IT Governance Consulting for the Mid-Market
Decision rights, change control and access reviews that hold up when the auditor’s request list lands.
Your auditor wants every NetSuite change from January through September, with the approvals. How long does that take you?
IT governance consulting at KORE1 sets up the decision rights, change control and user access reviews a $50M to $500M company needs to pass an audit, then staffs a fractional CIO and contract ITGC analysts to run them.
Last updated: October 14, 2026
For most companies that size, the honest answer is a week of digging through email. Nobody did anything wrong. The changes got made and most got tested. Somebody said yes to each one.
Nobody wrote down who. That’s the gap. Governance here isn’t a framework binder. It’s a few written rules, a twenty-minute weekly meeting and a quarterly review, run often enough that the evidence piles up on its own.
- This page
- The rules and records for how IT decisions, changes and access get approved. A fractional CIO sets them up, contract analysts run them until your own people can.
- Routed elsewhere
- A 12-month plan and budget is IT strategy consulting. A standing technology executive is a fractional CIO engagement, and a permanent one is a CIO search. A full SOC 2 or ISO 27001 program runs through GRC analyst staffing.
The work is led out of KORE1’s fractional CIO practice and staffed from the same IT staffing services desk that’s been recruiting technology people since 2005, where 92% of placements are still in the seat a year on. Analysts come on contract staffing terms and roll off once every control has an owner who isn’t us.
What IT Governance Looks Like to an Auditor
Ten requests from a first-year IT general controls list, the PBC or “provided by client” list. Each one sits on the side of the line where its evidence was created. The line is the day the request arrived.
IT general controls · Request list
- IT-01IT policies, approved by management during the periodSigned policy setFeb 12
- IT-02Who may approve new systems, admin access and production changesDecision table, written for this requestOct 8
- IT-03Every NetSuite production change, with its approvalChange log from the ticket systemRun nightly
- IT-04Emergency changes and their after-the-fact approvalsThree forwarded email threadsOct 9
- IT-05A sample of 15 new users and their access requestsOne approved ticket per userAt hire
- IT-06All leavers and the date their access came offHR list matched to disable dates by handOct 10
- IT-07Quarterly user access reviews, signed by each system ownerQ3 review never ranException
- IT-08Everyone with admin rights, and whyAdmin list, two names nobody could explainOct 7
- IT-09Backup results and one restore testNightly job reports, restore testedJun 18
- IT-10AI tools in use, who approved them, what data they reachNo list existsException
On file before the request. Nobody touched it in October.
Built after the request arrived.
Couldn’t be produced at all.
4 on file · 4 built after · 2 missing
Start with the left side. It’s boring. A policy set signed in February, a change log the ticket system writes every night, backup reports that ran whether anybody looked or not. Ten minutes to send.
The right side is where the cost hides. A decision table typed up two days after the auditor asked for it, emergency changes stitched back together from forwarded email, a leaver list matched to disable dates by hand on a Friday. Evidence built after the request isn’t thrown out automatically, but the auditor now has to satisfy themselves that it’s complete and accurate, and in our experience that means bigger samples, more follow-up questions and a fieldwork window that runs long. Expensive.
Then the two empty rows. You can’t rebuild an access review that never ran. It’s an exception for this period, full stop, and the fix only counts in the next one.
Most of this job is moving rows to the left, usually by making evidence a byproduct of the work instead of a project.
Decision Rights, Written on One Page
Somebody at your company already decides who gets NetSuite administrator access. Probably the IT manager. Maybe the controller. Occasionally whoever’s covering that week.
Decision rights just write that down, so the answer is the same in March as it is in October. That’s the whole trick. We start with five decisions, because they’re the ones auditors, boards and buyers ask about first, the buyers usually during IT due diligence.
Buy or retire a system that touches the books
The CFO decides. The IT lead and the system owner are asked first.
Grant admin or finance-role access
The system owner says yes, not IT. IT carries it out.
Change ERP, payroll or banking in production
The change board, every time, even when it’s one field on one form.
Make an emergency change
The IT lead, on the spot. The board sees it the next business day.
