cmc/cleberg.net

  1#+date:        [2025-05-30 Fri 10:53:28]
  2#+title:       IT Audit Career: Skills That Matter
  3#+description: What skills actually matter in IT audit vs. what just looks good on paper.
  4#+slug:        it-audit-career
  5#+filetags:    :audit:
  6
  7* Introduction
  8
  9As trends have shown, the auditing and assurance world is increasingly becoming
 10overwhelmed with topics like [[https://kpmg.com/xx/en/what-we-do/services/ai/trusted-ai-framework.html][AI]], [[https://pcaobus.org/Documents/Audits-Involving-Cryptoassets-Spotlight.pdf][Digital Assets]], [[https://kpmg.com/us/en/articles/2023/building-trust-cloud-environments.html][Cloud]], [[https://kpmg.com/us/en/articles/2023/role-of-internal-audit-devops.html][DevOps]], and [[https://kpmg.com/ch/en/insights/technology/audit-transformation.html][Automation]].
 11
 12While these trends are rapidly transforming businesses and industries, audit
 13firms and departments are working hard to ensure they stay aligned with business
 14objectives.
 15
 16Throughout my career, I've seen topics like "AI" evolve from LLM-based projects
 17used by data scientists to everyday tools accessible to the masses and integrated
 18directly into business operations.
 19
 20As an auditor, skills in emerging technologies are an invaluable asset that can
 21translate into massive career opportunities and long-term job security.
 22
 23I have experienced this firsthand as topics like automation, AI, cloud
 24assurance, and DevOps have kept me in a secure position with significant potential
 25for growth and learning.
 26
 27In this post, I'm going to walk through the process of becoming skilled in an
 28emerging technology and how to translate that into a rewarding audit career.
 29
 30* Step 1: Build a Strong Foundation in Audit & Risk
 31
 32To start, I want to note that learning about emerging technologies is only
 33useful if you already have a base in auditing. You can't audit a cloud
 34environment with cloud knowledge alone — you also need to understand the
 35fundamentals of auditing.
 36
 37If you find that you're highly technical already, focus your time on learning
 38audit standards and guidance.
 39
 40You can customize this to any frameworks applicable to your company or industry,
 41but these are generally the baseline for an audit career:
 42
 43- [[https://www.coso.org/Pages/default.aspx][COSO]]
 44- [[https://www.nist.gov/cyberframework][NIST CSF]]
 45- [[https://www.iso.org/isoiec-27001-information-security.html][ISO/IEC 27001]]
 46- [[https://pcaobus.org/][PCAOB]]
 47- [[https://www.aicpa-cima.com/resources/assurance][AICPA]]
 48
 49The consistent theme throughout these frameworks is that audits rely on
 50independent parties who provide consistent documentation, appropriate
 51considerations of risks and responses, scoping, and reporting.
 52
 53One of the easiest ways to get this knowledge is by doing. While it can be
 54challenging, the concept is straightforward. If you are working in a role within
 55a department like internal audit, external audit, risk, compliance, etc., focus
 56on performing your role exceptionally and continuously challenge yourself to
 57learn more about audit and risk each day you work.
 58
 59* Step 2: Learn the Tech That's Changing the Profession
 60
 61Getting to the point of this post, there's a wide range of technologies transforming the audit
 62world. To accelerate career growth and discover a niche you enjoy, I've compiled
 63a short list of topics that are currently (1) growing in demand, (2) have a need
 64for more experts within the audit field, and (3) are expected to remain relevant.
 65
 66- *Automation & Data Analytics*: Alteryx, Python, Power BI, Tableau
 67- *Cloud*: AWS, Azure, GCP, IBM
 68- *Blockchain*: Decentralization, smart contracts, chain of custody
 69- *DevOps*: Azure DevOps, CI/CD, DevSecOps, GitHub, GitLab, Jenkins
 70- *AI/ML*: AI in business, AI in auditing, AI assurance
 71
 72#+BEGIN_QUOTE
 73*Pro Tip*: Tackle one area at a time. You don't need to become an expert, but
 74make sure you learn enough to conceptualize the technologies and logic behind
 75the topics you're auditing.
 76
 77If you focus on one at a time, you can dedicate time to that sole topic to
 78understand it more deeply before moving on to the next.
