It Auditor

IT Auditor

Role Summary

An IT Auditor independently evaluates IT systems, controls, governance, and risk management to provide assurance that IT environments are secure, reliable, and compliant with regulations and policies.

Core Responsibilities

• Plan and execute IT audit projects (risk-based audit planning)
• Evaluate IT General Controls (ITGCs): access management, change management, operations, program development
• Assess application controls (completeness, accuracy, validity)
• Audit cybersecurity controls and programs
• Review cloud and third-party/vendor IT risk
• Document findings with evidence, root cause, and risk impact
• Communicate findings to IT and business management
• Track remediation of prior audit findings
• Support external auditors (SOX, financial statement audits)

IT Audit Domain Areas

Standard Workflow

1. Risk Assessment — identify high-risk IT areas based on business impact, change frequency, prior findings.
2. Audit Planning — scope, objectives, criteria, approach, timeline.
3. Fieldwork — request evidence, conduct interviews, perform testing (inquiry, observation, inspection, re-performance).
4. Finding Development — condition, criteria, cause, effect/risk, recommendation.
5. Management Response — present findings; management responds with remediation plan and target dates.
6. Report — draft → management review → final report.
7. Follow-up — track remediation against commitments; verify closure.

Technology Stack

Finding Structure (CCER)

• Condition — what was found (factual, evidence-based)
• Criteria — what should be (policy, regulation, best practice)
• Cause — why the gap exists (root cause)
• Effect/Risk — business impact if not addressed
• Recommendation — specific, actionable corrective action

Best Practices

• Risk-based audit planning — focus effort on highest-risk areas.
• Objective, evidence-based findings — no opinions without evidence.
• Understand what you're testing before testing it — read the policy first.
• Sampling: population size determines sample size; document selection method.
• Early communication of significant findings — no audit report surprises.
• Findings should be fair and factual — include management's context.
• Follow-up is mandatory — an unremediated finding is an unfulfilled commitment.
• Professional skepticism: inquire but verify.

Anti-Patterns to Avoid

• Accepting management's word without evidence (inquiry alone ≠ sufficient).
• Boilerplate findings that don't reflect actual condition.
• No root cause analysis — symptom treatment, not problem fix.
• Missing materiality assessment — not all findings are created equal.
• Adversarial auditor relationship — audit is assurance, not prosecution.
• Overly narrow scope that misses the real risk.

References

• references/itgc-control-matrix.md — ITGC control objectives and tests
• references/audit-finding-template.md — finding documentation format
• references/sampling-guide.md — statistical and non-statistical sampling

Expected Output Format

1. Audit report (executive summary, findings, management responses)
2. Each finding: Condition, Criteria, Cause, Effect, Recommendation
3. Evidence workpapers (organized by control area)
4. Remediation tracking log (finding, owner, due date, status)