Assisting a Subsidiary with IT Audit and Separation
Background & Challenge
A subsidiary business was preparing to formally separate from its parent company and operate as an independent entity. However, its IT systems were heavily intertwined with the parent organisation—sharing infrastructure, data, applications, domains, and identity management. Without a clear picture of ownership and dependencies, there was a high risk of disruption, lost access, or compliance gaps.
The business needed visibility, structure, and a managed handover process to transition smoothly into an independent operating model.
Initial Assessment
Astec began with a structured consultation and technical discovery phase to understand the scope and risks involved:
- Stakeholder Consultation: We worked closely with key contacts to define what the subsidiary needed to continue operating independently and what was currently shared.
- Comprehensive Audit: We reviewed all systems, both cloud and on-premises, across infrastructure, communications, file storage, user identity, applications, and DNS.
- Access & Ownership Checks: For each system, we verified:
- Who owned the system (legally and contractually)
- Who paid for it
- Who had access, including identification of any generic or shared accounts
- Where MFA was linked to personal mobiles or contacts from the parent business
- Registered addresses and contact details on file
- Data Dependency Review: We flagged systems where the parent company owned the platform, but the data primarily belonged to the subsidiary—outlining where data migration would be required.
- Unreachable Systems: Any systems we could not access or audit were highlighted and risk-scored based on their criticality—enabling the business to prioritise further access requests.
- Live Audit Tracking: All findings, actions, and next steps were recorded and managed via a live spreadsheet—shared with stakeholders to ensure full transparency throughout the process.
Separation Strategy & Methodology
Based on the audit, Astec created a structured separation plan tailored to the business’s goals:
- System Categorisation: Each application or service was grouped based on ownership, usage, and dependency—clearly identifying what needed to be transitioned, reconfigured, or rebuilt.
- Action Plan Development: For each system or domain, actions were assigned:
- Data migration where needed
- User access adjustments
- Ownership and billing transfers
- DNS and domain reconfiguration (including domain ownership transfers)
- Business Continuity Focus: The plan prioritised business-critical systems first to ensure day-to-day operations were not interrupted.
- Live Project Tracker: The audit document evolved into a real-time project tracker—ensuring every action was logged, owned, and resolved methodically.
Implementation Support
Once the separation plan was approved, Astec supported the delivery of each action item:
- System Reconfiguration: Services and platforms were updated with the correct ownership, billing, access control, and recovery details.
- DNS & Domain Transfer: Domain ownership and DNS entries were securely transitioned where needed to avoid loss of control.
- Data Migration: Where systems remained with the parent but data belonged to the subsidiary, we managed the extraction and secure transfer of business-owned content.
- MFA Realignment: Shared or generic accounts were updated to reflect appropriate individual contacts at the subsidiary—ensuring no loss of access post-cutover.
- Third-Party Liaison: In some cases, we worked directly with vendors to update ownership records and transfer service control.
Validation & Final Review
Once the separation work was complete, we carried out a final verification process:
- Confirmed successful ownership and billing transitions
- Verified access control updates and recovery information
- Ensured DNS records and domain routing pointed correctly to the new infrastructure
- Reviewed all completed items and flagged anything outstanding for follow-up
- Delivered a final version of the live tracker with all actions marked and documented
Outcome
- Smooth, Low-Impact Transition: The separation was completed on time and with minimal disruption.
- Independent & Compliant Setup: The subsidiary now operates independently, with clarity and control over its IT systems and services.
- Clear Ownership Across All Systems: From domains to apps, everything is now attributed correctly with up-to-date access and billing.
- Avoided Business Risk: Critical access was retained, data was preserved, and operations continued uninterrupted.
- Fully Tracked & Documented: The live audit tracker provided full visibility and ensured a structured, accountable delivery from start to finish.
“Astec made a complex process feel manageable. The transition was smooth, and we felt supported every step of the way.”
