What the role owns
Independent testing of whether the controls everyone else designed are operating, and the report that says so.
Who it reports to
A chief audit executive, or a client if the work is external.
A day in the job
Planning the audit, testing whether the controls other people designed actually operate, and writing the report that says so.
What employers test for
Audit methodology, sampling, evidence standards. CISA is commonly asked for. Independence is the job, not a formality.
How people get in
Internal and IT auditors. The framework knowledge is learnable; audit discipline is the harder half.
What it gets confused with
Not the control owner. An auditor who helped build the control cannot test it.
AI Auditor and AI Assurance: tools, skills and workflows
What does an ai auditor and ai assurance do all day?
Planning the audit, testing whether the controls other people designed actually operate, and writing the report that says so.
What skills do employers test for?
Audit methodology, sampling, evidence standards. CISA is commonly asked for. Independence is the job, not a formality.
How do people get into this role?
Internal and IT auditors. The framework knowledge is learnable; audit discipline is the harder half.
What is it often confused with?
Not the control owner. An auditor who helped build the control cannot test it.