Hi! Im planning to shift career from treasury (investment) associate to any internal audit role (risk, control, process).

I need advice how can i shift after 1-2 years in treasury. Im an internal auditing graduate anyways. Is it still possible to shift

Fala, pessoal! Estou participando do Programa de Estágio Corporativo 2026 do Itaú pela Gupy e queria saber se alguém aqui está passando por uma situação parecida.
Eu me inscrevi inicialmente no Banco de Talentos pela trilha de Tecnologia. Depois, o próprio Itaú entrou em contato comigo e fez um direcionamento/match para Negócios Atacado. Fiz o teste de inglês e as outras etapas do processo.
Atualmente, minha candidatura está assim:
Avaliação com Time de Seleção → concluída ✅
Entrevista com a Liderança → aguardando ⏳
Essa etapa está parada desde 11/08, então já faz umas três semanas.
Queria saber se alguém que está participando do Estágio Corporativo 2026, principalmente em Banco de Talentos/Negócios Atacado, também está nessa etapa ou já passou por isso.
Quanto tempo vocês ficaram esperando para chamarem para a entrevista com a liderança? E depois que chamaram, como foi?
Também queria entender uma coisa: quando o Itaú faz esse “match” para Negócios Atacado, isso significa que já existe uma oportunidade específica esperando o candidato ou eles deixam o perfil no banco de talentos até aparecer uma oportunidade?
Se alguém já passou por isso e puder contar como foi, ajudaria muito! 🙏

If any one can refer me for technology risk and IT audit role in Toronto, I’ve sent several applications with so many rejections

Hello, I am currently taking a course on IT Auditing and Secure Operations, and I have an assignment that requires me to interview someone who is currently working as an IT Auditor or who has previously worked in that role. I would greatly appreciate anyone willing to answer these questions, even if you're not currently working as an IT Auditor but have experience in the field.

Question #1: What company do/did you work for, and what is/was your position?

Question #2: How many years of experience do you have working as an IT Auditor?

Question #3: What degrees or certifications have you obtained that are relevant to working as an IT Auditor?

Question #4: What led you to pursue a career in IT Auditing?

Question #5: What do you like and dislike about working in IT Auditing?

Question #6: Where do you see yourself professionally in five years?

p.s. The answers can be simple and short.

Got an offer for IT Internal Audit at mid-sized firm after a summer internship. Didn’t love the work but didn’t hate it also. Would probably be more exciting with increased responsibility as opposed to just testing controls.

I am now in a graduate program with tons of resources to recruit and have been going back and forth on the offer. What options should I consider? Does the work become more exciting? What movement opps are there? Pros and cons of moving to a smaller company?

Thanks!

Title: How are IT auditors using Python and Power BI in practice?

I’m an IT auditor, mainly providing assurance over areas such as cybersecurity and IT controls, and I’ve recently started learning Python.

I’m noticing more Head of Audit / senior audit roles asking for stronger data analytics skills, so I’m trying to understand how best to develop these skills in a way that’s actually useful for IT audit rather than just learning Python in isolation.

For those working in Internal Audit / IT Audit:

* How are you using Python in your day-to-day audit work?

* Are there particular audit procedures or testing activities where Python has been especially useful?

* Can it be used effectively for producing or analysing management information (MI), identifying trends/anomalies, or testing larger populations of controls/data?

* Does anyone combine Python with Power BI for audit analytics/reporting? If so, what does your workflow look like?

* If you were an IT auditor trying to become more data-analytics focused, what Python skills or projects would you prioritise?

I already have some exposure to Power BI, so I’m particularly interested in whether developing Python alongside it is worthwhile and how the two can complement each other in an audit environment.

Would be really interested to hear practical examples from people who are already doing this.

Hi everyone,

I'm a final-year Data Engineering / CS student based in Southeast Asia. Given how brutal and saturated the entry-level SWE/Data market is right now, I cast a wider net and ended up landing an IT Audit Internship at a Big 4 firm starting next month.

I’m genuinely excited because having a Big 4 name on my resume is a massive career booster, and I’m seriously considering building a long-term career path around IT Audit / Tech Risk / GRC.

However, I have zero formal background in accounting, auditing, or compliance frameworks.

