JobDescription.org

Information Technology

IT Internal Audit Manager

Last updated

IT Internal Audit Managers lead the planning, execution, and reporting of technology-focused audits across enterprise IT environments — covering cybersecurity controls, ERP configurations, SOX IT general controls, and third-party risk. They manage audit staff, interface with IT and business leadership, and deliver findings that influence how organizations govern technology risk. The role sits at the intersection of technical depth and executive communication.

Role at a glance

Typical education
Bachelor's degree in IS, CS, Accounting, or related field
Typical experience
6-9 years
Key certifications
CISA, CIA, CPA, CISSP, CISM
Top employer types
Public companies, financial services, healthcare, critical infrastructure, consulting firms
Growth outlook
Growing demand driven by regulatory pressure and increasing cloud/technology complexity
AI impact (through 2030)
Augmentation and expanding scope — AI introduces new model risk management and governance requirements that increase audit complexity and demand for specialized expertise.

Duties and responsibilities

  • Develop and maintain the annual IT audit plan by assessing technology risks across the enterprise application and infrastructure landscape
  • Lead end-to-end audits of IT general controls, cybersecurity programs, cloud environments, and ERP configurations including SAP and Oracle
  • Manage a team of 3–8 IT auditors: assign engagements, review workpapers, coach staff through complex technical testing, and conduct performance reviews
  • Evaluate SOX ITGC design and operating effectiveness across change management, access management, computer operations, and application controls
  • Present audit findings, risk ratings, and management action plans to the CIO, CISO, Audit Committee, and external auditors in a clear, non-technical narrative
  • Coordinate reliance testing with external auditors to reduce duplicate effort and align on shared ITGC testing scope
  • Assess third-party and vendor technology risk using SOC 1 and SOC 2 Type II reports, supplementing with direct assessments where reports are insufficient
  • Track open audit findings through remediation: validate management's corrective actions, retest controls, and escalate overdue items to the CAE
  • Integrate continuous auditing and data analytics into the IT audit methodology using tools such as ACL, IDEA, or Python-based scripts
  • Stay current with NIST CSF, COBIT 2019, CIS Controls, and regulatory developments affecting IT governance and audit standards

Overview

IT Internal Audit Managers run independent assessments of how well an organization manages technology risk. That means planning which systems and processes to audit, executing the fieldwork, and translating technical findings into something a board member can act on — all without losing the technical credibility that makes the conclusions defensible.

The annual audit plan is the starting point. A good IT audit manager builds it from the ground up: working through the IT risk universe, identifying where control gaps are most likely to translate into financial exposure, regulatory liability, or operational disruption, then prioritizing engagements accordingly. The plan has to satisfy the Audit Committee's governance expectations, coordinate with external auditors on SOX reliance, and still leave room for the unplanned work that surfaces mid-year — a major cloud migration, a vendor breach, a new ERP rollout.

During fieldwork, the manager is both reviewer and participant. For a SOX ITGC audit, that means walking through access provisioning workflows, pulling and evaluating user access review evidence, testing change tickets for proper approval, and sampling operations controls around job scheduling and backups. For a cybersecurity program audit, it means comparing the organization's control posture against NIST CSF or CIS Controls, interviewing the security team about how they detect and respond to incidents, and forming an opinion on whether the program is fit for the threat environment the company actually faces.

Reporting is where the role earns or loses credibility. Audit committees want clear risk ratings, evidence-based conclusions, and management action plans with real owners and realistic due dates — not a list of generic observations that could apply to any company. Getting that right requires understanding what matters to the CIO and CISO well enough to frame findings in terms of business impact, not just control deficiency language.

The people management dimension grows at the manager level. IT audit teams are often small — four to eight people — and the manager typically handles staffing, scheduling, and staff development alongside the technical work. Senior auditors who want to become managers need to demonstrate that they can develop less experienced staff while maintaining workpaper quality under tight timelines.

Qualifications

Education:

  • Bachelor's degree in information systems, computer science, accounting, or a related field
  • Master's in information systems, cybersecurity, or MBA — increasingly common at director-track candidates
  • Big 4 or large regional firm IT audit experience is a well-worn path to in-house manager roles

Certifications:

  • CISA — required or strongly preferred by the large majority of employers
  • CIA, CPA, CISSP, or CISM commonly held in combination; specific mix depends on whether the role leans financial audit or cybersecurity
  • COBIT 2019 Foundation or CRISC for candidates in risk-heavy or GRC-adjacent roles

Experience benchmarks:

  • 6–9 years of IT audit or IT risk experience, with at least 2 years in a lead or supervisory capacity
  • Demonstrated ownership of at least one full SOX ITGC cycle at a public company from planning through external auditor reliance
  • Direct experience managing relationships with external auditors and presenting to audit committee or equivalent governance body

Technical knowledge:

  • ERP platforms: SAP access controls (SoD analysis, role design), Oracle EBS/Fusion application controls
  • Cloud environments: AWS, Azure, or GCP control frameworks — IAM policies, logging, encryption configuration
  • Identity and access management: Active Directory, Okta, CyberArk — provisioning, de-provisioning, privileged access review
  • Data analytics tools: ACL Analytics (Galvanize HighBond), IDEA, SQL, or Python for audit testing automation
  • ITGC domains: change management (ServiceNow, Jira workflows), computer operations (job scheduling, backup verification), logical access

Frameworks and standards:

  • NIST Cybersecurity Framework (CSF 2.0)
  • COBIT 2019
  • CIS Controls v8
  • SOC 1 / SOC 2 report evaluation
  • PCAOB AS 2201 and AS 2305 for SOX reliance contexts

Career outlook

Demand for IT Internal Audit Managers has been growing for a decade and shows no signs of contracting. Three structural forces are keeping it that way.

