What if your IT partner does not welcome an audit?

Oct 06, 2026 (updated on Nov 11, 2026)

Clients rarely ask the question out loud, but we hear it regularly between the lines. We already have an IT partner, a good one even. What will they make of an independent security audit? Is it a test they cannot pass? A comparison nobody is waiting for?

Understandable. IT is long-term trust, and nobody wants to see it disturbed. But the reasoning keeps a wrong picture alive, and that picture is worth examining.

The audit assesses your environment, not your partner

Our security audit looks at how your Microsoft 365 environment is built and where it is vulnerable. The report says nothing about the dedication of the people working in it every day. It does say something about years of choices: which settings were once made this way, what has not been reconsidered since, and what nobody ever explicitly decided.

That last part is the most interesting. In many environments we see, nobody was ever asked to watch over security. There was simply no role for it. That is not a reproach to the partner who keeps everyone else happy. It is a gap in the division of tasks, not a gap in craftsmanship.

Nobody ever decided to leave security as it was. Something more urgent always came up: a printer that refused to work, a new employee who needed access on day one, an application that had to go live tomorrow. In an organisation without its own security role, that is not a choice. It is a law of nature, and every honest partner recognises it.

A case, anonymised

We recently saw an organisation that grew over two decades from a handful of people into a full-fledged workplace. The IT partner had been there from the start and did the job: no open tickets, happy users, everything ran. But nobody had ever asked who was watching the security. No owner, no overview, no plan.

When a major customer sent a security questionnaire, it turned out no answer existed. Not because the partner was not doing his job, but because the question had never been anyone's job. The organisation had to build in a few weeks what should have grown over ten years: an overview, priorities and a first improvement plan. It worked out, but it should never have taken those weeks.

Interesting detail: the partner was relieved. He had seen the limitations himself long ago, but never got them on the board's agenda. The report put them there in one go. The first actions came from him, not from us.

The diagnosis is the same every time: the role never existed. Nobody failed, there was simply never a place where the responsibility could land. An audit makes that place visible, and that is exactly why it feels uncomfortable. The discomfort is part of it. It means the report touches where it should touch.

Why partners often calm down once they see it

We replace nobody. Our approach is a security layer on top of your existing IT, and we say so in the reports you can show your board. The findings come with a prioritisation and a mapping to CyberFundamentals, ready to work with. For the partner, that is input, not a verdict.

In practice, these reports often start a conversation both parties had wanted to have for a long time but could not begin out loud: what belongs to us, what do we outsource, what have we been forgetting for three years?

There is another effect that is underestimated: an independent report gives the partner a hearing where his own voice did not carry far. Anyone who has been asking for years to enforce multifactor authentication, test backups or clean up stale accounts knows the silence that follows such advice. A report with severity ratings says the same thing, but with authority from outside. We hear it literally afterwards: I have been saying that for three years.

How to set up the conversation

The fear of the reaction is almost always bigger than the reaction itself. Still, it pays to frame the conversation deliberately:

• Say it as it is: the audit is about the environment, not about his performance.
• Decide in advance what the report will be: input for the work plan of the coming months, not an evaluation of the relationship.
• Involve the partner. During the intake he is often at the table, and that works: he knows the history behind every setting we see.

A partner who can handle this is exactly the partner you want to keep. The exception who refuses the conversation tells you something about the relationship that you would rather know now than after the first incident.

The question is not who is right

If you doubt how your partner will react, ask yourself one question: do you want a report in which your IT partner gets no role? Or a report that makes your collaboration model clear and gives everyone the right task?

There is a simple test. Ask your partner beforehand how they would feel about it, and listen to the answer. A professional says: bring it on, I will cooperate. Anyone who starts about loyalty and trust while the subject is measurable facts is mixing up two conversations that have nothing to do with each other.

Book a no-strings conversation or request your audit. The report is for your organisation, and how you deploy it is your decision. Want to build a first picture yourself first? Our step-by-step plan from zero measurement to secure workplace describes the route, from free scan to improvement plan.