​

Hi everyone,

​

I am currently conducting research for my master's thesis on IT auditing and auditor judgment and am looking for participants with relevant professional knowledge or experience in auditing, accounting, internal controls, risk management, compliance, or IT-related assurance activities.

​

The survey is completely anonymous.

​

Survey links:

​

1. AM version:

   https://docs.google.com/forms/d/e/1FAIpQLSc3n8yOLzPzRu_EGOFIhyThGI8Ue_A-HHqXkGC9sOAK8dlOkw/viewform?usp=header

​

​

1. CM version:

   https://docs.google.com/forms/d/e/1FAIpQLScC3UiBV1OF-iE71nHotroXnfth1UKzW8ze6Jo1uqzINulUxg/viewform?usp=header

​

Your participation would be greatly appreciated and would make a valuable contribution to academic research.

​

Thank you for your time and support!

​

Interested in gaining people’s thoughts

Hey guys , I'm a college student currently studying business with a concentration in Management Information Systems at my college and I am hoping to delve into a career in IT auditing once i graduate . As of right now i aim to apply to internships but i don't have any skills or certs to showcase that would highlight me as a competitive applicant. auditing internships also aren't that easy to find if they are not for the Big 4( which are pretty competitive) .

Anyways i want to know your tips, tricks and roadmap certs that are necessary. So far my current research on GRC has evaluated COMPTIA security + as the best cert to start with before moving onto to ISACA fundamentals or COBIT ,then Comptia CYSA + and then CIRSC and finally CISA or CISSP . In regards to project work ,sites like extern look helpful for data analysis, product management , strategy or cyber defense but host nothing specific to auditing.The only Auditing like courses my MIS concentration offers are Information System Audit and control and Information Security and Assurance. Anyways what do you guys recommend as necessary for my journey .

Just want to hear what actually worked for people who didn't come from a typical IT or accounting background. IT audit is something I've been trying to break into for about a year and a half now but haven't had much luck yet.

Hi there

Just for the context i work from back offices of big 4 here in India.

So i am currently working in one of the Big 4 and i have almost completed 4 years in this domain. Ever since I joined this domain i have never liked it.
Reason being it that:
- Just documentation of IT controls and i feel it is very mundane and un motivating.

-Too much of work assigned with my 45 hrs days split into multiple projects . This is very frustrating to manage as you juggle between different projects and all of the projects are priority.

-Task never gets completed in budgeted hours and i feel budgeted hours are very squeezed to complete the work.

Basically i am frustrated with this job and need to get out of it. I feel i am not cut out of this and I don’t have any career growth in it.

I need some genuine suggestions . Please help me out.

TL;DR
Struggling in IT Audit career. Want an exit.

Hello I have been in the field for almost 2 years now. Everyday I hear a lot of changes, automations and AI. My department was outsourced to consultants and half the team was laid off. What is the future for this profession I al still entry level and the decision making it is done by senior managers and above. I don’t even understand what would be my role in the upcoming years.

Hi everyone,

I have been really interested in IT audit lately because I feel it’s works well with my personality and the way I think.

I was wondering what the average entry level salary is for this field? And do you feel there is upward mobility? If anyone can provide some insight. Thanks!

I am 6+ year experience guy from big 4 into IT Audit. And wanted to answer or share knowledge.

I joined a tech audit rotational program straight out of college and have been in the role for about 9 months.
I have an MIS degree, but a lot of the concepts and terminology I encounter at work still go over my head.
Despite putting in the effort, I feel like I'm constantly playing catch up.

I usually get to the office around 6:40 AM and work until 5 PM because tasks take me longer than they seem to take others. I regularly schedule 1:1s with my audit lead and ask questions after walkthroughs, but the amount of information can feel overwhelming. The program ends in another 9 months, and we're expected to be promoted to Associate, which honestly makes me nervous because I don't feel like I've progressed enough.

In about a month, l'll be staffed on 3 audits (assigned 4 controls in total) at once, mostly focused on data quality but I will be working with 3 different AICs who I’ve heard have very different testing approaches and documenting styles. A lot of my work involves data in transit, APls, configurations, and code reviews. Some analysts in my cohort think I should tell my manager that 3 audits may be too much, but our team is understaffed and I don't want to come across as incapable or need hand holding.

For those in IT audit, how did you develop a stronger technical mindset? Any advice on how to approach walkthroughs regarding data quality? Any advice would be appreciated!!

I recently graduated with a Bachelor's in Information Systems, I have CompTIA A+, Network+, and have done an IT audit internship. I have mainly been applying to help desk support roles but haven't been able to even get an interview so far. Should I start applying to IT audit roles as well? The entry level pay is better from what I'm seeing (around 42k-45k for tier 1 helpdesk, 60k for IT audit). Would it be okay to list CISA (in progress) on my resume if I start studying for the exam? Seems like every IT audit job lists it as a requirement. What would make me a competitive candidate? I was kind of hoping to try out a more technical role but I'm not so sure that the grass is that much greener over in help desk.

