Alle Stellen in Prüfung und Steuern

General Information

• Job Title: IT Internal Audit Manager
• Department / Function: Internal Audit (Central Function)
• Reporting Line: Internal Audit Director
• Location: Any
• Employment Type: Full-time, Permanent employment contract
• Leadership Responsibility: No
• Job Purpose

Responsibilities

The IT Internal Audit Manager is responsible for leading and supervising technology-focused Internal Audit assurance and advisory engagements covering information technology, cybersecurity, data governance, digital transformation, operational resilience, and technology-enabled business processes. The role contributes to protecting and enhancing organizational value through independent assessment of:

• IT governance
• Information security
• Cybersecurity controls
• IT operations
• Technology risk management
• Data integrity
• Digital transformation initiatives
• IT-enabled internal controls.

The Role Operates In Alignment With

• IIA Global Internal Audit Standards (2024)
• Internal Audit methodology
• Technology risk frameworks
• Applicable regulatory and supervisory requirements
• Organizational governance expectations.

3.1 IT Audit Engagement Management

• Lead and manage IT-focused assurance and advisory engagements from planning through reporting and follow-up
• Perform technology risk assessments and develop audit scopes, objectives, testing strategies, and engagement plans aligned with organizational technology risks
• Supervise engagement teams and allocate resources effectively to ensure timely and high-quality delivery
• Ensure IT audit engagements comply with:
• Internal Audit methodology
• IIA Standards
• QAIP requirements
• Technology audit best practices
• Monitor engagement progress, resource utilization, quality standards, and timelines.

3.2 Technology Assurance & Risk Assessments

• Lead and supervise audits covering:
• IT governance
• IT General Controls (ITGCs)
• Cybersecurity
• Identity & Access Management (IAM)
• Change management
• Cloud services
• Infrastructure and operations
• Data governance and data integrity
• ERP and core business systems
• Digital transformation programs
• Third-party technology risks
• Operational resilience and disaster recovery
• AI and emerging technology risks.
• Assess design and operating effectiveness of technology-related controls and identify control weaknesses, vulnerabilities, and governance gaps
• Evaluate adequacy of:
• Cybersecurity frameworks
• Monitoring processes
• Incident response capabilities
• Recovery planning
• Technology risk management governance
• Evaluate technology risks associated with:
• Outsourcing
• Cloud computing
• Data privacy
• Automation
• Emerging technologies.

3.3 Reporting & Stakeholder Communication

• Draft and review clear, concise, and risk-focused IT audit reports and stakeholder communications
• Present audit observations, recommendations, and technical risk implications to management and Internal Audit leadership
• Communicate complex technology risks to non-technical stakeholders clearly and effectively
• Facilitate meetings, walkthroughs, risk discussions, and remediation reviews with business and technology stakeholders
• Escalate significant technology risks, cybersecurity concerns, or control weaknesses appropriately.

3.4 Audit Methodology, Data Analytics & Technology Innovation

• Promote effective use of:
• Data analytics
• Continuous auditing
• Automated control testing
• AI-enabled auditing techniques
• Technology-enabled assurance approaches
• Utilize audit management tools and data analytics platforms effectively (e.g., Optro, TeamMate+, Power BI, analytics tools)
• Support development and enhancement of IT audit methodologies, testing approaches, and technical audit procedures
• Identify opportunities to modernize Internal Audit practices through automation, analytics, and emerging technologies
• Contribute to continuous improvement initiatives related to IT audit quality, efficiency, and innovation.

3.5 Quality Assurance & Improvement Program (QAIP)

• Ensure IT audit engagements conform with:
• IIA Standards
• Internal Audit methodology
• QAIP expectations
• Technology audit quality requirements
• Perform engagement-level quality reviews of workpapers, evidence, testing approaches, and reports
• Support QAIP activities including:
• Ongoing monitoring
• Internal assessments
• Methodology reviews
• Improvement initiatives
• External Quality Assessment preparation activities
• Promote consistency, quality, and continuous improvement across IT audit activities.

3.6 Leadership, Coaching & Capability Development

• Supervise and coach IT auditors, auditors, and engagement team members during audit activities
• Provide technical guidance and mentorship regarding:
• IT risks
• Cybersecurity
• Data analytics
• Technology controls
• Audit methodologies
• Promote continuous learning, innovation, and technical competency development within the Internal Audit function
• Contribute to onboarding, performance feedback, and capability development activities
• Promote professionalism, collaboration, accountability, and ethical conduct across engagement teams.

