We assess your infrastructure, cloud environment, licenses, and processes, and provide you with a prioritized list of risks, including remediation costs and a roadmap ready for approval.
![[interface] screenshot of core features (for an AI legal tech company)](https://cdn.prod.website-files.com/6a0029a6f31182220001f475/6a318c745f1cd3534b716212_6a318060570227777ccce3de_Audit%2520Saving.jpeg)
A true inventory of your IT infrastructure, including shadow IT that no one had accounted for
Quantified licensing risk exposure prior to the manufacturer's audit
Risks prioritized by probability and impact, with estimated remediation costs
A useful audit doesn't just describe your infrastructure—it tells you what to do, in what order, and at what cost.
Executive decision report, separate from the detailed technical annex — two hearings, two documents
Qualified risk register, with clearly defined and traceable criteria
Prioritized roadmap with cost estimates and the required internal effort
Documents meant for decision-making, not for filing.
We conduct audits so you can make informed decisions—not to justify a sale. If there’s nothing urgent, we’ll let you know.
Most audits result in a document that no one ever opens again. We start by focusing on the decisions your management will need to make.
We work with you to define the scope—websites, systems, subsidiaries—and gather the existing documentation. If it’s out of date, that’s our first finding.
We mapped out the existing IT environment, including shadow IT, reviewed the licensing, and interviewed the department heads.
Each risk is rated based on probability and impact, linked to a recognized control (CIS, ISO 27001, ITIL, LFPDPPP), and assigned a remediation cost.
The roadmap outlines what needs to be done, not who should do it. You can implement it with your team, with another vendor, or with us.
Scope, terms of reference, cost, independence, and internal effort: what to consider before commissioning an audit.
An IT audit is a structured assessment of your company's technology environment. It reviews the infrastructure, processes, and human resources to ensure security, efficiency, and alignment with your business objectives.
A standard audit takes 4 weeks, broken down as follows:
Multi-site or highly distributed environments may require an additional week or two. We'll work this out with you before we start, not as we go along.
That's the right question, and it deserves a straightforward answer. Yes, there is a conflict of interest: the auditor may have an incentive to find problems that they can then sell as projects.
That’s why we keep the two separate. The report assesses risks using explicit and traceable criteria, so that you can verify our conclusions with any third party. The roadmap outlines what needs to be done, not who should do it. You can implement it with your in-house team, another vendor, or us—and if your infrastructure is sound, the report will say so.
If you prefer complete independence, we also audit environments that we do not manage and do not provide quotes for remediation.
We don't make up criteria: we rely on recognized frameworks so that our conclusions can be verified.
Each finding is linked to an identified control, along with its reference. This allows you to verify the reasoning, not just the conclusion.
Yes, and it’s often one of the findings with the greatest financial impact. Many companies discover their licensing exposure on the very day the manufacturer audits them, when there’s no longer any room for negotiation.
We review the actual inventory of software installations against the licenses held: Microsoft, Adobe, databases, virtualization. We identify both under-licensing—which is a risk—and paid-for but unused licenses, which represent money lost every mes.
Less than you might fear, but not zero. We typically have:
We work with what we have. If your documentation is outdated, that in itself is a discovery, not an obstacle.
The report isn't the end. We present the findings to your management during a working session, prioritize the roadmap together based on your budget and operational constraints, and provide the documents in an editable format so your team can follow through on them.
We also recommend a follow-up review after 6 or 12 months to assess actual progress regarding the identified risks. An audit that no one ever revisits didn't change anything.
International subsidiaries and companies in Mexico that entrust their IT to Keptos.
Keptos IT Services has proven to be a reliable, responsible, and professional company, fulfilling its commitments in a timely manner and providing high-quality services. We highly recommend their services.
During every service call, the technical staff has demonstrated professionalism, punctuality, and a solution-oriented attitude. Thanks to their support, we have been able to improve the operational continuity of our activities.
Please provide your contact information, and a specialist from Keptos will contact you within one business day.
Thank you! We have received your request. We will be in touch soon.
An error occurred while submitting the form. Please try again.