IT Audit Checklist for Small Business: What to Check and Fix

An IT audit is a planned check of every part of your business technology: the hardware, the software, the accounts, the backups and the security around them. Most small businesses never do one on purpose. They find out what is wrong when a laptop dies, a server fills up or a former employee still has access to the shared drive.

This IT audit checklist gives owners, office managers and operations leads in Toronto and the GTA a practical way to review their own setup. Work through it yourself, or hand it to a provider. If you want the security side done by a specialist, our cybersecurity assessment service covers it in depth, and our managed network and IT support keeps the results in place month after month.

Each section below lists what to check and why it matters. Mark each item as done, needs work or unknown. The unknowns are often the most important findings.

Before You Start Your IT Audit

A technology audit goes faster with a little preparation:

• Pick an owner. One person collects the answers, even if others supply them.
• Gather your paperwork: internet and phone contracts, software licences, warranty records, your domain registrar login and any IT provider agreement.
• Get admin access to your Microsoft 365 or Google Workspace account, your firewall and your backup system, or know who holds it.
• Set a scope. For a multi-site business, audit one office fully before moving to the next.

1. Hardware and Asset Inventory

You cannot protect or budget for equipment you do not know you have.

• List every desktop, laptop, server, tablet and phone the business owns, with the user, model and purchase date.
• Note which devices are past their warranty or nearing the end of their useful life.
• Check that every computer runs an operating system version still supported by its maker.
• Include network equipment: firewall, router, switches, WiFi access points and the modem from your internet provider.
• Do not forget printers, security cameras, door controllers and other connected devices.
• Record where retired devices went and confirm their drives were wiped or destroyed.

2. Software and Licences

• List all business software, including cloud subscriptions paid on someone's credit card.
• Confirm you hold enough licences for the number of users, and cancel the ones nobody uses.
• Remove software that is no longer supported or no longer needed.
• Check that automatic updates are on for operating systems, browsers and common applications.
• Write down who has the admin login for each important system.

3. Accounts and Access

Access problems are one of the most common findings in any IT security audit.

• Compare the user list in your email system against your current staff list. Disable accounts for anyone who has left.
• Check that multi-factor authentication (MFA) is on for email, remote access, banking and every admin account. Our post on why MFA is non-negotiable explains why this matters so much.
• Look for shared logins. Each person should have their own account so actions can be traced.
• Limit admin rights. Most staff do not need administrator access on their computer.
• Confirm there is a written process for setting up new staff and removing departing staff on their last day.
• Make sure at least two trusted people can reach critical admin accounts, so the business is not locked out if one person is unavailable.

4. Network and Internet

A network audit looks at how your office connects internally and to the outside world.

• Change all default passwords on the firewall, router, switches and access points.
• Update firmware on network equipment.
• Review firewall rules and close any port that is open to the internet without a clear business reason.
• Separate guest WiFi from the network your staff and servers use.
• Use WPA2 or WPA3 encryption on WiFi, and change the staff WiFi password when people leave.
• Label your network cabinet and keep a simple diagram showing what connects to what.
• Note your internet speed, your provider's contract end date and whether you have a backup connection.

5. Security Controls

• Confirm every computer has antivirus or endpoint protection that is running and reporting.
• Check that patches are installed within a reasonable time after release, not months later.
• Turn on disk encryption for laptops and any device that leaves the office.
• Review email filtering for spam, phishing and malicious attachments.
• Set up SPF, DKIM and DMARC records for your domain so others cannot easily send email pretending to be you.
• Check whether staff have had security awareness training in the past year.
• Run a vulnerability scan, or book a professional one. Our guide on vulnerability assessment vs. penetration testing explains which kind of test fits.

If several items in this section are marked "unknown", that is a strong sign to book a full cybersecurity assessment for your small business.

6. Backups and Disaster Recovery

• List what is backed up: servers, shared files, email, accounting data and cloud accounts. Microsoft 365 and Google Workspace keep your data available, but that is not the same as a separate backup you control.
• Confirm backups run on schedule and that someone checks for failures.
• Keep at least one copy off-site or in the cloud, and one copy that ransomware on your network cannot reach or change.
• Test a restore. Pick a file, a mailbox or a whole machine and bring it back.
• Write down how long the business can run without each key system, and check that your backups support that.

