ronutz

The Roles · Who defends it

IT auditor

Written from published sources

The person who establishes whether the controls an organisation believes it has are actually there and actually working. Audit runs as an engagement — planning, fieldwork, reporting — and produces evidence rather than opinion. The profession has its own framework of standards covering not only method but ethics and expected behaviour, which exists because the value of the finding rests entirely on the independence of whoever produced it.

What the day looks like

  • Planning an engagement against objectives that connect to what the organisation is actually exposed to.
  • Fieldwork: sampling, testing, and asking for the evidence rather than the assurance.
  • Documenting control strengths, weaknesses and gaps, in workpapers another auditor could follow.
  • Discussing findings with the people they concern, before the report reaches anybody above them.
  • Reporting, and then following up on what was agreed and what actually changed.

What it answers for

  • Findings supported by evidence that survives being disputed.
  • Workpapers complete enough for a reviewer to reach the same conclusion.
  • Independence, maintained visibly as well as actually.

What it is measured on

  • The audit plan delivered, and coverage across the estate.
  • Findings accepted, and remediation completed rather than agreed.
  • Regulatory and external audit outcomes, where internal work is examined by someone else.

Who it receives from

The teams under review
Evidence, at whatever completeness their day allows.
The audit committee or board
The mandate, and the plan's priorities.
Risk and compliance functions
The obligations the organisation is being measured against.

Who it serves

The board
An independent view of whether the controls described in the reporting exist.
Management
Findings early enough to fix before somebody external arrives.
The teams audited
A written basis for the investment they have been requesting.

Who else has a stake

  • Regulators and external auditors, who read the same estate afterwards.
  • Customers, whose data the controls exist to protect.
  • Every engineer whose weekend a finding turns into remediation.

What it takes

  • Method: sampling, evidence and the discipline to test rather than to accept.
  • Technical literacy across the estate, sufficient to know what evidence would look like.
  • Writing that states a finding, its basis and its consequence separately.
  • The independence to record a finding about a team whose cooperation the next engagement needs.

What the job turns on

Independence is the product, and it is spent by helpfulness. An auditor who begins designing the fix becomes an adviser to the thing they will later examine, and the next report carries their own recommendation as its subject — which is why the profession puts ethics and expected behaviour into the same framework as method. The useful position is close enough to understand the estate and separate enough that the finding still means something, and holding it takes deliberate effort in every friendly conversation.

The published sources

Where it leads

The work itself

The Practice covers how this work is done — triage, escalation, evidence, handover — across the whole corpus.

Read The Practice