Hello everyone,

I'm an internal auditor at a Canadian public company subject to 52-109 (SOX in Canada). Over the past several years, our organization heavily encouraged the use of Power BI. Many teams independently developed their own solutions. We are now realizing that we have lost visibility over all those Power BI and don't have a clear inventory of who owns what. We are currently debating whether these Power BI solutions should be included in our SOX scope.

Arguments for Including Them: Our scoping approach is to include applications that have a direct/indirect impact on financial reporting or support internal controls. Some PowerBI are used to make pricing decisions or support operations (some financial impact).

Arguments for Excluding Them: PowerBI consume data but do not create, modify, or post transactions. The common counterargument is that these reports are just "large Excel spreadsheets" and we do not audit every spreadsheet.

My Question: How are other organizations approaching Power BI under SOX?

Thanks in advance for your insights.

How can we involve IT audit in a New SAP HANA S/4 Migration from a SAP ECC?

Hi, I’m just wondering if you guys have any great use case that specifically for testing. I have used a bunch in my work and overall it is great but since I deal with screenshots a lot, I am yet to find a solution that is accurate to populate information from images especially for testing and evidence checking. Any thoughts?

本人从事网络安全5年了，最近转向IT审计，作为审计新人，对于审计流程一头雾水，虽然我知道IT审计的理论，但是对于现场审计流程，还是不知道怎么办？如果有一份checklist，起码我就不会那么担忧应该从何开始。

Does anyone have any experience with Schellman? I may be interviewing with them soon. I’ve only heard great things, which is weird for public accounting. They seem to have really awesome benefits too. Are they really that great??

I've recently moved from external audit (accounting) into IT internal audit, and one thing I've been struggling with is what feels like a lack of methodology compared to what I was used to before.

In external audit, there were well-established concepts and principles that guided the work. Whether it was materiality, completeness, accuracy, existence, occurrence, or other assertions, there was usually a clear framework behind why procedures were being performed and how conclusions were reached.

Since moving into IT internal audit, I often feel like I'm missing that same foundation. I'm trying to understand what the equivalent methodology is supposed to be and whether I'm overlooking something.

At the same time, I'm very new to IT audit, so I'm not sure if what I'm experiencing is specific to my company, my audit team, or if it's something more common across the profession.

For those with more experience in IT audit:

• What methodology do you rely on when planning and performing audits?
• Are there concepts equivalent to financial statement assertions that help structure your thinking?
• How do you connect risks, controls, and testing in a consistent way?
• Is there a body of knowledge, framework, or approach that experienced IT auditors tend to follow?

One thing that would be especially helpful would be seeing an example of how experienced IT auditors structure a work program.

In external audit, I was used to seeing a clear chain between objectives, assertions, risks, and audit procedures. I'd be interested in understanding how that same thought process is applied in IT audit.

If anyone is willing to share a simplified example of an audit program (for example, user access management, change management, privileged access, etc.), showing how risks are translated into controls and testing procedures, I would really appreciate it.

​

Hi everyone,

​

I am currently conducting research for my master's thesis on IT auditing and auditor judgment and am looking for participants with relevant professional knowledge or experience in auditing, accounting, internal controls, risk management, compliance, or IT-related assurance activities.

​

The survey is completely anonymous.

​

Survey links:

​

1. AM version:

   https://docs.google.com/forms/d/e/1FAIpQLSc3n8yOLzPzRu_EGOFIhyThGI8Ue_A-HHqXkGC9sOAK8dlOkw/viewform?usp=header

​

​

1. CM version:

   https://docs.google.com/forms/d/e/1FAIpQLScC3UiBV1OF-iE71nHotroXnfth1UKzW8ze6Jo1uqzINulUxg/viewform?usp=header

​

Your participation would be greatly appreciated and would make a valuable contribution to academic research.

​

Thank you for your time and support!

​

Hey guys , I'm a college student currently studying business with a concentration in Management Information Systems at my college and I am hoping to delve into a career in IT auditing once i graduate . As of right now i aim to apply to internships but i don't have any skills or certs to showcase that would highlight me as a competitive applicant. auditing internships also aren't that easy to find if they are not for the Big 4( which are pretty competitive) .

Anyways i want to know your tips, tricks and roadmap certs that are necessary. So far my current research on GRC has evaluated COMPTIA security + as the best cert to start with before moving onto to ISACA fundamentals or COBIT ,then Comptia CYSA + and then CIRSC and finally CISA or CISSP . In regards to project work ,sites like extern look helpful for data analysis, product management , strategy or cyber defense but host nothing specific to auditing.The only Auditing like courses my MIS concentration offers are Information System Audit and control and Information Security and Assurance. Anyways what do you guys recommend as necessary for my journey .

Hi there

Just for the context i work from back offices of big 4 here in India.

So i am currently working in one of the Big 4 and i have almost completed 4 years in this domain. Ever since I joined this domain i have never liked it.
Reason being it that:
- Just documentation of IT controls and i feel it is very mundane and un motivating.

-Too much of work assigned with my 45 hrs days split into multiple projects . This is very frustrating to manage as you juggle between different projects and all of the projects are priority.

-Task never gets completed in budgeted hours and i feel budgeted hours are very squeezed to complete the work.

Basically i am frustrated with this job and need to get out of it. I feel i am not cut out of this and I don’t have any career growth in it.

I need some genuine suggestions . Please help me out.

TL;DR
Struggling in IT Audit career. Want an exit.