Here is a quick snapshot of my technical background:

Core skills: SQL, Python, Relational Database Design, Linux/Bash, Docker.

Data Stack: Experience building ETL/ELT pipelines, data modeling.

Other: Practical experience in Business Analysis (writing requirements/specifications, mapping workflows).

The internship JD mentions typical responsibilities: testing IT General Controls (ITGCs - access management, change management, operations), application controls, system interfaces, walkthroughs, documentation, and leveraging data extraction/analytics for audit procedures.

Since I have about a month before onboarding, I would love to ask for your insights:

How well do Data/CS skills actually translate to IT Audit?

Will my background give me an edge in audit analytics/automation, or is the day-to-day mostly qualitative compliance and screenshot ticking?

What should I study right now to hit the ground running?

What are the highest-yield resources (videos, articles, frameworks) to understand ITGCs, SOX 404 testing, working papers, and walkthroughs before Day 1?

What is the long-term career trajectory for someone with technical depth in IT Audit?

Do people typically stay in IT Audit/Internal Audit, or leverage it to pivot into GRC, IT Risk, Data Governance, or Cybersecurity Consulting?

Common pitfalls for technical folks?

What are the biggest culture shocks or mistakes engineers typically make when adapting to the Big 4 audit mindset and documentation standards?

Any tips, study recommendations, or candid advice would be greatly appreciated! Thank you so much.

Hi everyone,

I’m currently looking for an opportunity to start/build my career in IT Audit, Technology Risk, IT Controls, GRC, or Cybersecurity Risk in Canada, and I’d really appreciate some advice from people already working in the field.

My background is a little unconventional. I originally came from an accounting and financial operations background and then deliberately transitioned into Project Management and Cybersecurity through graduate programs in Canada.

I’ve also gained experience in Technology Risk & IT Audit, where I worked on ITGC reviews, access management and security controls, audit evidence, risk registers, remediation tracking, control effectiveness, and risk reporting.

On the cybersecurity side, I've completed projects involving:

• NIST CSF / NIST RMF
• NIST SP 800-53
• ITGC and control assessments
• Risk assessments and risk registers
• ISO 27001 / SOC 2
• Vulnerability assessments
• IAM / access controls
• Security policies
• SIEM / EDR / DLP concepts
• Business continuity and disaster recovery
• Audit and compliance documentation

I’ve completed graduate certificates in Project Management and Cybersecurity, hold AZ-900 and SC-900, and I'm currently working toward CISA.

I'm primarily targeting entry-level/early-career roles such as:

• IT Audit Analyst / Associate
• Technology Risk Analyst
• IT Controls Analyst
• GRC Analyst
• IT Risk Analyst
• Cybersecurity Risk Analyst
• IT Compliance Analyst
• Technology Assurance Analyst

I'm currently searching across Ontario, particularly Toronto, Mississauga, Hamilton and Ottawa, and I'm open to hybrid, onsite or remote opportunities.

For those already working in IT Audit/Technology Risk:

1. Does my background sound competitive for entry-level IT Audit/Technology Risk roles?

2. Are there particular skills or certifications you would recommend I prioritize to become more competitive?

3. For someone transitioning from accounting/business into technology risk, what would you emphasize on the resume?

4. Are there particular companies, recruiters or job boards in Canada that are good for early-career IT Audit/GRC opportunities?

I'm not necessarily looking for someone to hand me a job. I'm mainly hoping to learn from people who have already made it into the field and understand what Canadian employers are looking for.

Thanks in advance for any advice. I really appreciate it. Early-career IT Audit / Technology Risk professional looking for opportunities in Canada — advice appreciated

I got an offer for internal audit domain instead of statutory audit.
I will have to relocate to another city for this

Is this worth the effort to relocate to another city for this opportunity?
And overall is this worth the effort ?
I dont have any other option yet to choose from .

Senior manager in Global IT Audit at a global fashion/DTC retailer. Genuinely trying to figure out where the field actually is on this versus the LinkedIn highlight reel version.

Almost every AI conversation I see lands on efficiency gains: faster summaries, faster drafts, faster walkthroughs. That’s real value, I’m not knocking it. But I want to know who’s gone past that.