Our guide to business continuity planning helps turn these answers into a plan.

7. Policies, Privacy and Documentation

• Have written policies for acceptable use, passwords, remote work and personal devices.
• Keep an incident response plan that says who to call and what to do in the first hour of an attack.
• Know what personal information you collect about customers and staff, where it is stored and who can see it.
• Store vendor contacts, contract details and admin credentials in a secure, shared place, not in one person's head.

Under PIPEDA, Canada's federal privacy law for private-sector businesses, organizations are generally expected to protect personal information with safeguards suited to its sensitivity and to report and record certain breaches. Our PIPEDA compliance checklist covers this in more detail. This is general information, not legal advice.

8. IT Support and Budget

• Write down who supports your IT today, what they are responsible for and how to reach them.
• Check whether problems are logged and tracked, or handled by whoever is nearby.
• List the devices and systems due for replacement in the next year.
• Set an annual IT budget that covers replacements, licences, security and support.

Our IT budget planning guide shows how to build that budget from your audit results.

What Happens After the Audit

An IT infrastructure audit only helps if the findings lead to action. Sort every "needs work" and "unknown" item into three groups:

1. Fix now: anything that leaves the business open to attack or data loss, such as missing MFA, old accounts or untested backups.
2. Fix this quarter: updates, policy gaps and equipment approaching end of life.
3. Plan and budget: larger projects such as replacing a server, rewiring an office or moving to the cloud.

Repeat the audit once a year, and after any major change such as an office move or a new IT provider.

What a Professional IT Audit Costs at TechBoss

A self-audit with this checklist costs only your time. If you want a specialist to do the security side, the TechBoss IT Security Audit costs $1,500 to $5,000. It includes a vulnerability assessment, penetration testing and a security recommendations report, and the price depends on the number of users, devices, locations and systems in scope. You get a fixed written quote after a free consultation.

If you want the checklist kept up all year, our managed plans cover much of it. The Professional plan, at $89 per user per month with a 5-user minimum, includes network monitoring and firewall management, cloud backup and disaster recovery, employee onboarding and offboarding, and a quarterly business review. The Business plan, at $139 per user per month with a 10-user minimum, adds advanced cybersecurity, security awareness training and IT asset lifecycle management. See every plan on our pricing page.

How It Works with TechBoss

1. Free consultation: we talk through your setup, your concerns and any customer or insurer requirements.
2. Fixed quote: you get a written scope and price before work starts.
3. Audit: we review your systems on site or remotely and test the security areas agreed in the scope.
4. Report and plan: you get the findings in priority order, explained in plain language, with a clear list of what to fix first.

Frequently Asked Questions

How much does an IT audit cost in Canada?

It depends on the size of the business and how deep the review goes. At TechBoss, an IT Security Audit costs $1,500 to $5,000, quoted at a fixed price after a free consultation. A self-audit with a checklist like this one costs only staff time.

How often should a small business do an IT audit?

Once a year is a sensible baseline. Also audit after a major change, such as moving offices, switching IT providers or moving to Microsoft 365. If your business holds sensitive customer data, a regular review of security and backups is worth the time.

What is the difference between an IT audit and a security audit?

An IT audit looks at all of your technology, including hardware, software, licences, support and budget. A security audit focuses on how well that technology is protected from attacks and data loss. Most businesses benefit from both, and the security audit is usually the part that needs a specialist.

Can I do an IT audit myself?

Yes, for most of the inventory, licence and policy items. Security testing, such as vulnerability scans and penetration testing, is best done by a professional with your written authorization.

Do you do IT audits outside Toronto?

Yes. We are based in North York and cover the GTA, including Mississauga, Brampton, Markham, Vaughan, Richmond Hill and Durham Region. We travel across Ontario for scheduled projects and offer remote support across Canada.

Get a Professional IT Audit in the GTA

A checklist shows you where to look. A professional review tells you what you missed. TechBoss helps businesses across Toronto and the GTA with IT security audits and ongoing managed IT support. Request a free quote for your IT audit and get a clear plan for what to fix first.