IT Internal Audit Manager
1. General Information
- Job Title: IT Internal Audit Manager
- Department / Function: Internal Audit (Central Function)
- Reporting Line: Internal Audit Director
- Location: Any
- Employment Type: Full-time, Permanent employment contract
- Leadership Responsibility: No
2. Job Purpose
The IT Internal Audit Manager is responsible for leading and supervising technology-focused Internal Audit assurance and advisory engagements covering information technology, cybersecurity, data governance, digital transformation, operational resilience, and technology-enabled business processes. The role contributes to protecting and enhancing organizational value through independent assessment of:
- IT governance
- Information security
- Cybersecurity controls
- IT operations
- Technology risk management
- Data integrity
- Digital transformation initiatives
- IT-enabled internal controls.
The role operates in alignment with:
- IIA Global Internal Audit Standards (2024)
- Internal Audit methodology
- Technology risk frameworks
- Applicable regulatory and supervisory requirements
- Organizational governance expectations.
The IT Internal Audit Manager acts as a technical audit lead responsible for:
- Managing complex IT audit engagements
- Supporting technology-enabled auditing practices
- Promoting data analytics and audit innovation
- Supervising IT auditors and audit teams
- Supporting integrated assurance and digital risk oversight.
3. Key Responsibilities / Core Tasks
3.1 IT Audit Engagement Management
- Lead and manage IT-focused assurance and advisory engagements from planning through reporting and follow-up
- Perform technology risk assessments and develop audit scopes, objectives, testing strategies, and engagement plans aligned with organizational technology risks
- Supervise engagement teams and allocate resources effectively to ensure timely and high-quality delivery
- Ensure IT audit engagements comply with:
o Internal Audit methodology
o IIA Standards
o QAIP requirements
o Technology audit best practices
- Monitor engagement progress, resource utilization, quality standards, and timelines.
3.2 Technology Assurance & Risk Assessments
- Lead and supervise audits covering:
o IT governance
o IT General Controls (ITGCs)
o Cybersecurity
o Identity & Access Management (IAM)
o Change management
o Cloud services
o Infrastructure and operations
o Data governance and data integrity
o ERP and core business systems
o Digital transformation programs
o Third-party technology risks
o Operational resilience and disaster recovery
o AI and emerging technology risks.
- Assess design and operating effectiveness of technology-related controls and identify control weaknesses, vulnerabilities, and governance gaps
- Evaluate adequacy of:
o Cybersecurity frameworks
o Monitoring processes
o Incident response capabilities
o Recovery planning
o Technology risk management governance
- Evaluate technology risks associated with:
o Outsourcing
o Cloud computing
o Data privacy
o Automation
o Emerging technologies.
3.3 Reporting & Stakeholder Communication
- Draft and review clear, concise, and risk-focused IT audit reports and stakeholder communications
- Present audit observations, recommendations, and technical risk implications to management and Internal Audit leadership
- Communicate complex technology risks to non-technical stakeholders clearly and effectively
- Facilitate meetings, walkthroughs, risk discussions, and remediation reviews with business and technology stakeholders
- Escalate significant technology risks, cybersecurity concerns, or control weaknesses appropriately.
3.4 Audit Methodology, Data Analytics & Technology Innovation
- Promote effective use of:
o Data analytics
o Continuous auditing
o Automated control testing
o AI-enabled auditing techniques
o Technology-enabled assurance approaches
- Utilize audit management tools and data analytics platforms effectively (e.g., Optro, TeamMate+, Power BI, analytics tools)
- Support development and enhancement of IT audit methodologies, testing approaches, and technical audit procedures
- Identify opportunities to modernize Internal Audit practices through automation, analytics, and emerging technologies
- Contribute to continuous improvement initiatives related to IT audit quality, efficiency, and innovation.
3.5 Quality Assurance & Improvement Program (QAIP)
- Ensure IT audit engagements conform with:
o IIA Standards
o Internal Audit methodology
o QAIP expectations
o Technology audit quality requirements
- Perform engagement-level quality reviews of workpapers, evidence, testing approaches, and reports
- Support QAIP activities including:
o Ongoing monitoring
o Internal assessments
o Methodology reviews
o Improvement initiatives
o External Quality Assessment preparation activities
- Promote consistency, quality, and continuous improvement across IT audit activities.
3.6 Leadership, Coaching & Capability Development
- Supervise and coach IT auditors, auditors, and engagement team members during audit activities
- Provide technical guidance and mentorship regarding:
o IT risks
o Cybersecurity
o Data analytics
o Technology controls
o Audit methodologies
- Promote continuous learning, innovation, and technical competency development within the Internal Audit function
- Contribute to onboarding, performance feedback, and capability development activities
- Promote professionalism, collaboration, accountability, and ethical conduct across engagement teams.
