IT Audit Report — Spreewald Logistik GmbH

Oct 23, 2026 · Prepared by Kosmo Team

Sample report: Spreewald Logistik GmbH is a fictional company; all data is invented.

Company profile

Regional freight forwarder in Berlin-Brandenburg: 34 employees, €4.2M turnover, B2B only. IT is handled part-time by the office manager plus a freelancer on call.

Each row is one of the 10 scoping questions you answered. The Effect column shows which legal duty or check that answer triggers, so you can see why a law appears later in the report.

Audit scope & method

Findings combine your answers with our own checks, so every red flag is verified.

The steps we took to reach the findings. Time shows how much of your team's time each step needed; the rest was our own work.

Laws that apply to you

Six laws apply to you, based on your scoping answers.

Only the laws that apply to your company are listed. Why it applies links each law to a fact from your scoping answers.

Standards we check against

Best-practice findings cite a recognised standard, so every recommendation has a reference.

Standards are not legally required, but they are the benchmarks we use for best-practice findings. Why it matters explains which one is most relevant at your size and for your customers.

Overall score: 41 / 100 (Red)

Basic tools work, but legal gaps and missing backups put daily operations at risk.

Each area is scored 0–100. Red (under 40) needs action now, Yellow (40–69) within 90 days, Green (70+) is in good shape. Biggest gap is the main reason for the score.

Findings: legal obligations

Five must-fix gaps. Each can lead to fines or lost contracts.

These gaps break a legal duty. Source is the exact law, Evidence shows how we verified it, so each point can be checked by your lawyer or DPO.

Findings: best practice

Not required by law, but each gap costs time or raises risk.

These gaps are not illegal, but they cost time or raise risk. Reference is the standard behind each recommendation.

Tool inventory & savings

You pay €1,200/month for 8 paid tools; cutting overlaps saves about €2,900/year, almost three times the audit fee.

All paid tools found in the audit with their monthly cost. Finding says whether to keep, connect or cancel each tool; the cancellations make up the €2.9k yearly saving.

Top 3 risks

Together these three put an estimated €80k+ per year at stake.

1. Ransomware or account takeover: no MFA plus untested backups. A 3-day outage costs about €50k in lost turnover (€16.8k per working day).
2. Manual order entry: 18 hours/week × 46 weeks × €35/hour = €29k per year, plus typing errors in delivery addresses.
3. Losing retail contracts: your food retail customers fall under NIS2 and will ask for security proof. Without it you risk failing their supplier checks.

Fine risk from the GDPR gaps comes on top and depends on the authority.

Roadmap: 30, 60 and 90 days

The first 30 days need no outside help; days 31–90 close the remaining gaps.

Days 1–30 · you, no outside help

Days 31–60 · with Kosmo Team

Days 61–90 · with Kosmo Team

Actions in three phases, in the order they should happen. Owner says who does the work (your team or Kosmo Team), Effort is the estimated working time in person-hours. Days 1–30 need no outside help.

Team readiness: why training matters

New tools only pay off when people use them. Without training, staff go back to Excel and phone calls, and the savings in this report stay on paper.

• Legal: Art. 4 EU AI Act (since 2.2.2025) requires AI literacy for staff who use AI tools at work.
• Security: most attacks start with phishing; MFA helps only if staff recognise fake login pages.
• Today: no training on security, the dispatch tool or AI so far; knowledge sits with the office manager and one freelancer.

Plan time for training in every rollout step, and check after 30 days whether the new tools are used.

Recommended packages

Seven packages close every gap; the first three are urgent, and E-Rechnung has a hard deadline. Prices are placeholders for testing.

Packages that close the gaps above, sorted by urgency (Priority 1 = start first). Yearly effect is the expected saving or avoided cost per year. Prices are placeholders.

ROI: €24,000 one-off for all seven packages against ~€38.7k in measurable yearly savings. Payback in about 7.5 months, before counting risk reduction.

A re-audit in 6 months will show the before/after scores and actual savings.

Next step

Book a 60-minute review call with Kosmo Team to agree on a plan. If you book any package within 60 days, the full €1,000 audit fee is credited.

Included with this audit:

• Annex 1 — AI usage policy
• Annex 2 — Offboarding checklist
• Annex 3 — Record of processing activities starter (pre-filled with your tools)
• Annex 4 — Backup restore test guide

This is a compliance and IT check, not legal advice. It is aligned with, not certified against, the standards listed. Legal points should be confirmed with a lawyer.

Annex 1 — AI usage policy

Applies to all Spreewald Logistik staff and freelancers who use AI tools for work. Owner: managing director. Review: every 12 months.

1. Allowed tools

2. Never enter into AI tools

• Personal data of drivers, staff or customers (names, addresses, licences, health certificates)
• Customer contracts, prices, delivery addresses
• Passwords, access codes, bank details

3. Rules for use

1. Check every AI output before you use it; you stay responsible for the result.
2. Do not use AI to evaluate or select people (applicants, drivers).
3. Mark texts as AI-assisted when they go to customers without changes.
4. Report mistakes or data leaks to the office manager on the same day.

4. Training (AI Act Art. 4)

Everyone using AI tools completes a short AI literacy training before first use and once a year. The office manager keeps the attendance list.

Fill in one row per person after the training. Keep this list for 3 years as proof of AI literacy (AI Act Art. 4).

Annex 2 — Offboarding checklist

Use for every employee, driver or freelancer who leaves. Owner: office manager. Complete on the last working day.

Go through all steps on the person's last working day. Tick Done and add the date, so you can prove access was removed.

Checked by (name, date): ______________________

Annex 3 — Record of processing activities (starter)

Required by Art. 30 GDPR. Pre-filled with the tools found in this audit; complete the open fields with your Data Protection Officer.

One row per processing activity. Pre-filled cells come from the audit; fields marked ☐ still need to be checked or filled in with your DPO.

Responsible: Spreewald Logistik GmbH, managing director. DPO: ☐ to appoint.

Annex 4 — Backup restore test guide

Run once a month. Owner: freelancer IT support; office manager signs off. Time needed: about 1 hour.

Before the test

1. Check that last night's backup finished without errors.
2. Pick one test item: rotate between a single file, a full OneDrive folder and one dispatch software export.

Test steps

1. Restore the item to a separate test folder — never over the original.
2. Open the restored file and compare it with the original (date, size, content).
3. Note how long the restore took.
4. Delete the test copy.

Every 6 months: full test

Restore a complete system copy (e.g. dispatch data export) and check that the office could work from it within one working day.

Log

Log every restore test. A failed result must be fixed and the test repeated; this log is your proof that backups work.

If a test fails: inform the managing director the same day and repeat after the fix.