Modernising IT audit: An expert’s strategy using data analytics, automation, and zero trust

Organizations are increasingly recognizing the imperative for robust IT audit processes that can keep pace with the demands of modern, distributed digital environments. The contemporary IT landscape – which is now characterized by a cloud-based, distributed infrastructure and SaaS-heavy architecture – has rendered routine audit techniques insufficient. With the typical company operating well over a hundred SaaS applications, interaction with dozens of vendors significantly increases the attack surface and overall risk exposure. This complexity has contributed to a high incidence of data breaches, with the majority often attributed to human factors such as compromised credentials and configuration errors. Effective audit and security of IT systems today demand a multi-layered approach to ensure comprehensive protection. Organizations require strategies that can dynamically detect vulnerabilities, prevent unauthorized access, and respond swiftly to potential breaches, thereby enhancing the overall security posture and resilience of their IT infrastructure.

Integrating Data Analytics and Automation for Efficiency

Justus Onyebuchi, a Senior IT Auditor and cyber risk assurance expert, asserts that integrating data analytics, automation, and a Zero Trust security framework is essential for enhancing the effectiveness and efficiency of IT audits. According to him “Teams may spend late nights reconciling static logs and spreadsheets within dynamic IT systems that are constantly changing, and by the time an audit wraps up, the real risk profile has already shifted or mutated,”. Onyebuchi stated that “This is why incorporating data analytics, smart automation, and a Zero Trust mindset into the process is how audits can stay efficient, useful and genuinely helpful within a constantly shifting landscape.” He emphasizes that maintaining pace is only possible through automation, citing examples such as: Scripts that manage and enforce entitlements, bots that continuously check encryption settings, and scheduled jobs that review logging coverage and completeness.

ALSO READ: Global digital economy expected to hit $28trn in 2026, grow 9.5 percent — Report

Furthermore, Onyebuchi advocates for data-driven evidence: “Data analytics and automation have to do the heavy lifting. When we connect control objectives to the actual telemetry, we move from opinion to evidence. And when the evidence is comprehensive, we can focus on the outliers that truly matter.” This shift ensures that audit findings are based on verifiable system state and activity.

The Zero Trust Framework: From Compliance to Risk Reduction

Onyebuchi utilizes a Zero Trust approach to shift audits from a check-box exercise to one focused on real risk reduction. For example, instead of merely confirming that a quarterly access review occurred, the audit focuses on fundamental security principles:

Principle of Least Privilege: Do people only have the absolute minimum access required for their job functions?

Adaptive Authentication: Do high-risk roles or sensitive actions require extra verification, such as Multi-Factor Authentication (MFA), before proceeding?

Service Account Hygiene: Are machine or service accounts tightly scoped for specific purposes, and are their API keys or secrets rotated on a scheduled basis?

He then leverages data analytics to analyze usage patterns – who, what, where, and when of access – to identify unused or dangerous permission combinations, and flag gaps between written security policies and day-to-day enforcement. “An ideal starting point is how access is utilized in the real world, not whether a checklist was completed,” he explains. A Zero Trust culture enhances audits by encouraging a framework that always seeks to verify, never trust by default, and with strict adherence to policies at every step. “Zero Trust isn’t a catchy slogan but a series of deliberate design choices in how we build and run systems,” Onyebuchi states. “It means nothing is trusted by default – every person, device, and service must prove who they are and what they’re allowed to do, every time they interact with the IT environment.”

The real task for the audit teams becomes confirming that these zero-trust design choices manifest in real-life operational data. This involves looking beyond policy documents and analyzing logs, access records, and system behavior in production to confirm that controls are working as intended. When the data reveals a gap – such as an overly broad permission or an unchecked access path – a cycle of design, evidence, correction, and automation is initiated to fix the issue and prevent its recurrence in the build and deployment pipelines. This ensures that the Zero Trust model is a reliable, everyday practice, not just an idea on paper.

Developing Technical Fluency within the Audit Team

To amplify an auditor’s impact, Onyebuchi strongly encourages the development of technical fluency. Proficiency in SQL, scripting languages (e.g., Python, PowerShell), and a working knowledge of cloud architecture (e.g., AWS, Azure, GCP) are no longer optional. “Audit teams should be able to build queries, parse logs, and prototype control tests rather than waiting on others to produce them,” he argues. Technical fluency is the difference between surface-level reviews and audits that truly mitigate risk. It enables professionals to validate reports by querying raw data, trace anomalies to their source tables and automate hours of manual work into repeatable checks with clear audit trails.

Furthermore, a deep understanding of cloud architecture aids in mapping data flows, evaluating complex Identity and Access Management (IAM) models, and spotting high-impact misconfigurations in network boundaries, logging, and identity services that generic checklists invariably miss. Onyebuchi’s approach to IT infrastructure and cybersecurity audits highlights a necessary innovation through the systematic application of data analytics, automation, and a Zero Trust security framework. These strategies help organizations improve the efficacy of their audits, reduce technical risks and ensure that the audit function and risk assurance activities actively support the core business and organizational goals.