IT Audit & Compliance Analyst
IT Audit and Compliance Analysts produce findings reports, evidence memos, and remediation plans that must be understood by both technical teams and executive leadership — typically in English, regardless of the organisation's home country. This path builds vocabulary across IT General Controls, SOX IT audit cycles, ISO 27001 evidence collection, and change management control testing.
Topics covered
- ITGC Vocabulary
- SOX IT Audit Language
- ISO 27001 Evidence Writing
- Change Management Controls
- Audit Findings & Observations
- Remediation Planning
Vocabulary spotlight
4 terms every IT Audit & Compliance Analyst should know in English:
A weakness in the design or operation of a control that does not prevent or detect misstatements or security incidents in a timely manner
"The auditors classified the missing privileged-access review as a control deficiency that required remediation before the year-end SOX sign-off."
Documented artefacts — such as screenshots, logs, configuration exports, and signed approvals — that demonstrate a control is operating effectively
"The team provided evidence in the form of automated Access Certification reports exported from the IAM system for the preceding 12 months."
The corrective actions taken to address an identified audit finding and restore the relevant control to an effective state
"Management agreed to a 90-day remediation plan for the segregation-of-duties gap, including interim compensating controls approved by the CISO."
The defined boundaries of an audit engagement, specifying which systems, processes, and time periods are subject to examination
"The scope of the ISO 27001 surveillance audit covered the production environment and the three third-party data processors listed in Annex A."
📚 Vocabulary Reference
Key terms organised by category for IT Audit & Compliance Analysts:
ITGC Core Terms
Audit Process
Risk & Control Language
Remediation & Reporting
Recommended exercises
Real-world scenarios you'll practise
- Writing a formal audit observation for a SOX finding related to privileged access not being reviewed quarterly, including risk rating and management response.
- Presenting ISO 27001 evidence to an external certification auditor and answering questions about the effectiveness of your patch management process.
- Drafting a remediation status update for the audit committee, explaining in plain English why a critical finding has been reclassified as a material weakness.
- Reviewing a change management policy and marking up sections that do not align with ITGC requirements for segregation of duties.