An IT audit is a comprehensive evaluation of an organization's information technology governance, risk management, infrastructure, systems, operations, policies, and controls, from access control to data privacy, backup processes and incidents response readiness. Its purpose is to ensure that IT controls are in place and working effectively to protect corporate assets, maintain data integrity, and align with the business's goals

There are generally two main branches of IT audit with shared commonalities in terms of key review areas, audit techniques and methodologies

IT audit that focuses on IT controls over financial reporting, also known as an audit of Internal Control over Financial Reporting (ICFR), is a specialized review to ensure a company’s accounting information systems can produce reliable and accurate financial statements. The IT controls examined in this type of audit fall into two main categories of IT General Controls (ITGCs) and IT Application Controls (ITACs)

IT audit with a strong focus on the examination of an organization's information technology operations (including operating performance and efficiency, systems life cycle, disaster recovery and business continuity plans), IT infrastructure to identify and mitigate security risks. Cybersecurity audits fall under this category. Cybersecurity essentials are used as audit criteria to assess vulnerabilities, ensure best practices in cyber hygiene and enhance the security posture of an organization's IT systems.