Our audit and risk department want to look to audit SystemCentre and WSUS as part of their annual audit plan. I am not familiar with these tools, but do have some experience in Microsoft Server range of products (namely SQL Server, Exchange Server etc).

When auditing SQL and Exchange, the risks you are trying to protect against are pretty obvious, i..e availability, performance, reliability, security etc. Loss of availability of a SQL database or Exchange mailbox database are pretty obvious.  There are endless tools and scripts to audit or perform and best practice configuration/Healthcheck of SQL/Exchange installations.

But for SystemCentre, I am not sure what areas you would or should include as part of an audit or Healthcheck. Can you provide some recommendations? What risks do you face for loss of availability of SystemCentre to your organisation? Are there any security concerns to protect within your SystemCentre, or any other key areas you should review from a risk perspective?