How to become an IT Auditor

Ideal starting backgrounds

You're ready to start this path if you can:

• Explain what an internal audit is and what auditors do
• Have 2+ years in audit, IT operations, IT security, or compliance roles
• Understand IT systems at a functional level
• Be comfortable with detailed, methodical work (testing and documenting controls)

Not ready yet? If you don't have audit or IT ops background, spend 2 years building that first.

Goal: Prove baseline security and IT control knowledge before tackling audit-specific certifications.

Stage 1 total: $380 USD · R6,840 ZAR · 6–8 weeks

Study approach: Use Professor Messer (free YouTube), Pluralsight, or Udemy courses. The exam is 90 multiple-choice questions, 90 minutes, 70% pass rate. Most people score 70–78%. Do 100+ practice questions. Plan 8–10 hours/week for 6–8 weeks.

Lab requirement: Document security controls in your current IT environment (or a case study): access controls, encryption, incident response. Write a 5-page control assessment.

Goal: Get certified as a Certified Information Systems Auditor. This is the cornerstone credential for IT auditors.

Stage 2 total: $575–$760 USD · R10,350–R13,680 ZAR · 10–12 weeks

Study approach: Use ISACA's CISA Review Manual, Pluralsight/Udemy courses, and 200+ practice exams. The exam is 150 multiple-choice questions, 4 hours, 65% pass rate. Most people score 65–78%. You need 5 years of IT audit/security experience to sit (or substitute related experience). Plan 15–20 hours/week for 10–12 weeks.

Project milestone: Design a complete IT audit programme for a critical system (e.g., "Network Access Controls Audit"). Document: audit objectives, scope, risk assessment, control testing procedures, evidence requirements, and expected findings.

Goal: Add depth with either Internal Auditor (IIA CIA) or Risk Management (ISACA CRISC) credentials.

Option A: IIA Certified Internal Auditor (CIA)

Option B: ISACA CRISC (Risk)

Optional at hire time: Many people land their first IT auditor job after CISA alone. Security+ + CISA is sufficient for entry.

Study hours required: 250–300 hours total (Stage 1–2). If you study 15–20 hours/week, that's 4–5 months.

All figures: median base salary, not including bonuses/equity. ZAR = USD × 18 baseline (verified May 2026). Sources: Robert Half 2026 Tech Salary Guide, Glassdoor, PayScale, LinkedIn Salary.

South Africa note: Entry-level IT Auditors in SA earn R60,000–R85,000/month (equivalent to $55,000–$77,000/year). Mid-level (2–5 years) earn R85,000–R125,000/month. Senior (5+ years) earn R125,000–R180,000/month. Big 4 audit firms typically pay at the higher end. Internal audit at major corporations varies depending on industry.

Salary accelerators: CISA certification (+$8,000–$12,000/year), CIA certification (+$5,000–$8,000/year), CRISC certification (+$5,000–$8,000/year), and experience managing large audit programmes (+$15,000–$30,000/year). Transition to audit management/CAE roles adds $30,000–$60,000/year.

Month 0–4: Build Foundation

1. Get IT or audit experience — If you don't have 2+ years in audit/IT, do this first
2. Pass Security+ cert — 6–8 weeks; solidifies security fundamentals
3. Join ISACA — Membership ~$200/year; professional community
4. Document audit procedures — Collect examples of audits, control testing, findings you've conducted

Month 4–10: CISA Certification

• Intensive CISA study — 15–20 hours/week for 10–12 weeks
• Mock audit projects — Design 2–3 complete IT audit programmes (scope, testing, reporting)
• Pass CISA exam — Ensure you have 5 years of required experience (or substitute experience)

Month 10–18: Job Hunt + Optional Advanced Cert

• CV positioning: List yourself as "IT Auditor (CISA)" once certified. List ISACA ID and cert date.
• Target companies: Internal audit departments at large corporations, Big 4 audit firms (Deloitte, PwC, EY, KPMG), mid-tier audit firms. Banks, insurance, government agencies.
• Interview prep: Be ready to discuss: (1) A complex audit you conducted, (2) Control testing procedures, (3) How you'd audit a specific system (e.g., access controls, change management), (4) Your audit findings and recommendations, (5) Risk-based auditing approach.
• Salary negotiation: Entry-level IT Auditors in SA are offered R60,000–R80,000/month. Push for R75,000–R90,000. Use Robert Half Tech Salary Guide.

