Performs complex-level professional internal auditing work which involves leading or conducting information technology (IT), performance, operational, and compliance audit projects; providing consulting services to the organization’s management and staff; providing key input to development of the annual audit plan; and providing training and coaching to internal audit staff.  Responsible for identifying the audit scope based on technology risks and independently evaluating the efficiency and effectiveness of information technology infrastructure and application controls, including security and internal controls.  Maintains all organizational and professional ethical standards.  Works independently under general supervision with considerable latitude for initiative and independent judgment.

 

Identifies and evaluates the organization’s IT risk areas and provides key input to the development of the annual audit plan for IT audits and/or projects.

 

Performs IT audit procedures of systems, applications, and IT environments, including identifying and defining issues, developing criteria, reviewing and analyzing evidence, and documenting client processes and procedures.

 

Conducts interviews, reviews documents, develops and administers surveys, composes summary memos, and prepares working papers.

 

Identifies, develops, and documents audit issues and recommendations using independent judgment concerning areas being reviewed.

 

Communicates or assists in communicating the results of audit and consulting projects via written reports and oral presentations to management and the Board of Governors.

 

Develops and maintains productive client and staff relationships through individual contacts and group meetings.

 

Pursues professional development opportunities, including external and internal training and professional association memberships, and shares information gained with co-workers.

 

Represents the Office of Internal Audit on organizational project teams, at management meetings, and with external organizations.

 

Provides or assists in providing training, coaching, and guidance to internal audit staff in conducting audits and other audit-related issues.

 

Plans and executes audits of client/server technology platforms (Windows, SQL, Linux, Unix) and evaluates IT internal controls and works collaboratively with management to identify actions needed.

 

Conducts data extraction, analysis, and security reviews utilizing software tools.

 

Supports audits and consulting engagements related to programming, online processes, client-server architecture, cloud services, database extraction, technology strategy, and data communication and network security.

 

Acts as liaison with IT business partners to ensure full understanding of data flow, data integrity, and system security.

 

Assesses information technology control elements to mitigate IT risks regarding the confidentiality, integrity, and availability of business information.

 

Provides technical support to the Office of Internal Audit for the maintenance of all desktops, laptops, and servers. Serves as the liaison with the University’s central computing department related to IA’s technical support needs. 

 

Serves as the liaison for IA’s proprietary software.

 

Performs related work as assigned by audit management.

 

Job Reports to: Director.

 

Leadership Accountability: Develops strategic plans and interprets policy.

 

Organizational Accountability: Manages work group within a sub-unit of a department.

 

Customer Accountability: Interfaces with officials and executives.

 

Freedom to Act: Operates with significant autonomy.

 

Bachelor's degree

 

Bachelor’s degree from an accredited college or university, certification as a CISA, and four years of full-time experience in auditing, accounting, business analysis, or program evaluation, including two years’ experience conducting information technology audits.  

 

A graduate degree in computer science, business administration, or a related field, or a second certification (CIA, CPA, or CISM, CISSP) may each substitute for one year of required experience (for a maximum substitution of two years).

 

Experienced (minimum 2 years of job-related experience).

 

Experience in industry auditing or accounting and in conducting audits in information systems and other areas pertinent to the industry. 

 

Exposure to CAAT (Computer Assisted Applications Testing).

 

High level of proficiency in information technology control concepts and systems development methodologies.

 

Experience in performing new systems development audits, or related work experience.

 

Experience with networking.

 

Exposure to security software and controls.

 

Possess detailed technical skills in at least one platform (Unix, Windows).

 

Considerable knowledge of and skill in applying internal auditing principles and practices, and management principles and preferred business practices.  Knowledge of The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards) and Code of Ethics.  Knowledge of IT professional terminology, concepts, and practices based on NIST, COBiT, and ISO. Knowledge of generally accepted IT industry standards, policies, procedures, controls, regulations, and laws.  Skill in conducting quality control reviews of audit work products.  Skill in collecting and analyzing complex data, evaluating information and systems, and drawing logical conclusions. Considerable skill in planning and project management, and in maintaining composure under pressure while meeting multiple deadlines.  Knowledge of and skilled in backup and recovery processes and products.  Skill in negotiating issues and resolving IT business problems.  Strong knowledge of Microsoft Office Suite, accounting systems, and other business-related software to prepare reports, memos, summaries, and analyses.  Considerable skill in effective verbal and written communications, including active listening skills and skill in presenting findings and recommendations.  Ability to establish and maintain positive, collaborative working relationships with co-workers, staff and external contacts, and to work effectively in a professional team environment.  Considerable knowledge of distributed technology (i.e., Unix and Windows), web-based technology, and basic infrastructure control issues.  Considerable skill in assessing the effectiveness of internal controls over key IT risks, identifying significant exposures, analyzing transactions and other management information, and detecting changes in key risks and/or control effectiveness.  Skill in developing appropriate recommendations to address exposures.  Ability to learn new operations quickly and work independently is a must.