3.7 Integrated & Coordinated Assurance

• Coordinate with: o Information Security o Risk Management o Compliance o Data Governance o Privacy o External Audit o Technology leadership teams o Other assurance providers to strengthen integrated assurance and technology risk oversight
• Support development of assurance mapping and coordinated assurance activities related to technology and cybersecurity risks
• Identify opportunities to reduce assurance duplication and improve organizational risk coverage.
• Accountabilities & Decision-Making Authority
• Delivery of high-quality IT audit engagements within agreed scope, timelines, and quality standards
• Conformance of IT audit work with the IIA Global Internal Audit Standards and Internal Audit methodology
• Accuracy, clarity, and credibility of IT audit findings and reports
• Effective supervision and performance feedback for assigned audit team members
• Authority to elevate significant IT risk issues, control weaknesses, or audit quality concerns to senior Internal Audit leadership
• Competences & Powers
• Unrestricted access to IT-related systems, data, documentation, and personnel relevant to audit scope
• Authority to define and adjust IT audit scope and procedures based on risk
• Authority to challenge IT governance, security controls, and risk management practices
• Authority to recommend the use of specialized or co-sourced IT audit resources where justified
• Skills, Knowledge & Experience Education
• Master’s degree in Computer Science, Information Systems, IT Audit, or a related field Professional Experience
• Typically 8+ years of experience in IT audit, IT risk management, or information security
• Proven track record of leading complex IT audit engagements
• Experience in the insurance or financial services sector preferred Technical / Professional Knowledge Strong knowledge of: IT General Controls (ITGCs)
• Cybersecurity frameworks
• IT governance frameworks
• Data governance
• Cloud computing risks
• Identity & Access Management (IAM)
• Change and release management
• Technology operations and resilience
• Risk assessment methodologies
• Internal Audit methodologies.
• Working knowledge of:
• AI and emerging technologies
• Data analytics and visualization
• Operational resilience
• Third-party technology risk
• Data privacy and regulatory requirements
• Continuous auditing techniques.
• Experience applying:
• Data analytics
• Technology-enabled auditing
• Automated control testing
• Audit management systems and workflow tools. Certifications
• Certifications
• One or more relevant certifications strongly preferred (e.g. CISA, CISM, CISSP, CRISC)

Values Framework

• Customer Focus Provides practical, business-relevant, technology risk assurance insights Integrity Demonstrates objectivity, ethics, professionalism, transparency, and professional skepticism
• Teamwork Promotes collaboration, inclusion, knowledge sharing, and effective cross functional coordination
• Innovation Encourages continuous improvement, audit modernization, and adoption of emerging technologies
• Professionalism Demonstrates accountability, technical excellence, and commitment to high-quality outcomes.

Additional Competencies

• Analytical and critical thinking
• Leadership and engagement supervision capability
• Strong Communication and presentation skills
• Ability to communicate technical risks to non-technical audiences
• Negotiation and conflict management
• Professional skepticism and sound judgment
• Stakeholder management capability
• Adaptability and resilience. 8. Tools & Systems
• Audit management systems (e.g., Optro, TeamMate+)
• Data analytics and visualization tools (e.g., Power BI, Tableau, ACL, IDEA)
• Cybersecurity and monitoring tools
• GRC platforms
• Cloud and infrastructure management environments
• M365 / Microsoft Office tools
• Continuous auditing and automation tools.
• Collaboration & Key Stakeholders Internal Stakeholders
• Head and Deputy Head of Internal Audit
• Senior Internal Audit Managers and audit teams
• IT leadership and technology functions
• Risk Management, Compliance, Legal, Finance
• Business and operational management External Stakeholders
• Regulators and supervisory authorities (as applicable)
• External auditors
• Co-sourcing and specialist IT audit providers
• Working Conditions
• Occasional domestic and international travel may be required
• Hybrid or flexible working arrangements subject to organizational policy
• High degree of confidentiality and professional discretion required
• Frequent interaction with technology leadership, management, and assurance functions
• Responsibility for managing complex and sensitive technology-related audit matters.

The Role Operates In Full Compliance With

• IIA Global Internal Audit Standards (2024)
• IIA Code of Ethics
• Applicable laws, regulations, and supervisory requirements
• Internal Audit methodology, policies, and governance frameworks