I’m currently an IT Internal Audit Analyst and have been struggling with leading walkthroughs. I’ve been at my company for about a year and this is my first job out of college.

I was supposed to lead a walkthrough last week. I asked the questions on my agenda, but whenever the stakeholder explained the process, my mind would go blank when it came to thinking of follow-up questions.
For example, I’m assigned a data quality test, and I honestly wasn’t sure what to ask beyond the questions I had already prepared.

The stakeholder explained the process, and I basically just thought, “Okay.” My manager eventually had to step in and ask clarifying questions that I didn’t even know to ask. Later in the walkthrough, I asked a question that they told me they had already answered. They had explained it in a way that I didn’t realize had addressed my question.

After my walkthrough my manager said to me I have to be more independent as she was doing them alone when she was my age. Which I am aware I need to be more independent in this, but I’m really struggling.

I also struggle with grasping the information in the moment because I’m trying to listen, take notes, and capture screenshots at the same time. Unfortunately, my company doesn’t allow us to record walkthroughs.
- For those of you who work in IT/internal audit, how did you get better at:
- Coming up with follow-up questions on the spot?
- Understanding the process quickly during walkthroughs?
- Balancing listening with taking notes and screenshots?

Any advice, techniques, or resources would be really helpful. I’d especially love to hear from people who struggled with this early in their audit careers!

Hello all,

I'm just curious what everyones thoughts are on the future of the professsion, and what one should be doing to stay ahead of the curve so to speak.

Some stuff:

1. Cloud - this is obviosuly a big one, but what are the things people need to really get a grasp on?

2. Automation of ITGC testing - I've heard alot of talk of automating ITGC testing using alteryx, etc, however i haven't seen much of this in practice

3. Other stuff - Cyber? - People are often on the fence if this has any financial impact (We say their is a risk, but rarely make a link and address it)

Curious what you all think are some interesting emerging topics - and what one must do to keep pace.

Thanks!

Hey all! I am willing to make a small community of IT auditors for whom I can build tools and products for the problems they face in their work funnel.

This will help us learn about the space and current trends faster, if anyone is willing to get in. Let me know.

Edit 1: thanks so much for positive responses, a few clarification. I am looking forward to build this community with only experienced auditors and GRC practitioners for their current pain points in the emerging compliance driven changes,
This is not just another networking opportunity, more like a learning environment and contributive space.
Edit 2: again thanking for the volume of interest people are showing, the community is active now. Please feel free to DM me if anyone wants to join in.

Hello,

Currently working as a hospital EHR analyst and would like to know how to break into the world of IT auditing. Would getting the CISA help? Maybe even a bachelor's in accounting on top of that?

Hello everyone!

I wanted to share the good news that I FINALLY broke into IT audit. I currently have 9 years of IT experience in alot of different areas (IT operations, Identity Management, Software Asset Management) and NO experience in audit! The role that I am going into is internal IT audit (industry) for a insurance company.

If ANYONE has any tips or tricks for a new auditor coming in bright-eyed (or things to read up on to prepare myself for day 1) it is appreciated! Thank you all!

What is the career progression of an IT Auditor like, What options do I have after years of auditing? I have recently graduated with a Bsc in Computer Science, I have joined one of "the big 4 consulting" straight from college. Is it possible to go back to technical jobs after years of auditing? I would've preferred getting technical experience of a year or 2 before trying out audit. How does someone go from Auditor to something Like Network Security Specialist or Information Security Analyst etc. (*PS* The audit post was the only one available at the time, hard to find IT jobs where I live)

Hi everyone,

I currently work in IT Support and have a background in systems, networking, and cybersecurity. I hold CCNA, Security+ certifications and am currently studying ITIL Foundation v5.

I'm specifically interested in transitioning into IT Audit (ITGC, IT controls, IT governance, and internal IT auditing), not cybersecurity auditing.

Since I have no previous audit experience, I'd like to know where to start.