A few questions for the group:

**•** Is anyone building actual agents for document analysis, think SOPs, policies, control narratives, versus just prompting a chatbot one document at a time?  
**•** Has anyone gotten hands-on at the command line with something like Claude Code or Codex to build internal tools? I asked my org for an enterprise Claude Code license and was told it wasn’t worth the cost. So for now I’m doing this the old-fashioned way, one chat window at a time.  
**•** Is anyone actually getting value out of Copilot Cowork? 

I can see value in analysis and review of control documentation submitted for controls subject to continuous monitoring. We could use the document analysis rule set to analyze for internal consistency so that with the full expectation that the documentation is gonna look and feel the same every single time because it’s the same control, same control owners, same control, performance set, etc. coworker could be used to execute the entire continuous monitoring program and each document can be analyzed specific to how it’s created in that control is specifically performed.

Here’s where I’ve landed on the audit side. I built a small agent chain for control remediation work:

**1.**  Feed it the transcript from the remediation meeting with the control owner.  
**2.**  It gives me structured feedback to send back to the remediation owner.  
**3.**  It converts that into a starter SOP draft.  
**4.**  I hand the owner a second prompt that interviews them against a rule set for what a good SOP looks like, to fill in whatever the transcript missed.

The idea is that over time, as SOPs get renewed and findings come in, we build toward a consistent baseline of SOP quality across the org instead of every process owner writing to their own standard.

One more thing worth mentioning: I’ve also turned this inward. Everything’s recorded now anyway, so I run transcript analysis on my own meetings, particularly exec-facing ones, to check how closely I stuck to my talking points versus where I drifted. I’ve started doing the same for my staff, using the same recorded meetings, emails, and Teams messages, as a development tool.

Curious where the rest of you land on this. Ahead of the curve, behind it, or about where everyone quietly is? Especially interested in hearing from anyone in retail, fashion, or another industry drowning in document sprawl.

Having recently finished up a role heading up customer data and governance, I’ve had some downtime to reflect on where data governance is actually heading versus where vendors say they’re heading.

Here is the key friction point I’m seeing currently.

Big tech wants you to centralize everything in their stack, automate every business process, plug in their native AI, and rely on their built-in, proprietary governance features.

In contrast, most organizations are actively building decoupled operating models to avoid vendor lock-in, maintain agility, and avoid single points of failure.

For auditors, you're left stuck in the middle trying to piece together compliance, automated logic, and data integrity across a fragmented web of systems that don't natively trust each other.

As a result, I foresee the emergence of an independent, third-party forensic witness layer, an out-of-ecosystem system that immutably logs and verifies automated decisions outside of the platform where the decision actually happened.

I'm keen to hear what auditors think based on what they're experiencing currently.

Hello I am a CPA and currently work for a public company as an Audit lead. Currently my main focus is acting as the main point of contact for my company's SOC examinations and I assist at times with the annual SOX audit. I work about 35 to 40 hours a week and I make about 120k (includes base, bonus, and stock) a year with the ability to work fully remote. I do not really know what the next step is in my role, and at times I feel I am in the dark about the next promotion or what I am supposed to be working towards. I have absolutely no Idea what my earning potential would be. The company is good, and I get along with everyone, and I have a great boss.

Prior to this I worked in public accounting/assurance performing SOC 1 and 2 examinations. I enjoyed it even though I worked between 40 to 45 hours a week. I also worked remote for the most part here too. If I transitioned back, I would probably be making as much as I do now and could probably land a fully remote job. In this job I knew what my career/earning potential would look like. I would go from senior to manager, and eventually to partner.

My question is, should I stay in my current role acting as simply a point of contact or should I transition back to external audit and try to land a manager position making similar to what I am now? Or am I being ungrateful and I should stay in my current role?

Any and all advice is welcome, I appreciate everyone's input.

Hello everyone, I am an IT Auditor with about 7 years total experience but 3 in IT Auditor. I ama senior now and have a pathway to Lead or Manager in 2-3 years.

I do a lot 70% SOX, 20% Ops Audit and 10% doing fun stuff like AI Enablement projects.

I enjoy the AI Enablement stuff more than what I do mostly. I am tired of the hostile findings conversations, boring audits. I want to pivot to heavy AI audit or AI Governance.

