The first step is to determine their controls and the standards to which the audit should be performed.

General controls typically start at the top with the policies set in place by the board. These should be expanded upon and enumerated in the company’s various policies and procedures. General controls includes information security, change management, incident management, software policy, hardware policy, backup/recovery, information controls, physical security, privacy policies, HR practices and much more. Depending on the size of the organization, a thorough audit could take many months.

There are a few steps. First determine what the controls are, then audit against the controls… is the company doing what it says it should. Finally are the controls sufficient to meet the needs and/or requirements. You’ll need to take into consideration any regulations or required standards

Check out http://www.ISACA.org for COBIT (the best IT controls framework in the world) as well as tons of info on how to perform an IT audit.

Oh yeah, the auditor should not be anyone with operational responsibility. One cannot audit what one does. If you don’t have the staff for this, Kevin is right… hire an outside expert.