Which beginner-friendly courses, books, certifications, or other learning resources would you recommend for someone moving into IT Audit? Would it be suitable to start directly with COBIT? What topics should I focus on first to build a solid foundation and become ready for an entry-level IT Audit role?

I'd really appreciate recommendations from people working in this field. Thanks!

Hi All, I am an IT auditor with 9.5 yoe. I have worked extensively on ITGC, ITAC, interface testing, drafting Risk and Control Matrix, Infrastructure audit, ITAM, ITSM. I am in desperate need to freelance as my current job is not paying much and i have 2 daughters and wife. Thinking for future perspective, i am chosing to start freelancing. I can assure to provide detailed workpapers alongwith testing evidences in a efficient way. Any leads would be appreciated.

Thank you!!

Curious if anyone is in IT Audit at a larger company (FAANG) and was curious if any advice to land a job there? Have been at big 4 for 3 years (with certifications) and have been looking into careers there.

Hey guys, I was curious to know if anyone knew of any courses that offer 1 on 1 mentorship, assistance with job searching, and legitmate projects that relate to the roles. Looking to transition full time in IT Audit/GRC related roles and would love to some recommendations on any courses of projects you guys did that helped get you where you are.

Hi!

Longer time lurker here! I just wanted advice about this industry. I have been working in IT audit for 1.5 years now at a Big 4 firm in the US. This is my first job out of college and I am a first generation student, so I'd really appreciate the advice.

While the experience has been great, the work culture is super toxic. Everyone says there's a "busy season" but it never really ends. Even though it is summer right now, I still average 50 hours a week.

During my first year, I worked through busy season and studied for the CISA. I took it recently for the first time and failed by 7 points (score was 443). I don't have plans to take it again anytime soon since I am dealing with family issues at the moment.

With that being said, I want to leave Big 4 by the end of 2.5/3 years before promotion to senior. I know everyone says to stick it out until senior but I am so burnt out. I do plan on retaking my CISA after I transition to another job.

I actually love the work, but the hours are insane. Mentally, I am checked out. I am curious if it is any different if I switched to IA in industry. Are the hours better since I don't have to juggle multiple clients? Is this work culture only a Big 4 thing or an industry thing as a whole? If I want to get into GRC, would I need my CISA?

Any advice welcome! Thanks :)

Hi there

Just for the context i work from back offices of big 4 here in India.

So i am currently working in one of the Big 4 and i have almost completed 4 years in this domain. Ever since I joined this domain i have never liked it.
Reason being it that:
- Just documentation of IT controls and i feel it is very mundane and un motivating.

-Too much of work assigned with my 45 hrs days split into multiple projects . This is very frustrating to manage as you juggle between different projects and all of the projects are priority.

-Task never gets completed in budgeted hours and i feel budgeted hours are very squeezed to complete the work.

Basically i am frustrated with this job and need to get out of it. I feel i am not cut out of this and I don’t have any career growth in it.

I need some genuine suggestions . Please help me out.

TL;DR
Struggling in IT Audit career. Want an exit.

I just started a full time Internal IT Audit career and I hope to stay with my current employer for at least 5 years. For those of you who have been IT Auditors before or still are: 1. what is the typical IT Audit career path? 2. What are other career paths I could branch into after several years in IT Audit ? I’m currently 30yrs old and I’m just trying envision what role i could be in at say age 45. Any advice will be appreciated.

Hey Y’all. I see this forum is mostly dead, but hopefully someone will see this, and any advice is helpful!

I am currently 1 month in to an IT audit position fresh out of college at an amazing firm. The company culture, team I work with, resources available to me, and compensation has been wonderful! I see myself only staying in IT Audit for a year or two before wanting to try data analytics, etc. (I got my minor in BI and A).

My firm has a consulting branch that operates a BI and A business with around 100 employees. I would love to explore the option to transfer over there after a year or so. Company policy allows me to transfer officially after a year. I have no interest in rushing this process. But am curious what this community thinks of staying within my company or looking elsewhere for BI and A opportunities.

