An IT Auditor independently tests whether an organization's technology controls actually work as intended, then reports the results to the board or audit committee — not to the team whose controls are being reviewed. That independence is the entire point of the role: it exists specifically to check the checkers.
What the work actually looks like
- Planning an audit — scoping which systems, controls, or processes will be reviewed and against what standard.
- Testing controls against audit evidence — pulling logs, tickets, and configuration exports, and checking them against the requirement, exactly the way a GRC team does, but from an independent seat.
- Writing findings — documenting failures with a clear severity rating and a required remediation timeline.
- Following up — confirming a previously flagged finding actually got fixed, not just marked closed.
- Reporting to the board or audit committee — the reporting line that keeps the role independent from the teams it reviews.
Why independence is the defining feature
See internal audit vs. GRC for the full picture, but the short version: in the Three Lines Model, GRC is the second line (managing risk); internal/IT audit is the third line (independently verifying it). If the same team both ran the controls and audited them, a real gap could go unreported. IT Audit's reporting line to the board exists to prevent exactly that.
Skills that matter
A structured, skeptical mindset — the job is to look for what's wrong, not to assume things are fine. Enough technical literacy to understand what a system actually does and interpret its logs, without needing to write code. And clear, defensible writing, since an audit finding often has real consequences and needs to hold up to scrutiny.
Career path and certification
IT Audit and GRC careers overlap and cross-pollinate constantly. The certification most specifically tied to this work is CISA (Certified Information Systems Auditor) from ISACA, which requires 5 years of relevant experience to hold in full — see GRC certifications explained for how that compares to other options.