. Agree on the sites, systems, legal entities and standards in scope.
2. Data collection. Document review, interviews and read-only technical checks.
3. Testing. Vulnerability scanning and penetration testing, if they are in scope.
4. Reporting. Analysis, risk ranking, roadmap and a readout to management.

For a single-site company with one IT team, the whole cycle typically takes 3 to 4 weeks, up to a month. Groups with several legal entities, sites or countries take longer, mainly because there are more people to interview and more systems to check.

What drives the cost

We found no reliable public source for IT audit prices in Ukraine or the EU, so this guide gives no price ranges. What we can do is explain what moves the price, so you can compare quotes on the same basis.

• Scope. Each audit type you add (infrastructure, security, process, compliance) adds work.
• Sites and legal entities. Every additional office, plant or subsidiary means more systems, more interviews and often travel.
• Number of systems. ERP, CRM, e-mail, cloud services, industrial systems. Each one in scope is reviewed.
• Interviews. How many IT staff, managers and process owners must be interviewed.
• Testing depth. A vulnerability scan is quick. A manual penetration test of your external perimeter and internal network takes far more specialist time.
• Standards. A gap assessment against all ISO/IEC 27001 Annex A controls takes longer than a general security review. Each extra framework, such as NIS2 or GDPR, adds mapping work.
• Tooling. Whether scanners or other tools must be installed in your network.
• Your documentation. If network diagrams, asset lists and policies exist and are current, the audit is faster and cheaper.

The cost of not auditing is easier to find. Under NIS2, member states must allow fines for essential entities of up to at least EUR 10 million or 2% of worldwide annual turnover, whichever is higher, and for important entities up to at least EUR 7 million or 1.4%. A breach of GDPR Article 32 can be fined up to EUR 10 million or 2% of worldwide turnover. NIS2 also makes management accountable: under Article 20, management bodies must approve the cybersecurity measures, oversee them and follow training.

At Tymko Tech, we scope each audit in a 30-minute call and then send a written proposal with scope, timeline and price.

How to prepare

You can cut the audit time and cost by preparing a few things in advance:

• Name one internal owner who books interviews and chases documents.
• Collect what exists: network diagrams, server and software inventory, IT policies, backup schedules, vendor contracts and the list of who has administrator rights.
• List your known problems. Telling the auditor up front saves time for the problems you do not know about.
• Decide the standard you want to be measured against, if any, before the scoping call.
• Check your incident process. Under NIS2 Article 23, in-scope entities must send an early warning within 24 hours of becoming aware of a significant incident and a notification within 72 hours. Know who would do that in your company.
• Approve testing in writing. Penetration tests need a written scope, a time window and a named contact on your side.

Red flags when choosing an auditor

• They promise certification. A consultant cannot certify you. ISO/IEC 27001 certificates are issued by an independent certification body. A consultant prepares you for that audit.
• They quote a fixed price without a scoping call. Either the scope is tiny or the price includes a large safety margin.
• They cannot show a sample report. Ask for an anonymised one. If they have none, you do not know what you are buying.
• They work only from a checklist. A questionnaire without interviews and technical checks records what people say, not what is true.
• They still quote the 2013 edition of ISO/IEC 27001. The 2022 edition is current.
• The report has no ranking and no costs. A list of 200 findings with equal weight is not a decision tool.
• The audit is a sales funnel. Many auditors, including us, also implement fixes. That is fine if the report stands on its own and you are free to implement it with anyone.

Example: what an audit changed at Stork Investment

Stork Investment is a Ukrainian group in agro, trading and sauce manufacturing. As the business scaled, its IT fell behind: security was fragmented, there was no disaster recovery plan, and IT goals were not aligned with business goals.

We started with an IT audit and mapped every business process. The first decision was not technical: the group cut its IT project portfolio down to what delivered value. Then came the fixes from the roadmap. We integrated key security tools, migrated on-premises infrastructure to the cloud and built a business continuity and disaster recovery plan. A central change management office now coordinates all IT projects.

The results: operating costs fell 20% after the cloud migration, and project delivery became 35% faster. Group CFO Oleksandr Berezyuk said the audit and strategy work was “marked by Ivan’s deep knowledge and systematic approach”. Read the full Stork case.

Next step

Tymko Tech runs infrastructure, security, process and compliance audits for mid-size companies, remotely and anywhere in the world. Our founder Ivan Tymko is trained and examined as an ISO/IEC 27001:2022 manager and internal auditor (Quay Audit Ukraine, certificate QAUA/02/235/23).

Want to know what an audit would cover and cost for your company? Book a 30-minute scoping call.