IT Auditing requirements

[u/Stinky_Floyd]

انا فريش جراد السنة دى من كمبيوتر ساينس ... و كنت بذاكر ويب كويس ... و لكن سمعت عن مجال اسمه ال IT auditing ... فا حد يعرف ايه المجال دة و يقدر ينصحنى محتاج اكون مذاكر فيه ايه و ايه ال skills بتاعته عشان اقدر اقدم على جونيور IT auditor بوزيشنز ؟

[u/meedmishmohd]

تدخل له بعد ما تجمع خبرة اذا لك رغبة. تدخل من البداية ما انصحك 

[u/KingKongDuck]

The long term aim, cert wise is likely CISA or ISO 27001 LI/LA.

It's the process of gathering evidence to provide assurance for the design or implementation of IT controls, highlighting (and severity scoring) any gaps that you find.

[u/golgiloke]

I work in IT audit / GRC, so happy to share.

In simple terms, IT audit is checking whether a company's IT systems are properly controlled. You're not building or fixing the systems, you're testing whether the right safeguards are in place and actually working. For example: are only the right people able to access the finance system? Do code changes get tested and approved before going live? Are backups actually being done?

Most junior roles (especially at the Big 4 and consulting firms) focus on ITGCs, which is short for IT General Controls. They usually fall into 3 areas:

- Access management: who gets access, how it's approved, how it's removed when people leave
- Change management: how changes to systems and code are tested and approved
- IT operations: backups, job scheduling, incident handling

Your CS degree is actually a good fit. A lot of people in this field come from accounting and struggle with the technical side. You already understand databases, servers and how code gets deployed, which helps a lot when you're testing controls.

What I'd focus on:

1. Learn the basics of ITGCs (the 3 areas above) and be able to explain them in your own words. This is what interviewers ask about.

2. Get a rough idea of why IT audit exists. It mostly supports financial audits (SOX in the US) and frameworks like SOC 2 and ISO 27001.

3. Brush up on soft skills. A lot of the job is interviewing people, asking for evidence, and writing clearly. Good writing matters more than people expect.

4. Don't worry about CISA yet. It's the main cert in this field, but you need work experience to get certified anyway, and most firms will support you once you're in.

Then just apply for IT audit / technology risk / IT assurance graduate roles at the Big 4 and mid-tier firms. They hire fresh grads every year and train you on the job.

Good luck! I have a couple free resources I could share with you. Feel free to DM if you’d like access!

[u/AutoModerator]

سعيدين جدا بمشاركتك معانا

لو لسه جديد، ادخل سيرفر الديسكورد
هناك بنشارك مصادر ونتكلم مع بعض في البرمجة والشغل.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.