IT Audits for SMEs: Checklist, Frameworks and Costs

Do you know exactly what IT is running in your business, who has access to what, and how quickly you would recover after an incident? An IT audit gives you an objective answer. For a long time, audits were something for accountants and large enterprises. But with the Dutch Cybersecurity Act (the national implementation of NIS2) and the demands of banks, insurers and clients, they are becoming unavoidable for Dutch SMEs too. This article explains what an IT audit actually is, when you need one, what to expect from it and what it should reasonably cost.

What is an IT audit, exactly?

An IT audit is a systematic, independent assessment of your IT environment. NOREA (the Dutch professional association of IT auditors) describes it as an assessment of the quality, security and continuity of IT systems, IT infrastructure and the organisation and processes around them. So an IT audit is more than a technical scan: it looks at technology, people and procedures.

An audit starts with agreeing the scope (which systems, which processes, which control framework) and ends with a report that combines findings, risks and recommendations. One key point: an auditor is independent. If you let the same company both supply your solutions and audit them, you undermine the entire process. Under ISO 19011:2018, an audit is by definition a systematic, independent and documented process for obtaining and evaluating objective evidence.

How it differs from a pentest, risk analysis or security assessment

These terms are often used interchangeably, but each measures something different:

• A penetration test actively attacks your systems to expose technical vulnerabilities. Typical duration: 1 to 4 weeks.
• A risk analysis weighs the likelihood and impact of risks based on threats and assets.
• A security assessment reviews policies and procedures. Typical duration: 4 to 12 weeks.
• An IT audit is the broad umbrella that gathers both procedural and technical evidence and tests it against a control framework such as ISO 27001, NIST CSF, COBIT or NOREA standards.

A pentest can be part of an audit, but not the other way round. An audit that never tests anything technically misses part of the picture. A pentest on its own misses the context of policies and procedures.

When does an SME need an IT audit?

There are five classic triggers. The first is a legal obligation, or the suspicion of one. Under the new Dutch Cybersecurity Act (NIS2), passed by the Dutch Senate on 7 July 2026 and expected to take effect around 15 August 2026, roughly 10,000 Dutch organisations will be classed as essential or important. Mid-sized organisations with more than 50 employees or more than €10 million in turnover usually fall into the "important entity" category and must be able to demonstrate that their cybersecurity is in order.

The second is a certification programme such as ISO 27001. The third is a customer request. Large clients, banks and insurers increasingly ask for a Third Party Memorandum (TPM), a SOC 2 report or an assurance statement before they do business with you. The fourth is an IT audit as part of the annual financial statement audit; the Dutch accountancy body NBA and NOREA have already published a practical framework for this. The fifth is an acquisition or investment round, where due diligence always includes IT questions about continuity, licensing and security.

Who carries out the audit?

In the Netherlands, the title "Register EDP-auditor" (RE) is protected by NOREA. Anyone using it has completed an accredited postgraduate university programme in IT auditing and has at least three years of practical experience. NOREA has around 1,250 members. For an audit that needs external legal or contractual weight (think of a TPM for government contracts, or assurance reports), you work with an RE.

For an internal or advisory IT audit at an SME, a specialist IT audit team is often enough, provided it is demonstrably independent and works to a recognised control framework. An SME without an audit obligation doesn't need to pay for an expensive enterprise firm, but it does need someone who knows the landscape well.

Which frameworks are used?

The main frameworks you will come across in the Netherlands:

• ISO 27001:2022, with 93 controls in 4 categories (organisational, people, physical, technological). The transition period for existing certificates ended on 31 October 2025.
• NIST Cybersecurity Framework 2.0 (February 2024), with six core functions: Govern, Identify, Protect, Detect, Respond and Recover. In May 2024 NIST published a Small Business Quick-Start Guide.
• COBIT 2019 from ISACA, with 40 governance and management objectives across five domains. Used mainly in larger and regulated organisations.
• ITAF 5th edition (2026), ISACA's IT Audit Framework.
• The NOREA reporting standard for IT controls.
• For accountancy purposes: the ITGC (IT General Controls) framework from the Dutch Central Government Audit Service (Auditdienst Rijk), with four main categories: access to programs and data, change management, program development and operations management.

For SMEs, a combination of NIST CSF 2.0 and ISO 27001 controls is usually the most practical: broad coverage, familiar language and directly usable for NIS2 compliance.

What exactly does an IT auditor check?

A thorough IT audit for an SME covers at least these areas:

1. Governance and policy. Are there clear policies (information security, acceptable use, data classification, incident response), and are they followed?
2. Access management. Does the joiner-mover-leaver process work? Is MFA enabled on every system (NIS2 requires it for all access points to sensitive information)? Are leavers' accounts removed on time?
3. Patch management. With an average of 131 new CVE vulnerabilities a day in 2025 and an average time-to-exploit of just 7 days (Mandiant M-Trends 2026), this is a core process.
4. Backup and recovery. The Dutch National Cyber Security Centre (NCSC) prescribes the 3-2-1 rule: three copies of your data, on two different media, with one copy at another location. The modern version is 3-2-1-1-0, adding an immutable or air-gapped copy and zero errors after a test restore.
5. Change management. Are changes authorised, documented and traceable (ITIL basics)?
6. Logging and monitoring. Is unusual behaviour detected and followed up (think SIEM or MDR)?
7. Suppliers and third parties. Are the risks posed by external parties mapped out (TPM or SOC 2 statements)?
8. Physical security of server rooms, laptops and backup media.
9. GDPR compliance: a record of processing activities in place, data processing agreements signed, data breach procedure rehearsed.
10. Awareness and training. Only 9 per cent of Dutch SMEs make cybersecurity training mandatory for staff. NIS2 explicitly requires it, including for directors.

