IT AUDITOR CONTRACTOR

What They’re Looking For

• A true IT auditor with at least five years of hands-on IT audit experience. ITexperience is important, but candidates should also have experience with broader, end-to-end integrated audits.

• Someone who has personally planned and scoped audits, not just performed J-SOX testing or followed a predefined audit program.

• A candidate who can learn quickly, adapt to unfamiliar environments, and hit the ground running.

• Someone who can identify existing controls and recognize control gaps or deficiencies.

• A strong writer who can prepare detailed workpapers that clearly explain the evidence reviewed and how the candidate reached each conclusion.

• Do not prioritize candidates whose experience is primarily in information security. Debbie wants an experienced auditor, not someone who would need to be trained in audit.

Initial Assignment and Upcoming Work

• The first assignment is a post-implementation audit of BlackLine, a product used for reconciliations. The audit plan is already in place. The auditor will need to quickly understand how BlackLine was designed and how the organization uses it.

• Several additional audits are planned after the BlackLine review.

• The team is currently working on data privacy readiness and compliance, reviewing the full data lifecycle to confirm the right processes are in place.

Audit Tool

• The team uses Optro, formerly known as AuditBoard. Experience with it is a plus, but not required.

ALSAC’s Internal Audit team is seeking a Senior IT Auditor with 5+ years of hands-on experience planning and conducting risk-based IT audits. This person will independently assess IT risks and controls, including IT general controls, and develop audit procedures for unfamiliar systems or processes when established programs are unavailable or insufficient. Responsibilities include conducting walkthroughs and testing, preparing risk/control matrices and workpapers, using data analytics, and communicating well-supported findings and recommendations. Candidates should have experience beyond routine SOX testing; CISA is preferred, and CISSP, CIA, CPA, or comparable certifications are beneficial.

Screening Questions

1. Describe your hands-on IT audit experience. How many years have you worked in IT audit and which areas have you personally tested?

2. Describe one IT audit you personally carried out from planning through reporting, excluding ITGCs. What was the scope, which deliverables did you own, and what support or direction did you receive?

3. Give an example of an IT control you tested. What risk did it address, what evidence did you examine, and how did you determine whether the control was working effectively?

4. Describe how you have used data analysis in an audit. What tool did you use, what analysis did you personally perform, and how did the results support your testing or conclusion?

5. Describe an IT audit finding you helped develop and communicate. What was the issue, how did you explain the business risk, and what corrective action did you recommend?