For external independent auditors, please ignore the information below due to requirement for professional independence
I work as an IT Auditor. The answers above illustrate that one primary duty of an IT Auditor is verification of compliance of IT processes as as put in place by company management. However, another duty of an IT Auditor (traditional but may differ between companies), is IT risk assessment.
In this sense, the IT Auditor serves as an advisor to management. Rather than telling management what the IT shortcomings are, he/she helps management answer what are the risks posed to the business as those risks relate to IT? He or she can also assist in explaining some of the safeguards (controls) that should be in place to mitigate those risks.
In moving away from a "compliance focused" approach to IT Auditing, compliance deficiencies are often due to a bigger problem, such as a lax tone at the top or inadequately designed IT processes. While in my job, I strongly prefer to see compliance with applicable laws, regulations, and company policies, my work often goes beyond simply "checking the box" whether something is in compliance. I try to think myself as more than just enforcing the rules set by management. IT auditors and other information security professionals are often not seen as a "value add" to management of companies, due to them being linked to only pointing out what is wrong. Adding value by brainstorming solutions can also be seen as a role of an IT Auditor.