Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am going through training in information security, as a part of the course they included compliance standards like:

  • ISO 27001-2005
  • Cobit framework

So after searching over Google, I came to know that it is for "IT auditors" (correct me if I am wrong).

In layman terms, what is the job of an IT auditor?

share|improve this question
up vote 2 down vote accepted

An auditor examines an organization to determine if they appear to be compliant with a particular standard or regulation. They make their findings based on evidence, often directly supplied by the organization upon request of the auditor. And they are generally independent from the organizations they audit.

In the case of a security audit, the auditor may look for evidence that the organization has a security policy, that the policy is adequate to protect them according to the standard, and that the organization follows it. That policy will state practices to be followed, such as requiring code reviews. An auditor likely won't do a code review himself, but he might look for a documentation trail that demonstrates the organization does do code reviews. The standard may also require annual penetration tests, and he will examine documents produced by the penetration testers. He might also check with the pen testing company to be sure the organization wasn't lying about having pen tests. If he doesn't see such documentation trails, he finds that the organization is out of compliance.

An auditor can't verify that an organization is secure. He can only find that an organization appears to be trying to operate in a secure manner.

share|improve this answer

The auditor works mostly interview based whereas a pentester has a more "hands on approach". An IT Auditor mostly requests the auditees to supply him with certain deliverables. These deliverables can be documents stating how an IT process is implemented, configuration files, maintenance reports for HVAC,... . The IT Auditor will then compare this IT process with a standard or a configuration file with a baseline.

He will then perform several interviews with involved personnel and see if the corresponding process is indeed respected.

As an example for Logical Access: The auditor will check Joiners/Movers/Leavers. These are people:

  • who join the company
  • move position which requires different types of access
  • who leave the company

This is a list he will ask from the HR department. He will then check for a sample if:

  • The joiner received rights as are required for his permissions
  • The mover had his old rights revoked (so he cannot stack rights and come into a situation where he has incompatible duties)
  • The leaver had his rights revoked

The auditor mainly looks if processes are being used and if these are followed.

share|improve this answer

An auditor verifies whether a solution (e.g. application, infrastructure, etc.) is compliant to a specified standard/law or not.

share|improve this answer
Is it like a penetration tester finds vulnerabilities and sugests or provides solution to be verified by auditor? – user31079 Sep 24 '13 at 15:39
@user31079: Not exactly. An auditor takes one or more standards and checks if the solution is compliant to the requirements (depending on the standard, this may or may not include fixing vulnerabilities). – Gurzo Sep 24 '13 at 16:53
So he verifies a solution(eg.application, infrastructure) is compliant to a standard like PCI DSS ISO 27001-2005 Cobit framework @Gurzo – user31079 Sep 24 '13 at 17:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.