The IT auditor who widens their own audit universe

🆕 New & Trending AI Tools for IT AuditorReviewed September 2026

We track new AI-tool launches every week and refresh this list — here’s what’s gaining traction for IT Auditor work right now.

The access list still names people who left last spring. A change to the billing system went in on a weekend with no approval anyone can find. The backup log exists, and nobody has tried a restore since the hardware was new. An IT auditor writes those facts down, ties them to the rule the company said it follows, and states what the risk is. The job is evidence and a finding that still makes sense when someone reads the file next quarter.

Evidence before a conclusion

IT auditors test whether technology practices match what the organization claims. Typical areas are access, change, computer operations, backups, and the way vendors connect to internal systems. For access, the auditor looks at who can reach sensitive systems and whether that access was approved and later removed. For change, the auditor looks at whether a modification was requested, tested, and approved before it reached production. For operations, the auditor looks at whether jobs ran, whether failures were handled, and whether backups exist and have been proven restorable. None of this is a hunt for a clever trick. It is a comparison between a stated practice and the records.

A week has a rhythm. Early, you read last year's report and the process description the business provided. Then you ask the control owner for a population: the list of changes, the list of users, the list of vendors with a connection. You select a sample in the way the audit program describes, and you request the documents for that sample. You read them. Where the document is missing, you say so. Where the document shows the practice worked, you say that too. Findings are reserved for gaps that matter, written so a manager who was not in the room can see the issue, the evidence, and the effect. A finding with no evidence is an opinion. Audit departments do not keep those.

Public companies often ask IT auditors to look at the systems that feed the financial statements, in support of Sarbanes-Oxley duties. Banks, hospitals, and other regulated firms have their own examination calendars. A private company may want the same discipline before a sale, a major customer review, or a painful incident. The techniques of requesting evidence and writing a finding stay similar. The rules you test against change with the industry. Your job is to know which rule this engagement is using and to test that, not to import a checklist from a different client and hope it fits.

Independence is the uncomfortable part, and it is the point. You may like the system administrator. You may have done that job yourself. You still report what the sample showed. If management disagrees, you attach their response and let the rating stand or fall on the file. You do not redesign the control for them in the same breath as the finding, though you can discuss what a completed fix would need to demonstrate later. Follow-up is a separate act: did the agreed fix happen, and does new evidence show it. Auditors who blur testing, advising, and wishing produce reports nobody trusts.

The people around the work are the audit team, the control owners, and sometimes external auditors who will read your papers. You coordinate so the business receives one request for a screenshot, not five. You protect sensitive listings the way the company requires, because an access list is itself sensitive. You write in short sentences. A partner, a chief audit executive, or a regulator may read the finding without your narration. If the paragraph only works when you are in the room to explain it, rewrite it until it stands alone.

Where this seat lives

Internal audit departments in companies and agencies hire IT auditors to cover the technology slice of an annual plan. Public accounting firms hire them inside audit practices that examine clients. Banks, insurers, health systems, and technology companies hire them in internal roles or in groups that face regulators. Titles vary: IT auditor, information-systems auditor, technology risk auditor. Read for evidence, findings, and a plan. A posting that is really a security engineering job, or really a compliance-policy job, will say so in the duties. Testing and reporting are the core here. Writing the company's policies, or building the defenses, is adjacent work with a different allegiance.

The resume should show audits, not tools in a pile. Name the areas you tested, the industries, whether you drafted findings, and whether your work was reviewed by an external auditor or a regulator. If you sampled user access or change records, say that. If you only watched someone else, say you assisted. Honesty about your role is part of the professional identity you are applying to join. A portfolio is unusual. A sanitized finding, with names removed, sometimes works in an interview if your former employer allows you to discuss the shape of it. When in doubt, describe the type of evidence without the client's secrets.

Interviews probe judgment. You may be given a short scenario: a system with shared logins, or a change that went in during an outage. Walk the evidence you would request and the finding you would write if the evidence were missing. Do not jump to a dramatic story about attackers. The panel wants to know whether you can scope a test and stay fair. They also listen for how you speak to a defensive control owner. Contempt is a warning sign. So is folding the moment someone senior frowns. The useful auditor is calm, specific, and willing to write the uncomfortable sentence.

First roles often come from an audit internship, a public-accounting start, or a move out of IT operations by someone who liked the control side more than the pager. Take a seat where a senior auditor reviews your workpapers. That review is the education. A lone "IT auditor" title in a company that has never had one can be a real opportunity or a way to bury you in projects that are not audits. Ask who reads the report, how findings get closed, and what the plan for the year contains. If nobody can answer, you will be inventing the profession alone. That is harder than it looks on a job posting.