What does an IT audit cost for an SME?

Costs vary widely with scope, sector and control framework. Among Dutch providers, a full IT audit for a mid-sized company typically costs between €2,500 and €7,500. Standalone security audits can come in lower, while ISO 27001 programmes including certification cost considerably more. Auditor day rates are around €1,000 to €1,500. In 2026, freelance IT consultants charged an average of €108 an hour excluding VAT for advisory work.

For an SME with 25 to 100 employees, a realistic investment for a first, broad IT audit is €5,000 to €15,000, with a lead time of 3 to 8 weeks. If you are preparing for NIS2 or ISO 27001, expect to pay more, because the scope is larger and the number of controls doubles.

The real costs usually lie not in the audit itself but in the remediation that follows: rolling out MFA, introducing a password manager, sorting out backups, setting up an awareness programme, improving logging. Budget 2 to 5 times the audit investment for remediation, spread over 6 to 12 months.

What you get back: the audit report

A good IT audit report has three layers:

• Executive summary. Two to four pages the board can read: the main risks, the next steps and how urgent they are.
• Detailed report. For each finding: what was observed, the evidence, the risk, the recommended action and its priority (critical, high, medium, low).
• Action list. With an owner, deadline, budget estimate and KPI for each item. This is the basis of your remediation plan.

Always ask for a follow-up. The recommendation is at least one thorough audit a year, plus quarterly reviews of critical systems. Without follow-up, organisations slip back: patches fall behind, MFA exceptions creep in and awareness training gets skipped.

Director liability under NIS2

What makes IT audits even more urgent under the Dutch Cybersecurity Act is director liability. Article 24 places three duties on directors: a duty to approve (the security policy), a duty to supervise (its implementation) and a duty to train (keep themselves up to date and provide training to staff). If those duties are breached, directors can personally be fined up to €25,000. Essential entities themselves face fines of up to €10 million or 2 per cent of global annual turnover; for important entities it is up to €7 million or 1.4 per cent.

On top of that comes the 24-72-30 reporting obligation: an early warning to the competent authority within 24 hours of a significant incident, a detailed notification within 72 hours and a final report within 30 days. An IT audit that establishes whether your organisation can handle this cycle is no luxury.

Internal or external audit?

ISO 19011 distinguishes between first-party audits (internal), second-party audits (by or on behalf of a customer or supplier) and third-party audits (independent certification audits). Internal audits are useful as an annual check and for spotting improvements, but the auditor must not assess their own work. For external value (insurers, clients, certification), you need an external party.

Practical advice for SMEs: start with a broad external audit by an independent party, then set up an annual internal audit routine. The first gives you an objective baseline; the second keeps the discipline in place.

Frequently asked questions about IT audits for SMEs

Is an IT audit a legal requirement for SMEs?

For most SMEs, not directly. But through the Dutch Cybersecurity Act (the NIS2 implementation), roughly 10,000 Dutch organisations will be designated essential or important and will face mandatory independent evaluations. Customers, banks and insurers are also increasingly asking for an audit report or TPM statement.

How long does an IT audit take?

An SME audit typically takes 3 to 8 weeks from kick-off to report, depending on the scope, the number of systems and how readily evidence is available. A security audit on its own can be quicker (2 to 4 weeks), while an ISO 27001 certification programme takes considerably longer.

How much does an IT audit cost for my business?

For an SME with 25 to 100 employees, budget €5,000 to €15,000 for a first, broad audit. Standalone security audits usually cost between €2,500 and €7,500, and day rates are €1,000 to €1,500. The remediation that follows typically costs 2 to 5 times the audit investment.

Can my own IT provider carry out the audit?

No. By definition, that is not an independent audit. A company that supplies or manages your solutions cannot judge the quality of that work objectively. Choose an external auditor who sells nothing in the same environment. Internal evaluations are useful, but they don't count as an external audit.

What is the difference between an IT audit and an NIS2 compliance audit?

An IT audit is broad and covers technology, processes and governance. An NIS2 compliance audit focuses specifically on the requirements of the Dutch Cybersecurity Act (risk management, MFA, incident reporting, awareness). Auditors often use NIS2 as an additional control framework within the broader IT audit.

How often should I have an IT audit?

Best practice is one thorough audit a year plus quarterly reviews of critical systems. After major changes (a cloud migration, an acquisition, a new core system), an interim audit is a sensible move.

Conclusion

An IT audit is not a bookkeeping formality but an investment in continuity, liability and customer trust. For Dutch SMEs, NIS2 and customer requirements are making it increasingly necessary. The keys are an independent auditor, a clear control framework and the willingness to actually act on the findings through a remediation plan.

Not sure where to start? TRON Group carries out IT scans and audits for SMEs and helps you build the roadmap towards NIS2, ISO 27001 or simply a healthy IT foundation. Independent, with a clear report your board will understand and a team that wants to see your business sharper and better prepared. Take a look at managed cybersecurity or call +31 85 303 5869 for a no-obligation introductory call. We start small: a quick scan of your environment and a conversation about where your biggest risks really lie.