IT Systems Auditors

Key Responsibilities

Depending on level of experience and project assignment, responsibilities may include:

• Participating in the planning, execution, and reporting of IT audit and assessment engagements.
• Developing and executing audit programs, testing strategies, methodologies, and detailed testing procedures.
• Conducting risk-based assessments of information technology environments, systems, processes, and controls.
• Performing and documenting testing of IT General Controls (ITGCs), including:
• User access management and security controls;
• Change management and system development controls;
• IT operations and related controls;
• Application controls, including input, processing, output, and segregation of duties.
• Conducting interviews, walkthroughs, workshops, and evidence reviews with business and technical stakeholders.
• Evaluating the design and operating effectiveness of controls and documenting testing results and conclusions.
• Identifying control deficiencies, assessing associated risks, and developing recommendations for improvement.
• Preparing working papers, audit documentation, observations, findings, conclusions, and recommendations.
• Drafting, reviewing, and revising assessment reports, briefing materials, and other project deliverables.
• Presenting observations, findings, and recommendations to project leadership and client stakeholders.
• Supporting or leading audit team activities, including task coordination, quality review, mentoring, and supervision of junior resources, as applicable.
• Contributing to the continuous improvement of audit methodologies, assessment frameworks, and quality assurance practices.

Junior resources will work under the direction of senior team members and may be responsible for:

• Assisting with audit planning, fieldwork, testing, and documentation activities.
• Conducting research, evidence gathering, and preliminary analysis.
• Preparing working papers and supporting documentation.
• Assisting in the development of audit observations and draft reports.
• Participating in stakeholder meetings, interviews, and walkthroughs.

Intermediate resources are expected to work independently on assigned work streams and may be responsible for:

• Planning and executing audit testing activities.
• Conducting control assessments and documenting findings.
• Facilitating interviews and walkthroughs with stakeholders.
• Developing observations, risk assessments, and recommendations.
• Drafting sections of reports and presenting findings to project leadership.
• Providing guidance and support to junior resources.

Senior resources are expected to lead complex audit engagements and may be responsible for:

• Developing engagement strategies, work plans, methodologies, and testing approaches.
• Leading audit teams and overseeing the quality and completeness of deliverables.
• Supervising and mentoring audit staff.
• Reviewing working papers, testing results, and reports.
• Presenting findings and recommendations to senior management and executive stakeholders.
• Providing subject matter expertise in IT audit, ITGCs, information security, and risk management.

Candidates should possess a combination of the following qualifications, with specific requirements varying by resource level:

Mandatory

• Experience conducting IT audits, ITGC assessments, controls testing, risk assessments, or related assurance activities.
• Experience with audit planning, fieldwork, documentation, testing, analysis, and reporting.
• Knowledge of IT General Controls, application controls, information security controls, change management processes, and IT operational controls.
• Strong analytical, problem-solving, and communication skills.
• Ability to communicate effectively in English, both verbally and in writing.

Professional Certifications (one or more)

• CPA, CA, CMA, or CGA
• CIA (Certified Internal Auditor)
• CGAP (Certified Government Auditing Professional)
• CISA (Certified Information Systems Auditor)
• CISM (Certified Information Security Manager)
• CISSP (Certified Information Systems Security Professional)

Preferred Experience

• Public sector audit or assurance engagements.
• Internal audit, compliance, risk management, or controls assessment experience.
• Experience with recognized frameworks and standards such as COBIT, NIST, ISO 27001, ITIL, or COSO.
• Experience leading teams, reviewing deliverables, and engaging with senior stakeholders.