Who's Auditing Your IT Department or Managed Service Provider?

Companies routinely audit financial records, review vendor contracts, and evaluate operational performance. Yet one of their most important business functions often receives surprisingly little independent scrutiny: the people responsible for maintaining and securing their technology.

Whether those responsibilities belong to an internal IT department, a managed service provider (MSP), or both, executives frequently rely on service reports, contractual assurances, and the absence of major incidents as evidence that everything is working.

But how do you know?

When was the last time someone independently verified that your IT department or MSP was delivering the cybersecurity protection your business expects?

The Clorox Case: Who Was Responsible for Security?

In August 2023, Clorox suffered a cyberattack that disrupted manufacturing, order processing, and product distribution. The company experienced product shortages, lost sales, and significant recovery expenses.

Two years later, Clorox filed a lawsuit against Cognizant, its outsourced IT service desk provider, seeking approximately $380 million in damages.

Clorox alleged that service desk employees repeatedly provided attackers with access to employee accounts without following established identity verification procedures. According to the lawsuit, the attackers exploited routine password reset requests to gain access to the company's systems.

Cognizant disputed those allegations and challenged Clorox's internal cybersecurity practices. More significantly, Cognizant maintained that its contractual responsibilities were limited to help desk services and that it did not manage cybersecurity for Clorox.

The competing claims have not been established as judicial findings. However, the operational disruption was documented in Clorox's financial disclosures.

The disagreement exposes a question every business should examine: Where do IT service responsibilities end, where do cybersecurity responsibilities begin, and who verifies that both are being fulfilled?

The distinction matters because a business can have an IT service agreement, established security procedures, and sophisticated technology while still leaving critical responsibilities inadequately verified.

How Do You Audit Your IT Department or MSP?

An effective audit begins by comparing what the business believes it is receiving with what its IT department or service provider is actually responsible for delivering.

Start with the contract or internal service responsibilities. Identify who owns cybersecurity policy, access management, security monitoring, vulnerability remediation, incident response, and recovery. Determine which responsibilities belong to the provider, which remain internal, and where third parties are involved.

Then ask for evidence.

If employee identity must be verified before passwords are reset, select a sample of completed requests and examine whether the required verification occurred. If security monitoring is included, review how alerts were investigated, escalated, and resolved. If backups are part of the service, request evidence of successful recovery tests rather than relying exclusively on backup completion reports.

Vulnerability management deserves similar scrutiny. Are identified vulnerabilities actually corrected within established timeframes, or are reports being generated without meaningful remediation?

An audit should also examine the provider's access to the business. Who holds administrative privileges? How is that access monitored? What happens when employees leave or a service provider's personnel change?

These reviews require more than asking questions and accepting explanations. They involve examining records, testing selected controls, verifying corrective actions, and identifying weaknesses that may not appear in routine service reporting.

The objective is not to determine whether the IT department is busy or the MSP is responsive. It is to establish whether the protections the business depends on are working.

What Should Leadership Expect From an Independent Audit?

An IT department or MSP should conduct its own operational reviews. However, independent evaluation becomes particularly valuable when the same organization is responsible for implementing, operating, and reporting on its security controls.

The independence of the reviewer matters because the assessment must be capable of identifying shortcomings in the very services being evaluated.

Business leadership should receive more than a technical report listing vulnerabilities or compliance deficiencies.

The assessment should establish which contractual and operational responsibilities are being fulfilled, which controls were tested, where deficiencies exist, and who is accountable for correcting them. Findings should be prioritized according to potential business consequences, not simply technical severity.

Executives should also understand what remediation will cost, which actions require immediate attention, and whether existing IT investments are delivering their intended value.

An independent audit does not guarantee that a cyberattack will never occur. It provides something more useful than an assumption of protection: evidence on which business decisions can be made.

At CustosIQ, independent cybersecurity assessments examine how existing IT services, security controls, and operational responsibilities align with the risks facing the organization. The objective is to identify gaps, validate effectiveness, and help leadership determine where corrective action or additional investment is warranted.

Your IT department or MSP may be doing an excellent job. But confidence in that performance should come from evidence, not assumption.

Before approving your next IT budget or renewing a managed services agreement, consider when those services were last independently evaluated.

Talk with CustosIQ