Is this kind of transfer possible/acceptable with it the industry? Is this sort of move dependent completely on the firm I am working for? Anyone have any insights into my best option?

Thanks!!

I've recently moved from external audit (accounting) into IT internal audit, and one thing I've been struggling with is what feels like a lack of methodology compared to what I was used to before.

In external audit, there were well-established concepts and principles that guided the work. Whether it was materiality, completeness, accuracy, existence, occurrence, or other assertions, there was usually a clear framework behind why procedures were being performed and how conclusions were reached.

Since moving into IT internal audit, I often feel like I'm missing that same foundation. I'm trying to understand what the equivalent methodology is supposed to be and whether I'm overlooking something.

At the same time, I'm very new to IT audit, so I'm not sure if what I'm experiencing is specific to my company, my audit team, or if it's something more common across the profession.

For those with more experience in IT audit:

• What methodology do you rely on when planning and performing audits?

• Are there concepts equivalent to financial statement assertions that help structure your thinking?

• How do you connect risks, controls, and testing in a consistent way?

• Is there a body of knowledge, framework, or approach that experienced IT auditors tend to follow?

One thing that would be especially helpful would be seeing an example of how experienced IT auditors structure a work program.

In external audit, I was used to seeing a clear chain between objectives, assertions, risks, and audit procedures. I'd be interested in understanding how that same thought process is applied in IT audit.

If anyone is willing to share a simplified example of an audit program (for example, user access management, change management, privileged access, etc.), showing how risks are translated into controls and testing procedures, I would really appreciate it.

First-year in IT audit, busy season starting. I don’t plan to build a career in audit, but everyone says the experience is worth the long hours.

For those who did Big 4 and then left for something different: was it worth what you put in? What did you actually get out of it? Or did you wish you left earlier?

Hey everyone,

I can still clearly recall how it felt to look at job advertising filled with acronyms like SOX, NIST, and ISO 27001 and wonder how anyone was supposed to "break in" when every entry-level position apparently required three years of experience.

Now that I've worked in GRC and IT audit on the other side of the wall, I want to send the elevator back down.

I'm opening 3 free mentorship spots for people trying to break into IT Audit or GRC roles.

Here's what I can help with:

Frameworks made simple- NIST CSF, ISO 27001, SOC 2, PCI-DSS ( what they actually mean in practice, not just textbook definitions)

Core concepts - risk vs. control, audit lifecycle, evidence gathering, control testing etc.

Career roadmap advice - certs worth chasing (or skipping), resume tweaks, how to position yourself for entry-level roles

Who this is for:

Career changers, recent grads, or IT/security folks looking to pivot into audit or GRC.

People who are motivated and coachable .

I'll pick 3 people over the next few days and we'll figure out a cadence that works for us. No fluff, no gatekeeping. Just trying to make the path in a little less foggy than it was for me.

If you're interested, drop a comment below (or DM me) with:

* Where you currently are (student, career changer, IT role, etc.)

*What's tripping you up most right now

*Why IT audit/GRC specifically

Good luck out there.

A bit of an overall engagement post for those who have worked in IT Audit already, what got you started in the business?

My first encounter with IT Audit was being on the receiving end of a major audit issue where they pulled me in as a data SME to answer questions and go through a LOT of logs. That eventually lead to a pivot into the IA department and then getting a slew of ISACA certifications as I gained experience.

Team, can someone please clarify how you approach ITGC scoping for SOX?

What I have seen as a common trend is that ITGCs generally fall under three areas: Logical Access, Change Management, and Computer Operations (job scheduling, backups, incident management, etc.).

However, when I ask how we arrived at these specific areas, or what authoritative guidance or standard drives that scope, I rarely get a definitive answer.

For example, I have seen some SOX programs include physical security and backups within ITGC scope, while others exclude them. This makes me wonder: what actually drives these differences in scope across SOX programs?