Interested in gaining people’s thoughts

Just want to hear what actually worked for people who didn't come from a typical IT or accounting background. IT audit is something I've been trying to break into for about a year and a half now but haven't had much luck yet.

Hello I have been in the field for almost 2 years now. Everyday I hear a lot of changes, automations and AI. My department was outsourced to consultants and half the team was laid off. What is the future for this profession I al still entry level and the decision making it is done by senior managers and above. I don’t even understand what would be my role in the upcoming years.

Hi everyone,

I have been really interested in IT audit lately because I feel it’s works well with my personality and the way I think.

I was wondering what the average entry level salary is for this field? And do you feel there is upward mobility? If anyone can provide some insight. Thanks!

I am 6+ year experience guy from big 4 into IT Audit. And wanted to answer or share knowledge.

I joined a tech audit rotational program straight out of college and have been in the role for about 9 months.
I have an MIS degree, but a lot of the concepts and terminology I encounter at work still go over my head.
Despite putting in the effort, I feel like I'm constantly playing catch up.

I usually get to the office around 6:40 AM and work until 5 PM because tasks take me longer than they seem to take others. I regularly schedule 1:1s with my audit lead and ask questions after walkthroughs, but the amount of information can feel overwhelming. The program ends in another 9 months, and we're expected to be promoted to Associate, which honestly makes me nervous because I don't feel like I've progressed enough.

In about a month, l'll be staffed on 3 audits (assigned 4 controls in total) at once, mostly focused on data quality but I will be working with 3 different AICs who I’ve heard have very different testing approaches and documenting styles. A lot of my work involves data in transit, APls, configurations, and code reviews. Some analysts in my cohort think I should tell my manager that 3 audits may be too much, but our team is understaffed and I don't want to come across as incapable or need hand holding.

For those in IT audit, how did you develop a stronger technical mindset? Any advice on how to approach walkthroughs regarding data quality? Any advice would be appreciated!!

I recently graduated with a Bachelor's in Information Systems, I have CompTIA A+, Network+, and have done an IT audit internship. I have mainly been applying to help desk support roles but haven't been able to even get an interview so far. Should I start applying to IT audit roles as well? The entry level pay is better from what I'm seeing (around 42k-45k for tier 1 helpdesk, 60k for IT audit). Would it be okay to list CISA (in progress) on my resume if I start studying for the exam? Seems like every IT audit job lists it as a requirement. What would make me a competitive candidate? I was kind of hoping to try out a more technical role but I'm not so sure that the grass is that much greener over in help desk.

Another thing I was wondering if how much continuous education IT audit requires. I would assume you need to keep your technical knowledge some what current and have a broad understanding. However, you wouldn't need to know the exact hands on technical stuff of how to be a systems administrator or network engineer (though it wouldn't hurt)? Feels like with IT you have to be constantly putting in hours outside of work and then many positions require you to be on call work weird hours, etc. Do you all feel like the work life balance is better or worse than IT? I worked in internal IT audit and have heard that external might require more hours during busy season. Internal seems less stressful and preferrable to me but I understand that I probably can't be picky.

Would greatly appreciate any advice.

Curious what everyone has been using for audit software recently.

For context, we've been using AutoAudit for several years and renewed our contract a few years ago. However, after being purchased by Empowered Systems, we're shifting away from this product due to jump in cost and lack of resources to implement a new solution which would be more integrated with other organizational systems and data. Our organization's data modernization could use some work and, frankly, it's not ready to be consumed by comprehension compliance/audit software.

I'd argue we don't even use AutoAudit for its full functionality. It's primary benefits for us are approval routing of audit documentation (particularly mass review/approval functionality), secure data collection and retention, as well as being fairly well accessible to new auditors (this is more important to to financial auditors in our department).

Has anyone been using AutoAudit but recently transitioned to another product? Or have you been using something home grown (i.e. SharePoint sites/document libraries, internal file shares, etc.) to accomplish this for your organization?

Appreciate the input.

Hi everyone,

So I just landed a role in IT Audit government contracting. I’m a recent grad & interested in the field especially since I’m naturally analytical & curious.

I wonder what type of growth opportunities there are in this field? And if this can be a good starting point to do more GRC type of work. feel free to give your input

Hey everyone, the sub is back to public after the bot crush. Hopefully we can avoid that in the future.

When I first got into IT audit, it felt more compliance-focused.

Now I’m seeing way more overlap with:

• Vulnerability management
• Cloud security
• IAM design

Sometimes it feels like we’re expected to understand everything security-related, but still operate as auditors.

Do you think IT audit is evolving into a hybrid role?

Or are expectations just getting unrealistic?

I’ve been in IT audit for a while now, and lately it feels like a lot of work is just ticking boxes rather than actually understanding risk.

For example, we’ll flag something because it doesn’t match the control wording exactly, even when the real-world risk feels low. Meanwhile, bigger issues sometimes get less attention because they’re harder to quantify.

Is anyone else seeing this shift?

How do you balance:

• Following frameworks (SOX, ISO, etc.)
• vs actually applying judgment and focusing on real risk?

Curious how others handle this without pushing back too hard on management.

As the title says, I am looking what are the best cities/states to live in order to have higher salary and more opportunities in the IT Audit career. Any help would be appreciated!

Hey everyone! I had 9 years of IT experience and ive been in audit for about a year and a half. Does anyone have a similar background and what does your resume look like? I would love to learn more about how you guys structure it to show your technical exposure but at the same time highlight your audit experience.

Could anyone make a realistic plan to do this transfer in 2 years?