I work in IT audit in industry, but work very closely with our external (EY) team. Here are my thoughts:
“Apparently the upside is better hours than financial audit”
If you work in public accounting, you will be working a lot of hours regardless of which practice you are in. I actually work more hours than the financial auditors at my company, but still that's considerably less than the EY auditors.
“IT audit means you can still do internal audit in industry, government, university, or continue to do IT related accounting work right?”
Absolutely. There are plenty of opportunities out there, so I wouldn’t worry too much about being pigeonholed.
“I'm reading it's around 55 hours? Does that include driving.”
I think EY’s ITRA busy season was 50 hours this year (someone please correct me if I’m wrong). Unless you are on calls while you are driving, then no, that does not count.
“I know a lot of IT audit and control work involve driving to client sites”
Any audit position will require being at client sites. IT auditors usually have more clients than financial auditors (I think the IT auditors I work with have in the 5-7 range; the financial team each has 2), so they definitely spend more time traveling to different clients. At my company, the IT auditors spend maybe a day every week or so onsite; whereas the financial team is here pretty much every single day. Most of their clients are within the same area, so it’s really not too bad for them…usually when they travel out of town, it’s for training. How much time you spend onsite depends on several factors: how big is the audit, are there complications, how good is your audit team, is there a good internal audit team you can rely on, etc.
“how much mentally draining work is there in IT audit?”
Honestly, auditing isn’t terribly difficult to do. If everyone did everything perfectly, auditing would be the easiest job on earth. Having been a financial auditor before moving into IT audit, I wouldn’t say one is necessarily more mentally draining than the other. Some days your brain will hurt from trying to figure out a complex mess and some days you will be doing the most mind-numbingly boring work you can think of. In my job, the IT audit work itself is probably the easiest thing I do. The hardest part was the first initial audit and figuring out how to test controls and how all of the systems fit together. Once that was figured out, it’s been pretty easy. Since I do internal audit, the more difficult part of my job is figuring out some of the complex non-audit projects that get thrown my way.
“Any good exit opportunities when you jump to industry? How many years should you work in the field as an IT auditor to be desirable when you make the jump?”
I get calls all the time from recruiters looking to fill IT audit positions in industry. If you didn’t want to stay in internal audit, there are definitely other positions more IT related (security, privacy, etc.) Of course I’m biased, but I think IT auditing is a great field to get into. Stay until you make Senior before jumping ship. At the very least, get one busy season under your belt before leaving.
.