Are you applying for IT Audit jobs in industry or PA?
The CISA is a big HR checkbox for industry IT Audit, less so for PA since you're still heavily involved in financials. This sub underestimates the CISA heavily because it's an IT GRC certification, not an accounting one.
Still apply for jobs, but I would highly recommend you start studying for the CompTIA+ fundamental IT certs (i.e. A+/Net+) and the CISA to actually show recruiters that you're interested in systems and IT controls.
Well, it's really up to you. I would look up the objectives for each cert and see what interests you more.
The CISA teaches you how to be an IT auditor "the ISACA way". It gives recruiters a baseline that "this person understands IT auditing concepts". The A+, Net+, and Sec+ on the other hand, teaches you fundamental IT concepts, which is important for someone who is brand new to the field.
The CISA will probably help you land a job first and is more analogous to the CPA, so I recommend that one first. The CompTIA+ certs will help you understand what the hell you're doing once you land the job, especially in industry.
So, I've never been in PA, but from what I heard in terms of IT Audit lines, it is insanely boring. Screenshot central. Just because it's almost all entirely IT SOX work. Someone else can correct me if I'm wrong.
Pros of going into PA first, especially Big 4, is that it looks good on a resume and you can try to transfer to another, more advanced IT or InfoSec line by networking with other teams. But you're already kinda in that position.
Pros of going into industry is that if you choose more selectively, you can find an IA/IT Audit function that does very little compliance work and is in a much more advisory/operational role. Much more room to be innovative and learn about IT and business systems.
I made the switch from Tax to IT Audit 9 months into my career. I talked to my coach and he connected me with some people, who eventually let me change about two months later to IT Audit. Granted this was at a midsized firm, before I was big four. In my opinion, it is harder to make that move at a big four firm, but not impossible.
Feel free to DM me or comment if you have specific questions, but I agree with some of the comments above that you really want to understand what IT Audit is and the exit opportunities it offers.
As someone who has been in the IT Audit sector for 1.5 years and is leaving for a new job. Make sure you understand what you're getting into, in my opinion. IT audit is essentially mindless control testing; unlike internal audit, which provides business exposure and allows you to learn about business difficulties, IT audit does not provide any system or related exposure, and anyone who claims otherwise is either lying or does not know what he is talking about. I've worked on IT external, internal, and SOC reports, and believe me, in the end, you're just testing 6-7 items. It is quite easy to become pigeonholed in this job, and it is extremely difficult to do something else.
If you are considering a transfer, consider internal or external audits before IT audits. Otherwise, you'll be stuck capturing screenshots and arguing with clients about why the taskbar wasn't included in the screenshort and why you now need another one.
Best of Luck!
I agree with this 110%. As someone who was unintentionally pigeonholed because I didn't know what I was getting into, I would advise anyone pursuing IT audit to investigate the field thoroughly. It is NOT what most people think it is. And it definitely isn't a pathway into anything IT related.
Are you applying for IT Audit jobs in industry or PA? The CISA is a big HR checkbox for industry IT Audit, less so for PA since you're still heavily involved in financials. This sub underestimates the CISA heavily because it's an IT GRC certification, not an accounting one. Still apply for jobs, but I would highly recommend you start studying for the CompTIA+ fundamental IT certs (i.e. A+/Net+) and the CISA to actually show recruiters that you're interested in systems and IT controls.
I've been applying for both industry and PA. Which cert would you recommend first?
Well, it's really up to you. I would look up the objectives for each cert and see what interests you more. The CISA teaches you how to be an IT auditor "the ISACA way". It gives recruiters a baseline that "this person understands IT auditing concepts". The A+, Net+, and Sec+ on the other hand, teaches you fundamental IT concepts, which is important for someone who is brand new to the field. The CISA will probably help you land a job first and is more analogous to the CPA, so I recommend that one first. The CompTIA+ certs will help you understand what the hell you're doing once you land the job, especially in industry.
In that case, I'll pass the CISA first to help me land a job. Do you think it's advantageous to start in PA first? Appreciate your detailed responses.
So, I've never been in PA, but from what I heard in terms of IT Audit lines, it is insanely boring. Screenshot central. Just because it's almost all entirely IT SOX work. Someone else can correct me if I'm wrong. Pros of going into PA first, especially Big 4, is that it looks good on a resume and you can try to transfer to another, more advanced IT or InfoSec line by networking with other teams. But you're already kinda in that position. Pros of going into industry is that if you choose more selectively, you can find an IA/IT Audit function that does very little compliance work and is in a much more advisory/operational role. Much more room to be innovative and learn about IT and business systems.
PA should not be hard to get into. Look at midteir firms as well.
I made the switch from Tax to IT Audit 9 months into my career. I talked to my coach and he connected me with some people, who eventually let me change about two months later to IT Audit. Granted this was at a midsized firm, before I was big four. In my opinion, it is harder to make that move at a big four firm, but not impossible. Feel free to DM me or comment if you have specific questions, but I agree with some of the comments above that you really want to understand what IT Audit is and the exit opportunities it offers.
As someone who has been in the IT Audit sector for 1.5 years and is leaving for a new job. Make sure you understand what you're getting into, in my opinion. IT audit is essentially mindless control testing; unlike internal audit, which provides business exposure and allows you to learn about business difficulties, IT audit does not provide any system or related exposure, and anyone who claims otherwise is either lying or does not know what he is talking about. I've worked on IT external, internal, and SOC reports, and believe me, in the end, you're just testing 6-7 items. It is quite easy to become pigeonholed in this job, and it is extremely difficult to do something else. If you are considering a transfer, consider internal or external audits before IT audits. Otherwise, you'll be stuck capturing screenshots and arguing with clients about why the taskbar wasn't included in the screenshort and why you now need another one. Best of Luck!
I agree with this 110%. As someone who was unintentionally pigeonholed because I didn't know what I was getting into, I would advise anyone pursuing IT audit to investigate the field thoroughly. It is NOT what most people think it is. And it definitely isn't a pathway into anything IT related.
Is this the case for industry jobs as well?
What role are you getting into?
Digital Finance - IT Strategy and ERP Implementation. I went from ERP to IT Audit and now going back.
What made you want to switch to IT Audit in the first place?