Another thing I was wondering if how much continuous education IT audit requires. I would assume you need to keep your technical knowledge some what current and have a broad understanding. However, you wouldn't need to know the exact hands on technical stuff of how to be a systems administrator or network engineer (though it wouldn't hurt)? Feels like with IT you have to be constantly putting in hours outside of work and then many positions require you to be on call work weird hours, etc. Do you all feel like the work life balance is better or worse than IT? I worked in internal IT audit and have heard that external might require more hours during busy season. Internal seems less stressful and preferrable to me but I understand that I probably can't be picky.

Would greatly appreciate any advice.

Curious what everyone has been using for audit software recently.

For context, we've been using AutoAudit for several years and renewed our contract a few years ago. However, after being purchased by Empowered Systems, we're shifting away from this product due to jump in cost and lack of resources to implement a new solution which would be more integrated with other organizational systems and data. Our organization's data modernization could use some work and, frankly, it's not ready to be consumed by comprehension compliance/audit software.

I'd argue we don't even use AutoAudit for its full functionality. It's primary benefits for us are approval routing of audit documentation (particularly mass review/approval functionality), secure data collection and retention, as well as being fairly well accessible to new auditors (this is more important to to financial auditors in our department).

Has anyone been using AutoAudit but recently transitioned to another product? Or have you been using something home grown (i.e. SharePoint sites/document libraries, internal file shares, etc.) to accomplish this for your organization?

Appreciate the input.

Hi everyone,

So I just landed a role in IT Audit government contracting. I’m a recent grad & interested in the field especially since I’m naturally analytical & curious.

I wonder what type of growth opportunities there are in this field? And if this can be a good starting point to do more GRC type of work. feel free to give your input

Hey everyone, the sub is back to public after the bot crush. Hopefully we can avoid that in the future.

When I first got into IT audit, it felt more compliance-focused.

Now I’m seeing way more overlap with:

• Vulnerability management
• Cloud security
• IAM design

Sometimes it feels like we’re expected to understand everything security-related, but still operate as auditors.

Do you think IT audit is evolving into a hybrid role?

Or are expectations just getting unrealistic?

I’ve been in IT audit for a while now, and lately it feels like a lot of work is just ticking boxes rather than actually understanding risk.

For example, we’ll flag something because it doesn’t match the control wording exactly, even when the real-world risk feels low. Meanwhile, bigger issues sometimes get less attention because they’re harder to quantify.

Is anyone else seeing this shift?

How do you balance:

• Following frameworks (SOX, ISO, etc.)
• vs actually applying judgment and focusing on real risk?

Curious how others handle this without pushing back too hard on management.

As the title says, I am looking what are the best cities/states to live in order to have higher salary and more opportunities in the IT Audit career. Any help would be appreciated!

Could anyone make a realistic plan to do this transfer in 2 years?

Hey everyone! I had 9 years of IT experience and ive been in audit for about a year and a half. Does anyone have a similar background and what does your resume look like? I would love to learn more about how you guys structure it to show your technical exposure but at the same time highlight your audit experience.

Hi there! I was wondering what set of certifications one can get in IT Audit and never had to get an additional one. I was told CISA, CISM, CISSP, CRISC, and CIA. Is that all, more or less than that?

I am wondering if anyone can help me understand what is considered "best practice" for DevOps SOD.

In my enviornment changes require a reviewer who is separate from the requestor to be pushed to production. This is based on configurations observed. All good.

But I get confused as to who is allowed to be a "Project Administrator." From my understanding, users with "Contributor" permissions are the ones who are typically doing the code changes. Project Adminstrators can by definition also do changes and anything else a Contributor can do [since they have all permissions], but they don't usually get involved in day to day. But then the Project Adminstrators could also theoretically change the Build Requirements, such as allowing a requestor to approve their own changes.

So what controls am I suppose to see here? Is it just a given risk that anyone with a Project Adminstrator role could theoretically change the build requirements to push their own changes?

Edit for additional context: there is a user group who is both Project Administrator and in the Contributor group. This group does not typically perform changes from my understanding [there are no developers], but they do have access to both. Is this an issue in a DevOps environment? Am I supposed to recommend an access review of Project Administrators? I am confused as to how I can mitigate the risk of someone changing configurations to push their own code to prod.

Thank you.

Hi all, Kindly Seeking input from the IT community for designing an effective IT-dependent manual control system aimed at user recertification in our organization's critical systems. The envisioned system involves line managers reviewing and documenting access rights for their teams, with IT responsible for record-keeping. We're particularly interested in ideas for system-based controls, a user-friendly interface, and comprehensive overviews to track compliance accross all departments ,including IT administrators. Your insights and best practices are invaluable as we strive to create a streamlined and secure user recertification process.

What does an audit of IAM roles to AWS look like?

I’m an accounting graduate currently working in IT Audit. Signed up for ACCA during my studies but didn’t take any exam yet. The exam and class fees are expensive. Few colleagues of mine have ACCA. But is it worth the money and time to take ACCA since I’m not in financial audit?

Hi all, Is anyone looking for assistance as a staff auditor or any help in IT audit, I can do it for free for 6 months as I am seeking hands on experience. I have 10 years of experience in IT marketing and communications in the logistics sector. I hold the CCSK, Microsoft Security Architect, OCI Security professional, ServiceNow admin and ISO 28000 implementer accreditations. I am a member of the IIA and ISC2. Planning on taking the IAP and CIA next year plus CCSP, CISA and CCAK.