 79#+END_QUOTE
 80
 81* Step 3: Earn Certifications That Signal Credibility
 82
 83If you don't have much experience, or can't demonstrate your knowledge in a
 84particular area due to job constraints or otherwise, you can utilize courses
 85and certifications to boost your credibility. This is an effective way to
 86establish credibility and demonstrate your qualifications.
 87
 88- [[https://www.isaca.org/credentialing/cisa][CISA (Certified Information Systems Auditor)]]: Core certification for IT
 89  auditors covering systems, controls, governance, and assurance.
 90- [[https://learn.microsoft.com/en-us/certifications/azure-fundamentals/][Microsoft Azure Fundamentals (AZ-900)]] / [[https://aws.amazon.com/certification/certified-cloud-practitioner/][AWS Certified Cloud Practitioner]]: Entry-level
 91  cloud certifications covering core cloud concepts, services, pricing, and
 92  security.
 93- [[https://www.alteryx.com/certification/designer-core][Alteryx Designer Core Certification]]: Validates your ability to build data
 94  prep, blending, and analytics workflows in Alteryx.
 95- [[https://www.coursera.org/professional-certificates/ibm-data-science][IBM Data Science Professional Certificate]] (via Coursera): Teaches data
 96  science fundamentals, Python, SQL, and AI basics; popular for aspiring data
 97  auditors and analysts.
 98- Entry-level technical certifications:
 99  - [[https://pythoninstitute.org/pcep][PCEP (Certified Entry-Level Python Programmer) by Python Institute]]
100  - [[https://www.edx.org/learn/artificial-intelligence][AI certifications on edX]] covering foundations, governance, and AI ethics.
101  - [[https://www.blockchain-council.org/certifications/certified-blockchain-professional-expert/][Certified Blockchain Expert]]
102
103I have earned the following certifications and have seen great responses
104throughout my career due to the credibility they provided in these focus areas:
105
106- GitLab Certified Git Associate
107- GitHub Foundations
108- Alteryx Designer Core Certified
109- Microsoft Certified: Azure Fundamentals
110- Certified Information Systems Auditor (CISA)
111- Certified Entry-Level Python Programmer (PCEP)
112- Data Science Professional Certificate
113- Cybersecurity Audit Certificate
114
115* Step 4: Join Emerging Tech Projects and Pilots
116
117Once you have the knowledge and, if applicable, the credentials to showcase your
118skills, you need the chance to network and show what you can do.
119
120To do this, I recommend joining a group focused on the topic you're passionate
121about. Normally, this is easiest within your own company. However, sometimes you
122may need to seek other opportunities in your community or online to find the
123project that works best for you.
124
125- Seek opportunities internally: AI pilots, automation and data analysis
126  projects, blockchain initiatives.
127- If they don't exist — propose them.
128- Suggest automating risk assessments, piloting AI tools, or testing continuous
129  assurance routines.
130
131*Why this matters*: These projects become resume differentiators and position
132you for leadership roles.
133
134* Step 5: Build a Network of Tech-Savvy Auditors & Consultants
135
136As a segue from Step 4, ensure that you have a network of like-minded
137individuals who can challenge you and expose you to new ideas. This helps keep
138you sharp and open to innovation. Some suggestions include:
139
140- Join ISACA, local AI/ML meetups, blockchain working groups.
141- Engage with emerging tech communities on LinkedIn — share posts, comment on
142  thought leadership, or publish insights.
143
144* Step 6: Stay Curious and Keep Learning
145
146Last, but not least, keep learning! While you may feel like you know everything,
147there's always more to explore. I enjoy revisiting known problems from different
148perspectives, as it's helped me grow and realize that alternative approaches
149often yield better results with experience.
150
151- The landscape is changing rapidly — stay current on AI regulation, blockchain
152  security, cloud assurance frameworks, or whatever interests you.
153- Subscribe to niche newsletters (e.g., The Cybersecurity 202, AI Ethics
154  Weekly).
155- Take one course or certification per year to stay sharp.
156
157* Closing
158
159You don't need to be an engineer or software developer to thrive in technology —
160but you do need to understand enough to assess risk. With these steps, I have
161found a wonderful and fulfilling career, and I know you can too.
162
163If you have any questions on how to break into tech risk and audit, feel free to
164reach out over email or anywhere else — I would love to connect and chat!