The CISA beside the workpapers

ISACA grants the CISA. People prepare by doing audit work and by studying the content ISACA publishes for the credential. Earning it signals that you have met the experience rule and completed the exam. Hiring managers treat it as a serious marker, especially in firms and in regulated industries. A state board does not issue it as a licence, and holding it still leaves every finding to be judged on the file. The file still has to be good. Put the credential on the resume when you hold it, and describe the audits in the same section so the letters are attached to work.

Other certificates sit nearby. A Certified Internal Auditor credential from the Institute of Internal Auditors speaks to the broader internal-audit profession and helps if your career will include more than technology. Vendor certificates in a particular platform show you can navigate that tool. They do not show you can audit. Use them as supplements. If you came from system administration, the CISA is often the piece that tells an audit director you changed crafts on purpose. Plan the timing around real engagements so the experience requirement is met with work you can describe, not with a gap you hope nobody checks.

Study in a way that improves the next audit. When you learn how a population should be defined, go define one more carefully at work. When you learn how a finding should separate condition, cause, and effect, rewrite a draft you already have. The credential then becomes a sharpening of the job, which is what reviewers can see. Chasing letters without workpapers is obvious in a technical interview. So is the opposite problem: years of testing with no shared vocabulary. The CISA gives you that vocabulary. Your managers give you the standard of a file they will sign. Meet both.

From one system to the year's plan

Staff auditors test what a senior scoped. You learn to request evidence without annoying the entire company, to document what you received, and to raise a possible finding early enough that you are not surprised at review. Senior auditors scope engagements, supervise staff, and negotiate timing with control owners. Managers own a slice of the annual plan, the quality of the reports in that slice, and the relationship with the technology leadership who must hear the results. Some people then become a chief audit executive or a partner. Some move into technology risk advisory. The promotion that matters first is from "I tested what I was given" to "I can design a test that answers the real risk."

That design skill is the middle of the career. You stop treating every system as an identical checklist. A payroll system, a trading platform, and a patient-record system do not carry the same harm when access is sloppy, and your plan should show you know the difference. You also learn when not to test. An audit that spends its whole budget on a low-risk setting, while a fragile system goes unexamined, is a planning failure. Managers notice who can say that out loud with evidence, and who simply wants a familiar program repeated because it is comfortable.

Leaving the audit side is a real option and should be a choice. Some strong auditors become control owners, compliance managers, or security leaders. If you do that, you will be on the other side of the request list, and your old habits of evidence will still help. Do not leave because a finding made you unpopular in a single meeting. Unpopular and accurate is sometimes the job. Do leave, or change teams, if you are being asked to soften a file against the evidence. That request is a signal about the employer. Your name on the workpaper will outlast the meeting.

PayCrunch estimates, named as estimates

The Bureau of Labor Statistics does not publish a separate wage series for this exact title. These figures are PayCrunch estimates for an IT auditor, and they should be described that way in any salary conversation. Entry on the estimate is $58,000. The median estimate is $90,000. The top of the estimate is $162,080. From entry to the median is $32,000. From the median to the top of the estimate is $72,080. They are a national sketch of the title. They are not a firm's lockstep scale, and they are not a figure tied to a particular city. Use them to talk about scope.

A new auditor who is learning to document a sample and draft a finding under review can set an offer beside $58,000 and ask what closes the $32,000 step toward $90,000. Credible answers include independent workpapers, a CISA in progress or already earned, and experience across access and change rather than a single repeated test. An auditor who already scopes engagements, writes findings that survive review, and handles control owners directly can treat $90,000 as the midpoint reference. Describe your actual inventory. A person who has only ever tested one application sits in a different conversation from a person who plans a year of technology audits, even if both hold the same title.

The top estimate of $162,080 sits $72,080 above the median. It belongs when the role is senior: leading IT audit, owning the technology plan for a large or regulated organization, or carrying a manager or director title with staff and a reporting line to the audit committee or its equivalent. Quoting $162,080 for a staff seat, or for a first year out of operations, makes the rest of your evidence harder to hear. If a recruiter floats that number for a junior role, ask what the job really supervises. Titles in this field inflate. The estimate only helps if you attach it to work you can prove.

Say the source before the number. Because the Bureau of Labor Statistics does not publish a separate wage series for this exact title, open with PayCrunch estimates, then place $58,000, $90,000, or $162,080 next to the scope. Bring two findings you can discuss ethically, the credential if you have it, and a clear sense of whether you test, scope, or lead. That is a negotiation an audit director can answer. A demand that floats free of the file fails the same test. The work is the file. The pay talk should sound like someone who understands that.

Careers related to IT Auditor