Results are dependent on scope, but common IT audit findings include inadequate security controls, insufficient backup, disaster recovery and business continuity measures, outdated or under-optimised hardware and software, and a lack of policies and procedures.