Regulatory pressure. SOX hasn't gotten simpler — SEC rules on cybersecurity incident disclosure (effective 2024) added a new layer of IT governance accountability for public companies, and regulators in financial services, healthcare, and critical infrastructure have expanded their technology risk expectations simultaneously. Every new regulatory requirement creates audit scope that didn't exist in the prior year's plan.

Cloud and technology complexity. Enterprise IT environments are harder to audit than they were ten years ago. Multi-cloud architectures, SaaS sprawl, containerized applications, and API integrations have created control environments where the traditional audit playbook requires significant adaptation. Companies that ran SOX ITGC programs built for on-premises ERP now need audit managers who understand how those controls translate — or don't — into AWS Lambda functions and Salesforce configuration management.

AI governance. Model risk management is moving from a financial services niche to a mainstream audit topic. Organizations deploying AI in decision-making processes — credit decisions, fraud detection, HR screening — face governance requirements from regulators and their own audit committees. IT audit managers who develop fluency in AI governance frameworks are positioning themselves for an audit scope area that will grow substantially over the next five years.

The supply side is constrained. CISA holders with genuine SOX ITGC management experience and cloud audit skills are a small population relative to demand. Compensation has responded accordingly — total packages at large public companies regularly include performance bonuses of 15–25% on top of the base salary ranges above.

Career paths from this role split several directions. The most direct is upward within internal audit — VP of IT Audit, then CAE — typically at progressively larger organizations. A second path leads to IT risk and compliance leadership: CISO staff roles, GRC program ownership, or technology risk management in financial services. A third path returns to consulting, where in-house experience commanding the client side of the relationship commands premium billing rates.

For professionals entering the field now, building depth in cloud controls and AI governance alongside the ITGC and SOX fundamentals creates a profile that will remain in demand regardless of which direction enterprise technology moves.

Sample cover letter

Dear Hiring Manager,

I'm applying for the IT Internal Audit Manager position at [Company]. I've spent seven years in IT audit — the last three as a Senior IT Audit Manager at [Current Company], a NYSE-listed manufacturer with $4B in revenue and a 12-person internal audit function that I co-led on the technology side.

My SOX program ownership has covered two full annual cycles since I took the manager role: scoping roughly 180 ITGCs across SAP S/4HANA, a Workday HCM implementation, and our Azure-hosted infrastructure. Last year I restructured how we coordinate with our external auditors on reliance testing, moving from parallel independent testing to a shared workpaper model that eliminated about 300 hours of duplicate effort between our team and KPMG. The auditors were skeptical initially; the key was investing in workpaper quality and documentation standards that held up under their review procedures on the first pass.

Beyond SOX, I led an end-to-end audit of our third-party SaaS vendor portfolio last year. We had 40-plus critical vendors with SOC 2 reports on file but no systematic process for identifying gaps that complementary user entity controls were supposed to cover. The audit surfaced four vendors where our IT team had assumed controls existed at the vendor that actually required action on our side. Those findings got prioritized by the CIO in a way that prior-year vendor risk reviews hadn't.

I hold an active CISA and CIA, and I'm midway through the CRISC exam process. I'm looking for a role with more direct board and audit committee interaction and broader scope across cybersecurity program assurance. [Company]'s audit committee mandate and the scale of your cloud transformation program look like the right fit for that next step.

Thank you for your consideration.

[Your Name]

Frequently asked questions

What certifications are expected for an IT Internal Audit Manager?
CISA (Certified Information Systems Auditor) is the baseline credential and is required or strongly preferred by most employers. CISSP, CISM, or CIA are commonly held in combination. CPA is valued at companies where the IT audit function rolls up under the financial audit team or operates in a SOX-heavy environment.
How much SOX experience is needed for this role?
At public companies, SOX ITGC experience is essentially mandatory — managing access, change management, and computer operations testing cycles, coordinating with external auditors, and defending control conclusions under scrutiny. Candidates without direct SOX ITGC management experience typically enter at the senior auditor level, not manager. Private company roles are more variable.
What is the difference between an IT Internal Audit Manager and an IT Risk Manager?
IT Internal Audit provides independent assurance — it tests whether controls are designed and operating effectively and reports findings to the Audit Committee. IT Risk Management is a first- or second-line function that owns the risk framework, designs controls, and implements remediation. Audit managers should have no ownership of the processes they audit, which is the structural distinction regulators and auditors care about.
How is AI and automation changing IT internal audit work?
AI is reshaping the role in two directions. First, audit teams are using data analytics and AI tools to test entire populations of transactions instead of samples, which improves coverage and catches anomalies that sampling misses. Second, AI systems themselves are now audit subjects — governance of model risk, training data integrity, and algorithmic bias are active areas of emerging audit scope that didn't exist five years ago.
Is an IT Internal Audit Manager role a stepping stone to the CISO or CIO path?
Occasionally, but it more commonly leads to VP of Internal Audit, Chief Audit Executive, or IT governance and compliance leadership roles. The broad cross-functional exposure — touching every IT domain across the enterprise — makes experienced IT audit managers attractive to governance, risk, and compliance (GRC) program leadership positions, and some move into Big 4 advisory after building in-house depth.

More in Information Technology

See all Information Technology jobs →