IT Internal Auditor Job Description

An IT Internal Auditor works for the organization whose systems are under review. BLS, in its profile of accountants and auditors, draws the line plainly: internal auditors have duties similar to those of external auditors but are employed by the organization they are auditing, and IT auditors review controls for their organization's IT systems so that financial and nonfinancial data come from a reliable source. Put the two together and you have the job: an in-house assurance specialist who tests whether the technology the business runs on is controlled the way management says it is.

The reporting line defines the role. The IT Internal Auditor sits inside an internal audit department led by a chief audit executive, and that function answers to the audit committee of the board, not to the CIO whose systems it examines. The Institute of Internal Auditors' Global Internal Audit Standards, effective Jan. 9, 2025, call on chief audit executives to work closely with the board to establish the internal audit function, position it independently and oversee its performance. That independence is what lets a staff auditor write a finding about the CIO's own change process.

The year runs on an audit plan. Internal audit ranks the organization's technology risks, picks engagements that address the biggest ones, and the IT Internal Auditor carries them out: a review of who holds posting rights in the ERP, a look at how the cloud platform team approves infrastructure changes, a test of whether backups restore within the window the business continuity plan promises, a review of how a new payroll vendor's data handling was vetted before the contract was signed.

At a public company, a fixed block of that plan belongs to the Sarbanes-Oxley Act. As GAO summarized in a June 2025 report, Section 404(a) requires management to assess the effectiveness of internal control over financial reporting in annual reports filed with the SEC, and Section 404(b) requires auditors of public companies to attest to management's assessment, though amendments to the act exempted certain smaller and emerging growth companies from Section 404(b). Where internal audit carries management's testing, the IT Internal Auditor's share is the IT general controls: logical access, program change and computer operations for each system that feeds the ledger.

The Standards are organized into five domains, running from the purpose of internal auditing and ethics through governing and managing the function to performing internal audit services. The last domain is where the daily work lives. Fieldwork mixes walkthroughs, system queries and sampling. The auditor pulls the HR termination list and matches it against active accounts in Active Directory and the ERP, traces change tickets to deployment logs, and reads cloud configuration exports instead of screenshots. Each finding goes into a report with a risk rating, a management action plan, an owner and a due date, and the auditor comes back later to confirm the fix holds.

Cybersecurity work now has a written floor. The IIA's Cybersecurity Topical Requirement, effective Feb. 5, 2026, sets what the IIA calls a minimum baseline for assessing cybersecurity governance, risk management and control processes, and internal audit functions must apply it when they provide assurance on that topic. For the IT Internal Auditor, that gives the cyber engagement a defined scope the audit committee can hold the function to.

BLS lists a bachelor's degree as the typical entry-level education for accountants and auditors. For IT internal audit the degree is usually in accounting, information systems, computer science or a related field, and the major matters less than what the candidate can show about controls and systems. As a rough guide, people reach a standalone IT internal audit seat after two to five years in IT operations, security, public accounting or a general internal audit team.

Two routes lead in. Accounting and audit graduates arrive with sampling discipline, workpaper habits and an instinct for financial risk, then learn how identity platforms, databases and deployment pipelines actually work. IT and security professionals arrive knowing the systems cold and learn audit methodology: how to define a control, how to test it, and how to write a conclusion a reviewer will accept. Either route works; what matters is closing the gap on the other side.

Credentials. ISACA's Certified Information Systems Auditor (CISA) is a credential focused on IT audit. The Institute of Internal Auditors' Certified Internal Auditor (CIA) covers internal audit practice across every subject, which matters in a department where the IT auditor may join an operational or financial engagement. ISACA's Certified in Risk and Information Systems Control (CRISC) suits auditors drawn toward IT risk management, and ISC2's Certified Information Systems Security Professional (CISSP) fits those whose audits go deep into security architecture. A CPA license from a state board of accountancy is useful for auditors who spend much of the year on financial reporting controls.

