IT auditor & GRC

What does an IT auditor & GRC do?

An IT auditor checks whether an organisation's technology is properly controlled, secure and compliant with internal policies and outside rules.

The work covers systems, networks, cloud services, user access and data handling. You report what you find and what should change.

In Singapore, IT auditors work in internal audit teams, risk and compliance functions, and external audit or advisory firms. Banks, insurers and other institutions regulated by the Monetary Authority of Singapore (MAS) hire many of them. So do government agencies and large companies.

You work with IT operations, security teams, system owners, risk managers and senior management. GRC roles (governance, risk and compliance) are wider. They also own policies, risk registers and compliance programmes as well as audits.

What the work involves

• Review changes to systems, regulations and IT assets, then decide which areas need audit coverage.
• Help write the IT audit plan, including scope, workflows and the tests to run.
• Collect evidence such as access lists, system logs, change tickets and configuration settings, and test it against the control.
• Trace each gap back to its root cause and rate the risk it creates.
• Write findings and recommendations, then agree actions and deadlines with control owners.
• Follow up on open issues and run short briefings so teams understand the IT controls they own.

Pay in Singapore

Back to top

Skills an IT auditor & GRC needs

Back to top

IT auditor & GRC job description

We are hiring an IT auditor to assess the controls over our applications, infrastructure and data.

You will plan and run audits, test evidence against standards and regulations, and report risks to management. You will work with IT, security and risk teams across the organisation. Experience with ISO 27001, NIST and MAS technology risk requirements is an advantage.

Responsibilities

• Analyse changes to the IT landscape and regulations to set audit objectives.
• Draft IT audit plans that map out workflows, scope and test steps.
• Run audit fieldwork according to the plan and document the work clearly.
• Gather and assess evidence to find non-compliance and its root causes.
• Identify technology risks and rate them by likelihood and impact.
• Write audit reports with findings that business and technical readers can follow.
• Recommend fixes that improve compliance with IT standards and reduce risk.
• Track remediation and confirm that agreed actions are done and effective.
• Raise awareness of IT controls through briefings and guidance to staff.
• Support external audits and regulatory reviews by preparing evidence and answering queries.

Requirements

• A degree in information systems, computer science, accounting or a related field, or equivalent work experience.
• Typically 0 to 3 years in IT audit, IT risk, security or IT operations for an entry-level role; more for senior roles.
• Working knowledge of ISO 27001, NIST frameworks and common IT general controls.
• Familiarity with MAS Technology Risk Management requirements and the Personal Data Protection Act (PDPA), especially for financial sector and customer data roles.
• CISA or a similar certification, or a plan to get one; many employers ask for it.
• Clear business writing and the ability to explain technical risk to non-technical managers.

Back to top

IT auditor & GRC career path

Most IT auditors move from fieldwork into planning, then into managing audit teams or a wider GRC function.

Titles differ between banks, government bodies and consulting firms.

1. IT auditor

   Entry · SkillsFuture title

   You assist with audit plans, run tests, gather evidence and write up findings under guidance.

2. Senior IT auditor

   Mid

   You lead audits of specific systems or processes, review junior work and deal directly with control owners.

3. IT audit or GRC manager

   Senior

   You build the audit plan, manage a team and report results to senior management and audit committees.

4. Director of IT audit or GRC

   Lead

   You set audit coverage across business units and handle relationships with regulators and external auditors.

5. Head of IT audit or technology risk

   Head

   You own the assurance view of technology risk for the organisation and advise the board.

Steps marked "SkillsFuture title" follow the career pathway in the SkillsFuture Skills Framework. The others are titles commonly used in Singapore.

Related jobs and their pay

Back to top

IT auditor & GRC interview questions

We wrote these questions from the skills this job needs. They are not an official question bank.

1. How would you audit user access management for a critical finance application?

   What a good answer covers

   • Starts with scope and the risks: unauthorised access, excess privileges, leavers keeping access
   • Tests joiner, mover and leaver processes against a sample of real accounts
   • Reviews privileged accounts, periodic access reviews and segregation of duties
   • Checks that evidence comes from the system, as well as from the control owner's summary
   • Explains how you would rate any gap and who would own the fix

2. What is the difference between ISO 27001 and the NIST Cybersecurity Framework, and how would you choose one as an audit baseline?