I am a little bit confused on what a pathway looks like since it is relatively new. What are some skills and knowledge I should gather and where can I learn more.

Hi!

Longer time lurker here! I just wanted advice about this industry. I have been working in IT audit for 1.5 years now at a Big 4 firm in the US. This is my first job out of college and I am a first generation student, so I'd really appreciate the advice.

While the experience has been great, the work culture is super toxic. Everyone says there's a "busy season" but it never really ends. Even though it is summer right now, I still average 50 hours a week.

During my first year, I worked through busy season and studied for the CISA. I took it recently for the first time and failed by 7 points (score was 443). I don't have plans to take it again anytime soon since I am dealing with family issues at the moment.

With that being said, I want to leave Big 4 by the end of 2.5/3 years before promotion to senior. I know everyone says to stick it out until senior but I am so burnt out. I do plan on retaking my CISA after I transition to another job.

I actually love the work, but the hours are insane. Mentally, I am checked out. I am curious if it is any different if I switched to IA in industry. Are the hours better since I don't have to juggle multiple clients? Is this work culture only a Big 4 thing or an industry thing as a whole? If I want to get into GRC, would I need my CISA?

Any advice welcome! Thanks :)

Hi everyone,

I’m Charan, currently working at an MNC as a Project Engineer with experience in SOX audits, ITGC testing, walkthroughs, control testing, and audit documentation.

I’m currently exploring opportunities in IT Audit / Internal Audit / Risk & Compliance.

I’m open to opportunities across India, especially Hyderabad, Bangalore, Chennai, or remote roles.

If you know of any relevant openings or can refer me, I’d really appreciate it. Please feel free to DM me.

Thanks!

Same as above

Hi all, long time lurker here. I’ve just graduated with a first class degree in computer science with cyber security in the UK, and I’m looking for entry level IT audit, GRC or cyber consulting roles in London starting September.

A bit of background. I’ve done two Big 4 summer internships in advisory and assurance, with the most recent one in technology controls, so I’ve had a proper taste of ITGC work, walkthroughs, testing and writing up findings. I enjoyed it a lot more than I expected to and I’d like to keep going in that direction rather than drift into something else.

So two asks really. If you know of a team hiring, whether that’s a grad scheme, an off cycle opening or just a firm that tends to take people on around now, I’d love to hear about it and I’m happy to send my CV over. And if you’re not hiring but you’re up for a chat about the field, how you got in, what the day to day is actually like, what’s worth learning first, I’d love that too. I’m genuinely just trying to talk to more people doing this job.
Thanks for reading, and happy to answer anything about the internships if it’s useful to anyone else trying to get in.

Team, can someone please clarify how you approach ITGC scoping for SOX?

What I have seen as a common trend is that ITGCs generally fall under three areas: Logical Access, Change Management, and Computer Operations (job scheduling, backups, incident management, etc.).

However, when I ask how we arrived at these specific areas, or what authoritative guidance or standard drives that scope, I rarely get a definitive answer.

For example, I have seen some SOX programs include physical security and backups within ITGC scope, while others exclude them. This makes me wonder: what actually drives these differences in scope across SOX programs?

Interested in hearing how others approach and defend their ITGC scope, especially with external auditors.

A bit of an overall engagement post for those who have worked in IT Audit already, what got you started in the business?

My first encounter with IT Audit was being on the receiving end of a major audit issue where they pulled me in as a data SME to answer questions and go through a LOT of logs. That eventually lead to a pivot into the IA department and then getting a slew of ISACA certifications as I gained experience.

Throwing this out here because I'm going in circles in my own head and I need it out of there.

Context I'm a software engineer, mostly full-stack + some AI/ML stuff (built real-time audio pipelines, churn models, the usual DevOps/CI-CD toolkit). I graduated a year ago and it's been a full year of unemployment since. The market in 2026 is just... brutal. Applications into a void, a handful of interviews that go nowhere, the occasional "we went with someone with more experience" for a junior role. I know I'm not alone in this but it doesn't make it less exhausting.

Somewhere in the middle of all this, I landed a PhD offer. On paper it's a good opportunity. In reality? I'm not excited about it at all. I think I'd be doing it because it's there, not because I actually want it, and I know that's not a good enough reason to commit years of my life to something.