3.7 Integrated & Coordinated Assurance
- Coordinate with: o Information Security o Risk Management o Compliance o Data Governance o Privacy o External Audit o Technology leadership teams o Other assurance providers to strengthen integrated assurance and technology risk oversight
- Support development of assurance mapping and coordinated assurance activities related to technology and cybersecurity risks
- Identify opportunities to reduce assurance duplication and improve organizational risk coverage.
4. Accountabilities & Decision-Making Authority
- Delivery of high-quality IT audit engagements within agreed scope, timelines, and quality standards
- Conformance of IT audit work with the IIA Global Internal Audit Standards and Internal Audit methodology
- Accuracy, clarity, and credibility of IT audit findings and reports
- Effective supervision and performance feedback for assigned audit team members
- Authority to escalate significant IT risk issues, control weaknesses, or audit quality concerns to senior Internal Audit leadership
5. Competences & Powers
- Unrestricted access to IT-related systems, data, documentation, and personnel relevant to audit scope
- Authority to define and adjust IT audit scope and procedures based on risk
- Authority to challenge IT governance, security controls, and risk management practices
- Authority to recommend the use of specialized or co-sourced IT audit resources where justified
6. Skills, Knowledge & Experience Education
- Master’s degree in Computer Science, Information Systems, IT Audit, or a related field Professional Experience
- Typically 8+ years of experience in IT audit, IT risk management, or information security
- Proven track record of leading complex IT audit engagements
- Experience in the insurance or financial services sector preferred Technical / Professional Knowledge Strong knowledge of: IT General Controls (ITGCs) • Cybersecurity frameworks • IT governance frameworks • Data governance • Cloud computing risks • Identity & Access Management (IAM) • Change and release management • Technology operations and resilience • Risk assessment methodologies • Internal Audit methodologies.
- Working knowledge of: • AI and emerging technologies • Data analytics and visualization • Operational resilience • Third-party technology risk • Data privacy and regulatory requirements • Continuous auditing techniques.
- Experience applying: • Data analytics • Technology-enabled auditing • Automated control testing • Audit management systems and workflow tools. Certifications • One or more relevant certifications strongly preferred (e.g. CISA, CISM, CISSP, CRISC)
7. Soft Skills, Behavioural & Values-Based Competencies
The role is expected to actively demonstrate and promote the MS&AD values framework:
- Customer Focus Provides practical, business-relevant, technology risk assurance insights Integrity Demonstrates objectivity, ethics, professionalism, transparency, and professional skepticism
- Teamwork • Promotes collaboration, inclusion, knowledge sharing, and effective cross functional coordination Innovation • Encourages continuous improvement, audit modernization, and adoption of emerging technologies
- Professionalism • Demonstrates accountability, technical excellence, and commitment to high-quality outcomes.
Additional competencies:
- Analytical and critical thinking
- Leadership and engagement supervision capability
- Strong Communication and presentation skills
- Ability to communicate technical risks to non-technical audiences
- Negotiation and conflict management
- Professional skepticism and sound judgment
- Stakeholder management capability
- Adaptability and resilience. 8. Tools & Systems
- Audit management systems (e.g., Optro, TeamMate+)
- Data analytics and visualization tools (e.g., Power BI, Tableau, ACL, IDEA)
- Cybersecurity and monitoring tools
- GRC platforms
- Cloud and infrastructure management environments
- M365 / Microsoft Office tools
- Continuous auditing and automation tools.
9. Collaboration & Key Stakeholders Internal Stakeholders
- Head and Deputy Head of Internal Audit
- Senior Internal Audit Managers and audit teams
- IT leadership and technology functions
- Risk Management, Compliance, Legal, Finance
- Business and operational management External Stakeholders
- Regulators and supervisory authorities (as applicable)
- External auditors
- Co-sourcing and specialist IT audit providers
10. Working Conditions
- Occasional domestic and international travel may be required
- Hybrid or flexible working arrangements subject to organizational policy
- High degree of confidentiality and professional discretion required
- Frequent interaction with technology leadership, management, and assurance functions
- Responsibility for managing complex and sensitive technology-related audit matters.
11. Compliance & Professional Standards
The role operates in full compliance with:
- IIA Global Internal Audit Standards (2024)
- IIA Code of Ethics
- Applicable laws, regulations, and supervisory requirements
- Internal Audit methodology, policies, and governance frameworks
