Auditing one system end to end, rather than everything shallowly

There are two shapes this work takes. One covers every system in the organisation at a consistent, shallow depth. The other takes a single system and follows it all the way down.

They produce different things, and the choice is usually made by default rather than deliberately — organisations run the broad version because it feels responsible, and it is frequently the less useful of the two.

Which shape fits is the first thing to settle in an it audit services engagement, before scope is written.

What the broad pass is good for

Producing a register. Establishing what exists, who owns it, and whether basic controls are present across the estate. It answers “do we have gaps we do not know about.”

Its limitation is depth. A pass that touches twenty systems in ten days spends half a day on each, which is enough to confirm that a backup policy exists and not enough to discover it has never been restored. It reliably finds absent controls and reliably misses ineffective ones.

Absent controls are the easier problem. Ineffective ones are the dangerous kind, because they generate confidence.

What the deep pass is good for

Following one system from the interface to the database and out to every integration, and testing whether each control actually holds.

This is where you find that the access list has three departed employees on it, that the nightly job has been failing silently since a dependency upgrade, that the backup restores into a state missing a table nobody uses often enough to notice.

None of those is discoverable at half a day per system. All of them are ordinary findings when someone spends four days on one thing.

Choosing which system

Not the newest, and not the one somebody is worried about — worry is a poor prior. Two questions:

Which system, if it produced wrong output for a week without anyone noticing, would cause the most damage? Silent wrongness is the failure mode that controls are for. Outages announce themselves.

Which system has the most connections to others? Integration points are where ownership is ambiguous, and ambiguous ownership is where controls are absent rather than weak.

The system that scores highest on both is the right first subject, and it is frequently something unglamorous — a billing pipeline, a data feed, a reconciliation job.

What end to end means in practice

Following the data rather than the org chart.

Take one real record. Find every place it exists: the primary database, the replica, the analytics warehouse, the backup, the support tool, the export somebody scheduled to a shared drive. Establish who can read each copy and how long each is retained.

That single exercise typically surfaces two or three copies nobody in the room knew about, and it does so faster than any questionnaire, because it follows what the system does rather than what people believe it does.

Doing both, in the right order

The productive sequence is a broad pass first to build the inventory, then deep passes on the two or three systems the inventory identifies as material, repeated on a rotation.

Running only the broad pass, annually, produces a document that gets more detailed and never more useful. Running only deep passes leaves the estate unmapped, so the choice of subject is uninformed.

What depth actually costs

The honest arithmetic: a deep pass on one system is roughly the same effort as a shallow pass over eight to ten. That is the trade being made, and stating it plainly usually settles the argument faster than describing the benefits.

Where the estate is genuinely unmapped, the breadth-first answer is correct and the depth can wait — you cannot choose a subject sensibly without knowing what exists. Where an inventory already exists and is trusted, spending the same budget on breadth again produces a slightly better document and no new information.

The signal that a broad pass has stopped paying is when its findings are the same as last year’s with different dates.

The limit of the deep version

It gives you high confidence about one system and tells you nothing about the rest. That is an acceptable trade when the subject was chosen well and a poor one when it was chosen because somebody had a hunch.

It also has a shelf life. A deep pass describes a system as it was during the review. Where the system changes weekly, the findings decay quickly, and the durable output is not the findings but whatever monitoring or control the review caused you to add.

Related reading: the audit process covers the stages either shape runs through, what an IT audit checks covers the five areas examined per system, and the audit experience covers how to prepare for one without wasting a fortnight.