Technical fluency. Expect to read access configurations in Active Directory and Microsoft Entra ID, cloud identity and logging settings in AWS or Azure, and change records in ServiceNow or Jira. SQL is the workhorse for pulling user lists and transaction populations; Python or an audit analytics tool turns those pulls into full-population tests. Familiarity with a governance, risk and compliance platform such as ServiceNow GRC, Archer or AuditBoard helps, since that is where workpapers, issues and action plans live.

Judgment and writing. The report is the product. An IT internal auditor has to explain a privileged-access gap to a database administrator in the morning and to the audit committee chair in the afternoon, in language each will accept. Professional skepticism matters, but so does the ability to get evidence from teams who would rather be shipping code. Interviewing skill, clean workpapers and the patience to retest a control a third time are part of the job.

BLS projects employment of accountants and auditors to grow 5 percent from 2025 to 2035, faster than the average for all occupations, with about 115,300 openings a year on average over the decade. BLS notes that many of those openings are expected to come from the need to replace workers who move to other occupations or leave the labor force. BLS does not project IT internal auditors separately, so the figure describes the broader occupation, not this specialty.

The risk picture audit leaders report points straight at this job's territory. In the Internal Audit Foundation's North America Risk in Focus 2026/2027 board briefing, based on a global survey of 3,285 chief audit executives and directors conducted March 2 to May 6, 2026, cybersecurity was chosen by 85% of North American chief audit executives as one of the five highest risks facing their organizations, and digital disruption, including AI, reached an all-time high of 69%. Both are areas an IT internal auditor covers.

The profession's own rulebook is also growing. The IIA's Topical Requirements are mandatory: all internal audit functions must apply them, in conformance with the Global Internal Audit Standards, when providing assurance services on the topic. After the cybersecurity and third-party requirements, the IIA set a Dec. 15, 2026 effective date for an Organizational Behavior Topical Requirement and an April 30, 2027 effective date for an Organizational Resilience Topical Requirement. Each new requirement adds a defined scope that someone in the department must be able to assess.

Sarbanes-Oxley work recurs at public companies. Management's assessment of internal control over financial reporting appears in each annual report, so the IT general controls behind it are tested every year, and a new ERP module, acquisition or cloud migration can add systems to the scope.

The career ladder inside internal audit is well defined. A staff or senior IT auditor moves to IT audit manager, then to director of IT audit or a broader audit director role, and the top seat is chief audit executive. Lateral moves are open in several directions: IT risk management, security governance and compliance, privacy, and the assurance or advisory practices of accounting firms, which hire people who already know how an in-house function thinks. Some auditors move the other way, into the business, taking a control owner role in IT operations or finance systems after years of testing other people's controls.

For a candidate, the useful things to bring are concrete: a CISA, a record of full-population testing with SQL or Python, experience on a cybersecurity or vendor-risk engagement, and the writing to put a technical gap in front of a board committee. Every new system the business turns on is another system someone in internal audit will eventually have to test.

Dear Ms. Alvarez,

I am applying for the IT Internal Auditor position on your internal audit team. For the past four years I have worked as a systems administrator and then an IT compliance analyst at a regional insurer, and I want to move to the side of the table that tests controls rather than operates them.

In my compliance role I supported the annual Sarbanes-Oxley testing of our policy administration and general ledger systems. I learned how auditors think by answering their requests: which population they wanted, why a screenshot was not enough, and how a missing approval on one change ticket becomes a finding. Last year I rebuilt our quarterly user access review. I wrote SQL queries that matched HR termination data against accounts in Active Directory and the ledger, which turned a two-week manual exercise into a report the business owners could sign off in three days, and it surfaced eleven accounts that should have been removed.

I passed the CISA exam this spring and am completing the experience requirement for certification. I have also started the CIA program because I want to understand internal audit as a discipline, not only as IT testing.

Your posting mentions a cloud migration and a new vendor management program. I helped draft the access standards for our first Azure subscriptions, and I know where the gaps hide when a team moves fast: service accounts with owner rights, logging left off in test environments, vendors granted standing access for a one-time project.

I would welcome the chance to discuss how I can contribute to your audit plan. Thank you for your time and consideration.

Sincerely, Jordan Patel