IT Auditor Job Description

An IT auditor gives an independent opinion on whether the systems a business runs on can be trusted. The questions are concrete: who can log in to the general ledger with posting rights, who approved the last code release to the billing platform, whether last night's batch interface ran complete, and whether anyone has ever restored the backups. BLS counts the work inside its accountants and auditors occupation and describes it plainly: IT auditors review controls over their organization's IT systems so that both financial and nonfinancial data come from a reliable source.

The same skills show up in several settings. At a CPA firm, an IT auditor tests the general controls behind a public company's financial statements so the financial audit team can rely on system-generated reports, and runs SOC 1 and SOC 2 examinations for service organizations such as payroll processors, data centers and software-as-a-service vendors. At a FedRAMP third-party assessment organization, the auditor examines cloud services that want to sell to federal agencies. In the public sector, audit offices test agency systems for financial statement audits and performance audits. Inside a company, an internal IT audit group works through a risk-based plan for the audit committee.

The vocabulary carries across all of them. GAO's Federal Information System Controls Audit Manual sorts information system controls into user controls, application controls and general controls. General controls are the foundation: logical access (provisioning, terminations, privileged and service accounts, periodic access reviews), change management (approval, testing, and separation between the people who write code and the people who move it to production) and operations (job scheduling, backups, incident handling). Application controls are the checks built into a system: a three-way match in accounts payable, an edit check that rejects a malformed account number, a reconciliation between two interfaces.

An engagement follows a familiar arc. The auditor scopes which applications, databases and cloud accounts matter, walks through each control with the person who performs it, tests a sample or the full population, and writes a conclusion another reviewer can follow without asking a question. Evidence is the real product. A screenshot of a password policy proves little unless the auditor can show it came from the production system on a date inside the audit period. When the auditor queries a population with SQL or Python, the extract itself needs testing for completeness and accuracy before any exception counts.

The tools are the client's tools. A single week might mean reading ServiceNow change tickets, exporting Entra ID group memberships, reviewing AWS IAM policies and CloudTrail settings, pulling SAP role and transaction code assignments, and matching Workday terminations to account disable dates. When something fails, the auditor writes the finding as condition, criteria, cause and effect, rates it, and agrees on an owner and a fix date with management. Then comes the part outsiders forget: retesting the fix months later to see whether it held.

BLS lists a bachelor's degree as the typical entry-level education for accountants and auditors, the occupation that includes IT auditors. Two degree paths feed the job. Accounting graduates arrive knowing internal control, financial statement assertions and audit sampling, then learn systems on the job. Graduates in management information systems, computer science or cybersecurity arrive knowing how directories, databases and cloud consoles work, then learn audit methodology and documentation standards. Either route works; the gap each person has to close is just different.

People also move in from operations. A systems administrator who has run Active Directory, a database administrator who has managed Oracle privileges, or a security analyst who has handled access reviews already understands the controls an auditor tests. What they need to add is the discipline of evidence: defining a population, picking a sample, documenting exactly what was inspected, and reaching a conclusion that holds up under review.

As a rough guide, staff-level roles suit people with 0 to 2 years of relevant experience, and senior IT auditor roles suit people with 3 to 5 years, including time leading fieldwork on their own. Treat these as guidance, not rules; firms and agencies set their own bars.

Certifications worth pursuing:

• CISA (Certified Information Systems Auditor), from ISACA: the credential written around IT audit itself. Its exam areas run from the information systems auditing process and governance and management of IT through systems acquisition, operations and business resilience, and protection of information assets.
• CPA, licensed by state boards of accountancy: relevant for IT auditors on the financial statement side of a CPA firm.
• CIA (Certified Internal Auditor), from The Institute of Internal Auditors: relevant for anyone who plans to work in internal audit.
• CRISC and CISM, from ISACA: risk and security management credentials that suit auditors moving toward IT risk or security leadership.
• CISSP, from ISC2: a security credential useful for auditors who spend their time on infrastructure and network controls.
• AAIA (Advanced in AI Audit), from ISACA: an advanced AI audit credential. In July 2025 ISACA widened its prerequisites; holders of CISA, CIA or CPA already qualified, and six more credentials were added to the list.