So now I'm eyeing a different escape hatch: an M2 (master's) in audit at a solid school. Different world entirely, more stable hiring pipeline, a real credential, a reset button on this whole job search nightmare.

Except here's the annoying part: I can't let go of the "I'm a software engineer" identity. I've built things I'm proud of. I like the work. Some small stubborn part of me feels like switching to audit would mean giving up on something I actually wanted, just because the timing and the market screwed me over.

So I'm stuck between three options that all feel wrong in a different way:

• Keep grinding the SE job search and hope it turns around
• Take the PhD offer despite not being into it, because it's "something"
• Pivot to audit M2 and try to make peace with leaving SE behind

Anyone else been in this exact kind of limbo job market forcing your hand into a path you didn't actually choose? How did you figure out what to do? Did the pivot end up feeling right, or did you regret not sticking it out?

Not really looking for "just keep applying, it'll work out" I've heard that a lot and at some point it stops being useful advice. Looking more for how people actually made this kind of decision when none of the options felt exciting.

Hi everyone,
I graduated with a BS in Internal Auditing and I’m planning to study a Master’s degree in Australia (possibly Information Systems or Cybersecurity) because I want to transition into IT Audit.

I have a few questions for those who are already in Australia or working in audit:
Is IT Audit a good career path in Australia?
Is there good demand for IT Auditors?
Would having a Master’s in Information Systems or Cybersecurity improve my chances of getting an IT Audit role?

If you were in my position and want to become an IT Auditor, what would you choose to take, Master’s in Information Systems or Cybersecurity?

I’d really appreciate hearing from anyone who has gone through a similar path or is currently working in audit in Australia.
Thanks in advance!

I worked in Internal Audit for a Fortune 200 company. As part of my position, I was responsible for the IT SOX reliance testing. The first control we test during the year is the periodic administrator access review and terminations testing. There are 2 "minor" (lol) issues with the admin. access review:

1. The reports used in the review rely on the annual administrator access review. The IUC used to substantiate the reviews is not retained; therefore, the annual access review's control design would fail.
2. The periodic admin access review uses the annual review's report and is not updated monthly. In fact, we identified accounts that were active but had inappropriate access for 5 months, and my team detected them. Again, control design fails.

These deficiencies are pervasive across all systems (e.g., ERP, mainframe, etc.). So, I suggested to IT management to test the key control, in this case, deprovisioning. They pushed back on it. They want us to test them, and they'll cover the budget. It relies on a bi-weekly Altryx workflow implemented in 2010, and the configurations have not been reviewed since then. I wanted to test the termination configurations vs. the review to find out that IT management has NEVER tested the termination configuration (wait, what?!?).

Let me stop there. My director is an IT auditor, but has never worked on SOX. My seniors and I meet with them weekly to discuss our findings, and she takes over conversations with IT management. During those meetings, I would repeatedly ask for their response, which would eventually be "This person is overwhelmed, so they can't do their job," and my response is always "Let's call the exception and let them decide what to do with it." She was also informed about the "budget", which I rebutted, stating that I cannot test a control that has not been validated as remediated by IT management.

To make things worse, on a monthly basis, Internal Audit would meet with the IT Director to update them on the current Internal Audit engagements, and started noticing that the IT SOX issues suddenly disappeared from the slides.

The company undergoes A LOT of regulatory audits, but IA mgmt doesn't collect those reports... because why wouldn't we need to know about those audit deficiencies? The Company utilizes federal and state funds, and is critical failure/resilience point in disasters.

Also, the external auditor was never notified of these issues (because why would they?) My director's favorite line with me is that the company is over 120 years old... [Fill in the blank]. I also spoke with the VP of Internal Audit about these issues, and nothing happened except for them forcing me out last December.

I have been in spots in my career where I've felt uncomfortable, but never have I been put in a place with so many glaring holes that can affect the entire integrated audit, and there wasn't enough time to investigate. Or such weak management. I got the feeling that my director didn't want to "rock the boat"... Grow a backbone. We're internal audit, act like it. Work with IT management to resolve issues rather than sweeping them under the rug.

So, I've kinda been in limbo. I moved to another city. I am still really salty about it. I feel like I was gaslit for a whole year.