Information Systems Auditor Job Requirements

As a third/last line of defense role within the risk function of an organization, an Information System Auditor (also known as IS/IT Auditor) being part of the internal audit department of an organization, is responsible for providing independent assurance to stakeholders (i.e. executive management, board of directors, customers, shareholders and investors) on the effectiveness and adequacy of system, process and operational controls around an organization's information systems and IT infrastructure. An information systems auditor typically performs IT assurance function and is primarily responsible for the identification and assessment of risk/vulnerabilities inherent in IT infrastructures and technology enabled processes within an organization while recommending controls/measures that will mitigate identified risk. He/she provide that independent assurance to the senior management and the Board of Directors that investments made in technology is enabling the business, creating the expected value to stakeholders of an organization and achieving business objectives. An information systems auditor in the course of his duties also helps stakeholders (i.e. senior management and the Board of Directors) in identifying some of the business pain points occasioned by the use of technology to provide services to customers and improve business efficiency, which management may not be aware of or have failed to address. An information systems auditor is a risk specialist and should be knowledgeable in risk management and control activities. He/she is expected to have requisite technical skills to be able to perform security assessment of IT systems and infrastructures.

Reporting line of an Information Systems Auditor

An information system auditor reports to the Chief Audit Executive (CAE) of an organization through his/her line manager while the CAE reports to the Board Audit Committee (BAC - a standing/oversight committee within the Board). This is to ensure independence of the internal audit function and good corporate governance practices within the organization. It is to be noted that the internal audit function that an information Systems Auditor belongs to administratively reports to the management (i.e. R-Responsibility) but functionally reports to the Board of Directors through the Board Audit Committee (i.e. A-Accountability).

Professional Certifications for Information Systems Auditors

To be endorsed as an Information Systems Auditor, practitioners must acquire the prestigious Certified Information Systems Auditor (CISA) credential by ISACA (Information Systems Audit and Control Association) in addition to other technical certifications such as certified information security manager (CISM), certified in risk and information system control (CRISC), COBIT 5 Assessor (IT governance assessor certification), ISO/IEC 27001 (information security management system), ISO/IEC 22301 (business continuity management system) among others.