Client IT security audit checklist: how suppliers can prepare

Why clients audit their suppliers

Your contract with a client includes a right-to-audit clause, and now they want to make use of it. Their auditor, either an internal employee or someone they hired from an external firm, will check how you protect the client’s data and how you deliver your services to them. They send you a security questionnaire that asks you to describe your controls, or worse, they visit you onsite to see the controls in action. They then need to check the evidence that the controls are in place and operating effectively.

Client audits are becoming more common, often driven by regulation. NIS2 pushes many companies offering critical services to manage security risks in their supply chain, and DORA requires financial sector companies to include audit rights in contracts with their ICT suppliers.

For a small supplier without a security team, an audit can feel daunting. But most of the work is preparation, and preparation should follow a predictable pattern. The following checklist covers what to do before, during and after a client IT security audit. Applying the checklist in your operations will help you standardize this process and stay ahead of any relevant inquiries.

What auditors usually check

Although the scope may differ depending on the client, contract in place or services offered, most supplier security audits go through these areas:

Keep in mind that a policy alone is rarely enough. Usually, auditors want to see that a control actually works. They are more interested in a dated record of an access review, not just a policy that says you do one. This is why it is important to keep accurate records and keep them up to date.

The audit preparation checklist

Preparing a checklist during the various phases of an announced audit will save you a lot of time and effort, which can be invested in addressing the audit items as well as possible. Here’s how to set the checklist up, depending on the phase of the audit:

As soon as the audit is announced

• Read the audit clause and security annex in your contract: notice period, frequency, who pays and confidentiality. Confirm any issues with your client and/or the auditor.
• Confirm the scope in writing: which services, systems and locations are in scope, whether the audit will be remote or on-site, and the dates.
• Ask the auditor for the agenda and document request list in advance.
• Appoint one coordinator for all communication with the auditor.
• Inform your IT provider and other key suppliers, and check they are available on the audit dates, if needed.
• Inform and prepare your internal staff.
• Perform a sanitization of your physical facility/facilities, if the audit will be performed on-site.
• Check that a confidentiality agreement covers the audit. If not, ask the client and auditor to sign a non-disclosure agreement (NDA) first.

In the weeks before the audit

• Re-read what you have committed to: questionnaire answers, the validity of your controls, the contract’s security annex and any certifications you mentioned. The auditor will test these.
• Collect your evidence in one folder, sorted by the audit scope. Use the table above as a guide.
• Check that evidence is current and dated. Replace old screenshots and update policies past their review date.
• Close quick gaps, such as turning on MFA, removing leaver accounts and enabling basic access controls. Record what you changed and when.
• List the gaps you can’t fix in time, each with a plan and a target date.
• Brief everyone who may be interviewed: answer the question asked, stick to facts and say “I’ll check” when unsure.
• For on-site audits, book a room, arrange visitor access and check what is visible on desks and screens.

During the audit

• Start with an opening meeting to confirm the scope, agenda and contacts.
• Where possible, show confidential material on screen instead of handing over copies or sending documents via email.
• Keep a log of every document you share and every question you need to follow up on.
• Stay within the agreed scope. Politely flag requests outside it, such as data about other clients or services not in scope for the client.
• Ask for clarification when a question is unclear.
• Ask for a closing meeting to hear the initial findings before the report arrives.

After the audit

• Review the draft report and correct factual errors before it is final. Liaise with the client and/or auditor to ask any questions and clarify items of uncertainty.
• Agree a remediation plan with a realistic date for each finding.
• Track progress and send the client updates as agreed.
• Save your evidence and answers for the next audit or questionnaire.

By incorporating the above checklist in your operational practice, tackling such audits will become much easier and less time-consuming, allowing you time to actually prepare and address critical points.

Four mistakes to avoid

• Writing policies the night before. Auditors can tell when a policy is sloppy or isn’t followed. A short policy that matches what you actually do is stronger than a long one nobody uses or is even aware of.
• Backdating or editing evidence. Never do this. It turns a simple finding into a loss of trust, and possibly a breach of contract.
• Promising unrealistic fix dates. A missed deadline looks worse than a later, realistic one.
• Sharing more than the scope requires. Keep other clients’ data, full system exports and unrelated documents out of the audit unless agreed. Always keep confidentiality at the forefront of those efforts.

How EvRisko helps

An audit tests your controls against evidence. Knowing where you stand beforehand lets you fix gaps on your own schedule, not the auditor’s.

EvRisko asks plain-language questions about your IT setup. You get a risk score from 0 to 100, rated Poor, Fair or Good, and a list of what to fix first. The questions draw on established frameworks such as ISO27001 and NIST, so they cover the basics auditors tend to look at. A first score takes about 25 minutes, and no technical knowledge is needed. You can export the results as a PDF report to guide your preparation.

Frequently asked questions