Interested in hearing how others approach and defend their ITGC scope, especially with external auditors.

Is it possible to obtain a template or spreadsheet which includes IT Controls to test for SOX testing? For education purposes, I would like to see the types of controls to test.

So I am a manager in a big 4 global team since 3 years (IT Audits). I am struggling with the environment and have lost interest in the day to day work

Now recently I have received an offer from a US based audit company that are setting up their office in India.

The offer that I have received is 1.4 (40%) times my current CTC. However the designation that they are giving me is of a Senior Associate. At the same time it is also a individual contributor role. There would be no team management as there is no other team member either above or below me for IT audits. And I'd be directly working with the US team members for US clients. And as per the company's internal policy, I won't be eligible for a promotion in the next 2 years regardless of my performance post joining.

I am leaning towards accepting the new offer as the salary is attractive, however I am worried if it'd hinder/slow down my career growth and impact future opportunities.

​My Questions for you all:

​1. Will a title downgrade from Manager to Senior Associate look like a red flag to future employers on my resume?

2. ​Has anyone made a similar switch (Management to IC) for much better pay? Did you regret giving up the leadership track?

3. ​Given the 2-year promotion lock-in, is this a trap that will slow down my career trajectory, or is the 40% hike worth having a stagnant title for a while?

Hi All,

I am an IT SOX Auditor based out of Bangalore, India

Recently our internal audit function was transitioned over to a service based company and we are transitioning their knowledge this month post which we will have to leave.

I have 7.2 years of experience in IT SOX and IT Audits. Skill set includes -

ITGC (IT General Controls)

IT Application Controls (ITACs)

Key Reports (IPEs)

Infrastructure Audits (Database and Servers)

SOC Reports Testing

Issue Identification and Remediation

Automation of Controls

AI assisted workflows

Audit Optimization

I also coach mentor analysts and handled the planning scoping and work distribution among juniors and review their work.

If there is anything that you all are aware in Bangalore or Remote kindly let me know, will share my cv.

I have a technical interview for the Senior Associate - IT Risk & Sox Advisory role at CNM (boutique tech advisory firm). I left my role as an IT auditor at a big 4 firm after 4 years (straight out of college) so I've never had to do a technical interview in my life. They've said it'll be based on my knowledge of IT SOX, ITGCs, ITACs, and key report testing. Any advice on what others have been asked as experienced hires in the same position (at CNM or other firms)?

Hello all! :) I was so happy to find that an IT audit subreddit page exists!

To provide a little bit of background about myself, I've been in the profession for almost 5 years now. I graduated college with a bachelors degree in accounting and an MBA in Public accounting. I never thought I would end up in IT audit and, for some reason, decided it would be a good move for myself. I worked for years at a big four and eventually transitioned to industry (about a year or so ago).

One of the problems I've faced throughout my career as an IT Auditor is the amount of knowledge one needs to know on how systems work (SAP, Oracle, the list goes on...) as well as the underlying accounting concepts that are built into these systems (three-way match, revenue recognition, ect.). IT controls are relatively straightforward, and once you've learned them, they are pretty easy to know going forward. The problem I have is really in the ITAC / Key Reports space. There are a number of IT Automated Controls (Key Automated functionality that is depended on) as well as Key Reports (Reports used in the execution of a key control/used in audit test procedures). For me, it has been very difficult to wrap my mind around these as they pertain to multiple different business cycles (Procurement, Inventory, Treasury, ect.). There is so much going on within these cycles, and not understanding it all can be detrimental to being able to lead a WT or getting the required support to test what is needed to be tested.

If any of you have experience in this space (ITACs/key reports), could you please advise me on how you have been able to be successful. There is a lot to learn on the accounting concepts front but then to also need to understand the technical nature of how the systems work seems very overwhelming. Especially given the fact that there are often hundreds of different ITACs/Key Reports that need to be tested during each year.

Thank you for any advice you can give! I very much appreciate you taking the time to read through my post.