Hi everyone,

I currently work in IT Support and have a background in systems, networking, and cybersecurity. I hold CCNA, Security+ certifications and am currently studying ITIL Foundation v5.

I'm specifically interested in transitioning into IT Audit (ITGC, IT controls, IT governance, and internal IT auditing), not cybersecurity auditing.

Since I have no previous audit experience, I'd like to know where to start.

Which beginner-friendly courses, books, certifications, or other learning resources would you recommend for someone moving into IT Audit? Would it be suitable to start directly with COBIT? What topics should I focus on first to build a solid foundation and become ready for an entry-level IT Audit role?

I'd really appreciate recommendations from people working in this field. Thanks!

I have 2 years of Accounts Payable experience before transferring to a Process Analyst role within the same company 9 months ago, while still handling my AP responsibilities. In my current role, I focus on improving existing processes, developing systems for different departments, and automating manual tasks to improve efficiency, streamline workflows, and address operational challenges. I’m a BS Accounting Information Systems graduate.

My question is:

Is it worth shifting to IT Audit, even if I have to start at entry level, or should I continue building my career in process analysis and system development?

I don’t mind starting at entry level or taking a lower salary if the long-term opportunities are worth it. I’d like to know which path offers better long-term career growth, earning potential, and opportunities for advancement.

We’ve been running our audits out of spreadsheets and a shared drive and it’s starting to fall apart now that we’re juggling more than one framework. Looking at moving to a proper platform but every vendor page reads the same.

What I actually care about: how the auditor clarification loop works (do requests come back inside the tool or over email), whether evidence can be reused across frameworks without re-uploading everything, and how much of it is really automated vs just a nicer to-do list. Also what happens when an integration fails or evidence doesn’t sync properly, because that’s usually where automated turns manual again.

Scytale is one of the platforms I’m looking at, but I’d rather hear from people who are actually running it than from a sales call. Also open to hearing what you tried and dropped, and why.