IT Auditor at a bank — Junior Level

08:00 — Audit kickoff meeting. You're starting an audit of the bank's network access controls. You review the audit plan with the IT infrastructure team.

09:00 — Conduct interviews with IT staff. You gather evidence: how do they provision access, who approves, what's the deprovisioning process?

10:30 — Test access controls. You sample 30 active user accounts and verify: (1) They have documented approvals, (2) Their access level matches their job requirements, (3) Inactive accounts are disabled. You find 2 exceptions; document them.

12:00 — Lunch.

13:00 — Document testing results. You write up your findings in an audit workpaper: what you tested, what you found, whether there's a control issue.

14:30 — Meet with the IT Security Manager. You present preliminary findings and ask for explanations of exceptions. They're valid (system migration); you agree to close the findings with compensating controls.

15:30 — Start writing audit recommendations. You draft: "Implement quarterly access reviews to ensure access levels remain appropriate."

16:30 — Wrap up the audit. You'll finish the formal report next week.

IT Auditor at a Big 4 firm — Mid Level

09:00 — Standup with your audit team. You're serving 3 client engagements: a bank, an insurance company, and a government agency.

09:30 — Client 1 (Bank): Lead the audit fieldwork. You're testing IT security controls. You assign testing tasks to your 2 junior auditors, review their work, and make audit judgements.

11:00 — Client 2 (Insurance): Attend a management meeting. Present preliminary audit findings: (1) Data backup procedures lack redundancy, (2) Incident response plan is outdated, (3) Access reviews are not documented. You recommend remediation.

12:30 — Lunch.

13:30 — Client 3 (Government): Draft the audit report. Compile findings, risk ratings, and recommendations. You assess overall IT control environment and provide executive summary.

15:00 — Internal: Mentor a junior auditor on your bank engagement. Review their access control testing; provide feedback and coaching.

16:00 — Quality review. Your senior manager reviews one of your audit reports before release to client.

17:00 — End of day. Tomorrow: present bank audit findings to the Audit Committee.

Market specifics

IT Audit is a strong field in SA, particularly in regulated industries. SA banks (Nedbank, Standard Bank, ABSA, FNB, Capitec), insurance companies (Discovery, Old Mutual, Santam), and government agencies all have internal audit departments that include IT audit specialists. Big 4 audit firms (Deloitte, PwC, EY, KPMG) and mid-tier firms (BDO, Grant Thornton) have active IT audit practices serving SA clients.

The advantage: IT audit offers job security and steady salaries, especially in large institutions and consulting firms. Remote work for Big 4 and consulting firms is increasingly available.

BEE/EE considerations: Large SA employers and audit firms have preferential hiring for previously disadvantaged individuals. CISA and CIA certifications are merit-based and help level the field. Many firms actively recruit from previously disadvantaged backgrounds for audit roles.

SA-specific resources

Q: Do I need IT or audit experience first?

A: Both are valuable. If you have one, you can learn the other. 2+ years in either IT operations, IT security, or internal audit is strongly recommended.

Q: Should I get Security+ before CISA?

A: Helpful but not required. Security+ builds foundational knowledge; CISA expects deeper audit/control expertise. Many people do Security+ → CISA in sequence.

Q: Do I need CISA or can I get hired with just Security+?

A: CISA is the gold-standard IT audit credential; most IT auditor roles require it. Security+ alone is not sufficient for IT auditor positions.

Q: Can I do this while working full-time?

A: Yes. At 15–20 hours/week, you can pass Security+ in 8 weeks and CISA in 12 weeks while working. Many people do this.

Q: Is it better to work in Big 4 audit or internal audit at a corporation?

A: Different pros/cons. Big 4 offers broader experience, client variety, and career mobility. Corporate internal audit offers stability and potential to transition to GRC/IT management. Choose based on your preferences.

Template version: 2026-05-02 | Maintained by IT Career Roadmap | ZAR baseline: R18/$1 USD File naming: Career_Paths/CP62_ITMgmt_IT_Auditor.md