The Difference Between an IT Audit and an IT Assessment
Does Compliance with Standards Indicate IT Maturity?
Imagine the CEO of a large holding company asking during a review of IT across its subsidiaries:
“Is the state of IT across our subsidiaries satisfactory?”
One of the managers replies:
“Yes. Several of our subsidiaries are certified to ISO/IEC 27001, periodic audits have been conducted, and identified nonconformities are being addressed.”
- That sounds encouraging, but is it enough to understand the actual state of IT?
- Does an organization that conforms to the requirements of an information security standard necessarily have sound IT governance?
- Are its service-management processes effective?
- Are IT projects selected and managed properly?
- Do information systems meet business needs?
- And have IT investments created the value the organization expected?
Compliance with standards is necessary and valuable, but conformity with a standard does not necessarily indicate maturity or effectiveness across every dimension of IT.
This is where the difference between two important concepts becomes clear: an IT audit and an IT assessment.
IT Audit: Have the Requirements and Standards Been Met?
An IT audit usually begins with a defined set of criteria.
Those criteria may be drawn from international standards, legal requirements, regulations or directives issued by higher-level authorities, the organization’s internal policies, or contractual obligations.
By reviewing documents, interviewing those responsible, observing processes, and gathering evidence, the auditor assesses the extent to which the organization conforms to the specified criteria.
In this approach, concepts such as compliance, nonconformity, audit evidence, and corrective actions are particularly important.
For example, standards and guidance that may be relevant to IT audits include:
ISO/IEC 27001 — Information security management systems
This standard specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system. In an audit against it, conformity with the management-system requirements and the applicable security controls is examined.
ISO/IEC 20000-1 — Service management systems
This standard defines the requirements of a service management system and can provide a basis for auditing how IT services are managed and delivered.
ISO 22301 — Business continuity management systems
In an audit based on this standard, the organization’s conformity with the requirements of a business continuity management system is examined.
ISO 9001 — Quality management systems
Although it is not specific to IT, this standard may be relevant when auditing quality-management processes associated with IT services and activities.
ISO 19011 — Guidelines for auditing management systems
ISO 19011 provides guidance on the principles of auditing, managing audit programs, and conducting management-system audits.
In an IT audit, questions such as the following may be asked:
- Has an information security policy been approved and communicated?
- Is the risk-management process carried out in line with the defined requirements?
- Do records and evidence of control operation exist?
- Have previous nonconformities been resolved?
- Have the corrective actions taken been effective?
An IT audit provides assurance that the organization has met specified requirements and that expected controls are operating as intended.
Understanding the state of IT is not limited to these questions.
IT Assessment: How Far Are We from Recognized Best Practices?
In an IT assessment of maturity and performance, the scope broadens.
Here, the aim is not merely to check whether a requirement has been met; it is to identify the organization’s capabilities, the quality of its processes, its level of management maturity, the effectiveness of its services, and the gap between its current state and the desired state.
To that end, organizations can draw on recognized international frameworks, maturity models, and established best practices.
These frameworks reflect accumulated professional experience, research, and specialist knowledge in IT management and governance. They help organizations draw on proven approaches instead of reinventing methods.
Some of the most important frameworks include:
COBIT 2019 — IT Governance and Management Framework
The COBIT framework, developed by ISACA, helps organizations align the governance and management of information and technology with business objectives.
In a COBIT-based assessment, topics such as decision-making structure, risk management, benefit realization, resource management, performance monitoring, and IT process capability can be examined.
ITIL 4 — Best Practices for IT Service Management
ITIL provides a body of recognized guidance and practices for IT service management.
ITIL addresses topics such as incident management, problem management, change management, service-level management, service request management, and continual improvement.
In an IT assessment, the mere existence of a process is not enough; how it performs and how much value it creates for users and the business are also examined.
TOGAF — Enterprise Architecture Framework
TOGAF helps organizations design and manage their business, data, application, and technology architectures in a structured way.
In an enterprise-architecture assessment, assessors can examine the extent to which existing systems and infrastructure align with the target architecture and the organization’s future needs.
CMMI — Capability Maturity Model Integration
CMMI offers a structured approach to assessing and improving process capability and organizational performance.
The model can be used to examine the maturity of development, service delivery, management, and performance-improvement processes.
NIST Cybersecurity Framework (CSF) 2.0
With six functions—Govern, Identify, Protect, Detect, Respond, and Recover—the framework helps organizations manage cybersecurity risk systematically, assess their current posture, and define target outcomes.
What matters is not only whether security controls exist, but also how the organization manages risk and whether it can detect threats, respond, and recover.