Point an AI tool at company data
The IT lead and the data’s owner together, and legal too if customer records are involved.
Then one rule makes the rest stick. A verbal yes doesn’t count.
“Verbal agreement is not sufficient and does not create an obligation on either party.”
That line was written for change orders on consulting work. It holds for IT approvals too. Email counts, tickets count, signed pages count. Hallways don’t.
An auditor can’t sample a hallway.
A Change-Control Board of Three People
Large-company change advisory boards have a dozen members and a standing two-hour slot. Overkill. You don’t need that. You need three people and twenty minutes a week.
Requester
Says what’s changing, why, and what breaks if it goes wrong.
Reviewer
Anyone except the person doing the work. Reads the change before it moves.
Approver
Usually the system owner, which on ERP and payroll tends to mean the controller.
Three rules from the same Foretopia process do most of the work, and we install them nearly word for word.
- Every change is recorded before work starts, along with the reasoning behind how it was classified, not just the outcome.
- The reviewer is never the author of the change.
- Emergencies are allowed. Each one is written up within one business day, with the reason the normal path got skipped.
Behind all three sits the rule we see broken most, usually by someone trying to help. Nobody changes production outside the process. Not the implementation partner, not the MSP, and not the NetSuite administrator fixing one saved search at six on a Friday.
Outside hands are where the risk is climbing, too. The Verizon 2026 DBIR puts third-party involvement at 48% of breaches, and that share grew 60% in one year.
Changes don’t get bundled to slip past review, either. Five tweaks in one ticket? Five reviews.
$5K–$15K
a month covers most KORE1 fractional CIO engagements
48%
of breaches had a third party in them, Verizon 2026
17 days
KORE1’s average time to hire for IT
92%
of KORE1 hires stay past their first year
Third-party share from the Verizon 2026 Data Breach Investigations Report. KORE1 rate and placement data, 2026, with the fractional CIO range as published on our fractional CIO services page.
User Access Reviews and ITGC Evidence Before the Auditor Asks
Auditors testing IT general controls keep coming back to the same few areas. The PCAOB’s internal control standard, AS 2201, names general controls over program changes, access to programs and computer operations, and it also points to controls over how software gets acquired and maintained, which matters most in a year you put in a new system. COSO’s 2013 internal control framework asks for the same thing in Principle 11, that the organization “selects and develops general control activities over technology.”
Access is where most of the first-year findings we get called about come from. The review is easy to describe. Running it isn’t. Every quarter, the owner of each system that touches the financials gets a list of who has access and in what role, and signs off that each line still makes sense.
Leavers get matched against the day their access came off. Admins get a reason next to their name. Then it has to happen every single quarter, including the one where everybody’s slammed with year-end, so the analyst we place builds it to run on a fixed date, pulling from NetSuite, Microsoft Entra ID and the payroll system, and files the signed copy where the auditor will look. Every quarter.
Two details save the most pain.
- Pull the user list out of the system itself, with the run date printed on it. Retyped spreadsheets aren’t evidence.
- Have the reviewer write down what they changed. Four straight quarters of “keep” on every line reads like nobody looked.
The leaver side has its own order of operations, covered in our contractor access offboarding checklist. If the roles themselves are a mess, an IAM engineer from our cybersecurity staffing practice cleans them up first. When the auditor is a SOC 2 firm rather than your financial statement auditor, Kris Drouet’s guide to SOC 2 for engineering leaders sorts out who owns the evidence.
AI Rules Go Inside IT Governance, Not Next to It
Skip the separate AI program. Put the tools into the governance you’re already building. Same rules. NIST treats governance as its own function too, ever since CSF 2.0 added Govern in February 2024.
An AI assistant wired into NetSuite, Microsoft 365 or your CRM is a system like any other. It gets an owner. It shows up in the quarterly access review. Its connector account is privileged access, the same as an admin login, and it belongs on the IT-10 list the auditor is starting to ask for, usually right after the admin list.
Most companies haven’t. Not even close. Among organizations that had an AI-related breach, 92% lacked proper AI access controls, according to IBM’s Cost of a Data Breach Report 2026.