Technical skills that pay off on day one:

• SQL for pulling and testing populations, plus Python or audit analytics software for larger data sets
• Identity platforms (Active Directory, Entra ID, Okta) and how roles, groups and privileged accounts are set up
• ERP security, especially SAP roles and transaction codes, Oracle responsibilities and Workday security groups
• Cloud consoles in AWS, Azure or Google Cloud: identity policies, logging, encryption and network exposure
• Control frameworks: COBIT, the COSO internal control framework and NIST control baselines

The soft skills are not soft. Control owners rarely volunteer bad news, so interviewing well matters. Writing matters more: a finding has to be clear to an executive who never saw the testing and specific enough that an engineer knows what to fix.

BLS does not project IT auditors separately. For accountants and auditors as a whole, it projects employment to grow 5 percent from 2025 to 2035, faster than the average for all occupations, with about 115,300 openings a year on average over the decade. Those figures describe the full occupation, from staff accountants to audit partners, so they are context rather than a forecast for IT audit specifically.

Industry rows add context. In May 2025 the median wage for accountants and auditors was $98,750 in computer systems design and related services and $120,950 in the federal executive branch, according to BLS industry-specific estimates. BLS does not break those rows out by IT specialty either.

Several developments shape the job as of November 2026.

Federal audit methodology. GAO and the Council of the Inspectors General on Integrity and Efficiency issued a June 2026 revision of the Federal Information System Controls Audit Manual (FISCAM), replacing the 2024 version. It took effect with fiscal year and calendar year 2026 audits of federal entity financial statements, and for attestation engagements and performance audits beginning on or after Oct. 1, 2026. GAO says the FISCAM methodology is designed to be used primarily on federal financial audits.

Cloud assessments. FedRAMP's Consolidated Rules for 2026 frame the assessor's work as two questions: did the provider implement what it documented, and does that implementation produce the intended results. The rules say each applicable FedRAMP rule must be assessed. Under the newer FedRAMP 20x approach, the assessor's job is to find out whether the provider has described its security choices honestly, implemented them as described and proved that they work. In the 20x Moderate pilot, the first cohort received pilot authorizations on March 6, 2026, and as of April 27, 2026, six additional cloud service providers had received pilot authorizations. Among its lessons, the program says key security indicators can demonstrate security posture in near real time, replacing static yearly manual assessments.

Public company audits. PCAOB amendments covering audit procedures that involve technology-assisted analysis of information in electronic form (PCAOB Release No. 2024-007) apply to audits of fiscal years beginning on or after Dec. 15, 2025. IT auditors at registered firms may support that kind of data extraction and analysis on engagements.

AI as an audit subject. GAO published an AI accountability framework in June 2021 built on four principles: governance, data, performance and monitoring. For auditors asked to look at a model in production, those principles translate into familiar questions: who approved it, what data trained it, how its output is checked, and who watches it after go-live.

The career ladder runs from staff to senior, manager and director, with exits into IT risk, security governance, compliance and vendor risk roles. Some auditors move the other way, into the engineering or security teams they used to audit, carrying a habit that serves them there too: asking for the evidence.

Dear Hiring Manager,

I am applying for the IT Auditor position on your technology assurance team. For the past three years I have worked as an IT audit associate at a regional CPA firm, where I test general controls for public and private company clients and support SOC 2 examinations for software companies.

My strongest work has been on access and change management. On one manufacturing client, I matched twelve months of HR terminations to Active Directory and SAP disable dates and found a group of contractor accounts that had stayed active after their contracts ended. I wrote the finding, walked the IT director through the root cause, and retested the new offboarding workflow at year end. It held. On a SaaS client, I traced production deployments in their CI/CD pipeline back to approved pull requests and built a SQL query that let the engagement team test the full population instead of a sample.

I earned my CISA last spring and am studying for the CRISC. I also completed an AWS certification so I can read IAM policies and CloudTrail configurations without waiting on the client to explain them. My background is in accounting, which helps when I talk with the financial audit team about which reports they need to rely on and why.

What draws me to your team is the mix of SOC reporting and cloud assessment work. I want to spend more of my time on cloud environments and on the evidence pipelines that support continuous monitoring, and your practice does that work at a scale my current firm does not.

I would welcome the chance to talk about how I could contribute.

Sincerely, Jordan Avery