Importantly, standards and frameworks do not always fall neatly into two separate categories. For example, NIST CSF can be the basis for an IT assessment and gap analysis, and COBIT can also be used as the criterion for an IT audit.
The main difference lies not in the name of the standard or framework, but in its purpose, how it is applied, and the results it is intended to produce.
IT Audit and IT Assessment at a Glance
| Topic | IT audit | IT maturity and performance assessment |
|---|---|---|
| Core question | Have the specified requirements been met? | How mature and effective is the organization’s IT? |
| Primary focus | Standards, controls, and nonconformities | Best practices, capabilities, and maturity |
| Criteria | Applicable requirements and audit criteria | Frameworks, maturity models, and organizational objectives |
| Typical output | Audit findings, including conformities and nonconformities | Maturity ratings, gaps, and opportunities for improvement |
| View of the future | Corrective actions and improved conformity | A roadmap for development and improved performance |
| Management use | Assurance and control | Decision-making, prioritization, and planning |
| Example references | ISO/IEC 27001, ISO/IEC 20000-1, ISO 22301 | COBIT, ITIL, TOGAF, CMMI, NIST CSF |
One Issue, Two Perspectives
Suppose a company has an IT support unit.
In an IT audit based on service-management requirements, the auditor checks whether an incident-management process has been defined, responsibilities are clear, incident records are maintained, and applicable requirements have been met.
An IT assessment informed by ITIL best practices can also ask:
- Are incidents resolved within appropriate timeframes?
- Are recurring problems identified and their root causes analyzed?
- Are users satisfied with the quality of the response?
- Are service performance indicators measured and analyzed?
- Does the support process improve continuously?
In the first perspective, the aim is to check conformity with specified criteria.
In the second perspective, the aim is to understand the efficiency, capability, and maturity of the services.
An organization may meet applicable requirements and still have significant opportunities to improve the quality and effectiveness of its services.
Why IT Assessments Are Especially Valuable for Ministries and Holding Companies
In a ministry or a large holding company, dozens of organizations, banks, institutions, and companies may differ from one another in size, mission, infrastructure, and level of IT maturity.
An IT audit can provide assurance that shared, essential requirements are being met across these entities.
Senior management also needs information to oversee and guide these entities.
- Which company is more mature in IT governance?
- Which organization performs better in service management?
- Which entities have the largest gaps relative to established best practices?
- Which weaknesses are shared across several companies?
- Which entities have improved since the previous assessment, and which have regressed?
- Most importantly, where should financial resources and management attention be directed to achieve the greatest improvement?
A structured IT assessment can help answer these questions.
This is especially true when an assessment framework applies shared criteria while also accounting for differences in the organizations’ nature and missions.
In this context, a structured IT assessment can provide a common language for understanding, comparing, and governing IT across these entities.
Feedora: Using Best Practices to Understand an Organization’s Actual IT Maturity
Feedora is designed to assess and monitor IT maturity. It goes beyond checking conformity alone to help identify capabilities, weaknesses, risks, and opportunities for improvement.
The platform assesses domains such as IT governance, security and risk management, infrastructure, services and support, information systems, digital transformation, and data analytics within a unified assessment framework.
Feedora applies established management and technical best practices and enables organizations to measure and track their IT maturity over time.
With this approach, leadership teams in ministries and holding companies can review each entity’s results, compare companies, observe trends, and identify domains that need attention.
Combining technical and non-technical assessments with end-user feedback provides a more complete picture of actual IT performance.
Drawing on concepts and best practices from international frameworks does not mean that Feedora is certified or officially endorsed by the organizations that publish them.
Feedora makes IT assessment an ongoing process rather than a one-off activity, helping organizations understand their IT over time and make informed decisions about improvement.
Conclusion: Is Meeting Standards Enough, or Should Organizations Strive for Better Performance?
Organizations need IT audits to verify that specified requirements are met, controls are operating as intended, and applicable standards are followed.
To develop capabilities, increase maturity and effectiveness, and make informed decisions about the future, organizations also need IT assessments.
IT audits and IT assessments are complementary approaches; one focuses more on assurance against specified criteria, and the other on understanding the current state and finding a path to improvement.
For senior leaders, both are valuable; but when the task is governing IT across dozens of organizations and companies, IT assessments can provide a broader view of improvement opportunities and investment priorities.
An IT audit helps us determine whether we have done what was required; an IT assessment helps us understand how effectively our IT is performing and how it can be improved.
Feedora: from measuring the current state to charting a path toward greater IT maturity and excellence.