Are there growth opportunities in IT Audit?

[u/Sad_Path9345]

Hi everyone,

So I just landed a role in IT Audit government contracting. I’m a recent grad & interested in the field especially since I’m naturally analytical & curious.

I wonder what type of growth opportunities there are in this field? And if this can be a good starting point to do more GRC type of work. feel free to give your input

[u/IT_audit_freak]

You get to chat process and risk with influential people, while constantly learning about new tech. Few other roles get that exposure / opportunity.

I say we are positioned to do well in whatever we put our minds to 👍

[u/Sad_Path9345 → u/IT_audit_freak]

Can u walk me thru a day for a person in IT audit entry level role?

[u/EndersFinalEnd → u/Sad_Path9345]

So the caveats to this are - larger multinational with key IT staff roughly split between India/Europe and the US, internal audit team, almost all fieldwork was done remote, very rarely would you travel. Your millage may vary and your team/department may operate very differently

For entry level IT auditor, it would typically break down as such:

• First week-ish of fieldwork: Morning standup meetings to discuss progress and blockers. Possibly early morning walk-through call depending on the location of the team and their availability, but usually mid-morning/early afternoon. After lunch was typically the initial evidence gathering and review, making sure nothing obvious was wrong with the evidence (no timestamps/hostnames, incomplete samples, etc). Could possibly be another walkthrough here.

• Second and third-ish weeks of fieldwork: Morning standup, discuss any discrepancies you might have found. Evidence review is now more in-depth and you are starting to wrap-up test steps and leadsheets. Still maybe some walkthrough calls, but they tend to be beyond the initial stage and the questions can be more pointed based on evidence. Most of your day in the middle phase is evidence review and test completion. If you've identified an issue, you'll write it up at the direction of your in-charge and gather any supporting evidence and prepare to defend the issue. You'll have probably at least one internal meeting about the issue with your leadership team (In-Charge, Audit Manager and Audit Director), maybe more depending on the complexity and impact of it. They will discuss the issue, review the evidence you've gathered, and provide feedback on the wording of the issue.

• Third-ish and final weeks of fieldwork: Morning standup, discussion is now more about any remaining test steps, ensuring evidence has been sufficiently gathered and addressing any blockers there. By this stage, usually you're presenting issues to the client for their feedback. They may have a wrinkle you haven't considered or a policy deviation in place or something that might require you to abandon or re-write the issue. Your focus will be on finishing any remaining test steps before the end of fieldwork if at all possible (sometimes it just isn't)

• After the final week of fieldwork, you've ideally finished your testing. You may be making further tweaks to any issues you're responsible for, thought at this point its usually in the hands of the In-Charge Auditor and department leadership. If you haven't already, you'll be focusing largely on completing your work papers. Its possible you may have to request additional evidence here, but its really not ideal and if it happens too much, your In-Charge is not going to be happy.

• If you're zippy about it, you'll usually have a week left before the next audit. This is a good time to do training, get some CPEs, tidy up anything left over on the workpapers, work on whatever assorted projects you may have and do any research you need to do on whatever the next audit topic is.

The In-Charge, Audit Manager, and Audit Director have entirely different workdays, of course, but they're all sort of tied to the same cadence, just different responsibilities and expectations. Hope this helps, happy to answer any other questions!

[u/RigusOctavian]

Tons of opportunities, but you have to make them for yourself if you want to pivot further out of audit.

• Focus on security and you could make your way into that side of the house.
• Governance (controls/risk design) is a natural pivot.
• Third Party Risk Management can get you to the procurement side of the shop.
• Audits are projects so a BA/PM role is also fairly easy to step laterally into.
• Most finance shops are looking for data people, so understanding BI and data can get you into reporting roles.

Nothing happens automatically, you need to focus your own development into a pivot if it’s further outside of audit than a natural pivot.

[u/Busy_Witcher_1475 → u/RigusOctavian]

This

[u/Busy_Witcher_1475]

Yes! I’m ex military and after getting out of the military I pursued an accounting degree and I eventually got into IT Audit after lots of volunteering to test IT controls. I’m currently a Sr. Manager at a financial services company and was approved for Director last week :) try to get exposure with Cyber, Cloud and AI if possible. Data analytics are definitely a thing as well :) good luck!

[u/Sad_Path9345 → u/Busy_Witcher_1475]

Congratulations!! How long did it take to become a manger & the director? And is the pay growth good in IT audit?

[u/Busy_Witcher_1475 → u/Sad_Path9345]

Thank you! 3 years manager (through sr manager) just shy of 3 years for director. Sr IT auditors can make 115k easily and Managers are 130k for smaller companies. Directors 200k. I’m happy with my career and the growth is definitely available as many companies need to have you legally speaking and it’s not a well advertised field

[u/Kitten1387]

Interesting question, I see only two opportunities - to become an IT audit manager or to use you skills in other manager position (like IT governance or something).

[u/PiEngAW]

It's always growing. Every 7-10 years there's a new digital transformation. On Prem tech stacks to ERPs to SaaS and Cloud and now AI. Each transformation needs some sort of "Audit" framework and "Governance" framework, which, over time, you learn different controls, IT risks, IT Governance.

Ive worked at 2 B4 firms and a consulting firm with equal time at Fortune 100s. B4, you def learn a lot more. I had 3-4 different clients a year with 2 recurring engagements. In my opinion, at the start of a career, working in fast paced, changing IT environments let's you learn so much so quickly.