Code and scripts an AI drafted go through the same three-person board. Foretopia’s rule for regulated work makes a good default anywhere. Every change has a named author, AI-assisted or not, and that person has to walk an auditor through it with the tool closed. If they can’t, it gets rewritten.
That covers the governance side. The usage side, meaning which tools touch which data and who reviews what they produce, is a one-page standard of its own, and Colin wrote one out in full in a piece on mid-market AI rules. The people who build those assistants come from our AI business operations consultant desk.
Who Staffs an IT Governance Consulting Engagement
One leader and two or three contract seats. Read each card for what that seat hands back to you.
Lead · Billed monthly
Fractional CIO
Writes the decision table, chairs the change board for the first quarter and signs the governance pages.
Analyst · Billed hourly
ITGC analyst
Builds the request-list evidence so it’s already on file when fieldwork starts, then walks the auditor through it.
Analyst · Billed hourly
IT GRC analyst
Maps the same controls to SOC 2, ISO 27001 or a customer questionnaire, so one control answers three asks.
Engineer · Billed hourly
Systems administrator
Cleans up roles, removes accounts nobody can explain and automates access removal for leavers.
A typical first year runs a fractional CIO at about $9,000 a month for six months plus one contract ITGC analyst at $80 an hour for twenty hours a week, which comes to roughly $54,000 and $41,600, or about $95,600 in total, before the controls hand off to your staff. The CIO time bills monthly. Analysts bill hourly. No fee is stacked on the rate.
Public-company work, where SOX testing drives the calendar, often adds a SOX compliance analyst on the finance side. Once a control is running and somebody has to own it for good, contract-to-hire lets the analyst who built it stay. Colin’s argument for renting senior IT judgment rather than hiring it is in the rentable CIO, and if nobody owns IT at all yet, start with an IT roadmap without a CIO. Role cleanup comes from our systems administrator staffing desk, and data ownership questions go to data governance analysts.
Common Questions
What does an IT governance consultant actually do?
An IT governance consultant writes down who decides what in IT, sets up change control and access reviews, and makes sure each one leaves evidence an auditor can test. At KORE1 that’s a fractional CIO for the rules and contract analysts who run them until your team takes over. Nothing fancier.
Do we need COBIT, ITIL or ISO 38500 to have real governance?
No. Those frameworks are useful reference shelves, and COBIT 2019 alone lists 40 governance and management objectives. A $200M company needs maybe a dozen controls that actually run. We map them to a framework when a customer or auditor asks for one.
How much does IT governance consulting cost?
About $95,600 for a typical first year, which covers a fractional CIO at roughly $9,000 a month for six months plus a contract ITGC analyst at $80 an hour for twenty hours a week. Fractional CIO engagements run $5,000 to $15,000 a month and analysts $65 to $95 an hour. Scope moves the total.
Which IT general controls will the auditor test?
Expect access to programs and data, program changes and computer operations, the three general control areas the PCAOB names in AS 2201. Controls over how software is acquired and maintained come into it too, especially in a year you implement a new system. Access usually draws the most samples, starting with new users, leavers and admin accounts.
How often should we run user access reviews?
Quarterly, for any system that touches the financials and for every admin account. Less sensitive systems can go twice a year. No rule fixes the cadence. What matters to an auditor is that you picked one, wrote it down and never skipped it.
Where do AI usage rules fit in IT governance?
Inside it. An AI tool connected to company systems gets an owner, a line in the access review and a spot on the tools list, and AI-drafted code goes through the same change board with a named author of record. The one-page usage rules sit alongside.
How long before governance holds up in an audit?
Plan on two full quarters of controls running before fieldwork. The rules take a few weeks to write. Evidence takes longer, because the auditor checks that each control ran across the whole period, not that it exists the week fieldwork starts.
Send Us Last Year’s Request List
Or the management letter, or the email from your auditor asking for things nobody could find, or the tracking spreadsheet somebody on your team started in March and quietly abandoned around May. Any of those works. We’ll tell you which rows move first and who it takes to move them.
Scope a Governance Engagement →