A method for auditing and verifying configuration items (CIs) in an information technology (IT) configuration management database (CMDB) includes identifying which configuration item (CI) types should be part of an audit, defining link rules to link an authorized CI type stored in a CMDB to an actual CI type that is part of an IT infrastructure, retrieving all authorized CI instances of the identified CI types from the CMDB, retrieving all actual CI instances of the identified CI types from a discovery upload of a current IT environment, comparing the actual CI instances to the authorized CI instances, and taking remedial action when variances are discovered.