Year 1 – 1988
My first audit position was in an organization employed over 100 auditors divided into business lines: finance, HR, operations, and IT. I was hired as a Senior IT auditor even though I had no internal audit experience and only (what I felt was) limited IT experience. On top of that, I was getting very little (read “no”) support from my supervisor. To be fair, there were hundreds of application systems and new system development projects and only 3 IT auditors; so my supervisor was busy conducting his own IT audits. (BTW, I was called an EDP auditor at the time; but I am using the newer term.) After reading 6 feet (literally) of printed documentation on the company, audit, and audit procedures I was “ready” to start auditing.
Our IT environment was almost exclusively IBM mainframe computers and applications. There was a certain amount of distributed processing and a few mini-computers. At a previous job I had learned JCL, TSO/ISPF (both mainframe essentials) as well as a couple of applications such as Wilbur and S2K. I was definitely not a programmer – but I had taken several introductory programming courses (e.g. FORTRAN, COBOL, Pascal, XPL, and PL1) in university. I was more of an “intelligent end-user”. I knew enough about IT to talk to programmers and explain what I needed, but now I had to do more than just talk IT.