   What a good answer covers

   • ISO 27001 is a certifiable management system standard with defined controls
   • NIST CSF is a voluntary framework that organises outcomes into functions
   • Choice depends on regulator expectations, existing certifications and what the organisation already uses
   • Mentions mapping controls between frameworks to avoid testing the same thing twice

3. Explain inherent risk, residual risk and control risk. How do they affect your audit plan?

   What a good answer covers

   • Inherent risk exists before controls; residual risk remains after controls
   • Control risk is the chance a control fails to prevent or catch an issue
   • Higher residual risk areas get earlier and deeper testing
   • Notes that ratings need agreed criteria so results are consistent

4. How would you test change management controls on a core banking system?

   What a good answer covers

   • Gets the full population of changes from the ticketing or deployment tool
   • Samples changes and checks approval, testing evidence and separation between developer and deployer
   • Looks for emergency changes and changes made outside the process
   • Compares system change logs with tickets to find unrecorded changes
   • Reports exceptions with the risk they create

5. A bank plans to move a workload to a public cloud provider. What would you check against MAS technology risk expectations?

   What a good answer covers

   • Risk assessment and board or senior management approval before the move
   • Third-party and outsourcing due diligence, including exit and concentration risk
   • Access control, encryption and key management responsibilities between the bank and the provider
   • Logging, monitoring and incident handling across the shared environment
   • Says you would confirm the exact current MAS requirements before concluding

6. How do you decide sample size and judge whether evidence is reliable?

   What a good answer covers

   • Sample size depends on population size, control frequency and risk
   • Prefers evidence generated by the system over screenshots supplied by the owner
   • Checks that evidence is complete, accurate and covers the audit period
   • Documents the reasoning so a reviewer can repeat the test

7. How would you use data analytics to test privileged account activity across a full year?

   What a good answer covers

   • Obtains the full log or account list and checks its completeness
   • Uses SQL, Excel or a scripting tool to filter for unusual hours, shared accounts or unapproved users
   • Reconciles hits against approved change and incident tickets
   • Treats results as leads, then confirms with the system owner
   • Keeps the script and data so the test can be reproduced

8. How would you use ChatGPT in your audit work, and where would you not use it?

   What a good answer covers

   • Uses it for drafting, summarising public standards or structuring test steps
   • Never pastes confidential client, customer or system data into a public tool
   • Follows the organisation's AI use policy
   • Checks every output against source documents because it can be wrong
   • Takes responsibility for the final wording and conclusions

1. During fieldwork you find that a former employee's account is still active in the finance system and was used last week. What do you do?

   What a good answer covers

   • Escalates straight away to the system owner and security team instead of waiting for the report
   • Preserves evidence such as logs and account records
   • Checks whether any transactions were made and whether other leaver accounts are affected
   • Looks for the root cause in the leaver process
   • Records the issue as a finding with a clear action and owner

2. A control owner disagrees with your finding and says the business has accepted the risk. How do you respond?

   What a good answer covers

   • Asks to see the formal risk acceptance, its approver and its date
   • Checks whether the person who accepted it had authority at that level
   • Explains the facts and the impact simply and without blame
   • Escalates to your manager if acceptance was not formally recorded
   • Records the agreed outcome in the report

3. Halfway through an audit, you learn the scope missed a new system that holds customer data. The deadline is fixed. What do you do?

   What a good answer covers

   • Tells your manager early and does not drop or ignore the system
   • Does a quick risk assessment of the new system
   • Proposes options: widen scope, swap with a lower-risk area, or schedule a follow-up review
   • Documents the decision and who approved it

1. Tell us about a time you had to give an unwelcome finding to a senior manager.

   What a good answer covers

   • Describes the situation and the evidence you had
   • Shows how you prepared and kept the tone factual
   • Explains how you handled pushback
   • States the outcome and what you learnt

2. Describe a time you had to learn an unfamiliar technology quickly to complete a review.

   What a good answer covers

   • Names the technology and why it mattered to the audit
   • Explains how you learnt: documentation, a subject expert, a test environment
   • Shows how you checked your understanding before drawing conclusions
   • Gives a result, such as a finding that was accepted

1. You are auditing a customer database held by a Singapore company. What would you check for Personal Data Protection Act (PDPA) compliance?

   What a good answer covers

   • Whether the company knows what personal data it holds and why
   • Consent, purpose and retention practices for the data
   • Access control, encryption and other security arrangements to protect the data
   • A process for handling data breaches, including assessing and notifying where required
   • Says you would confirm current Personal Data Protection Commission guidance before concluding

2. A financial institution has a major system outage. After recovery, what would you review against Monetary Authority of Singapore (MAS) expectations?

   What a good answer covers

   • Whether the incident was escalated and reported to MAS within the required period
   • The root cause analysis and whether the fix addresses it
   • Recovery time and recovery point objectives, and whether they were met
   • Communication to customers and senior management
   • Follow-up actions and who owns them

Common questions about an IT auditor & GRC job

Sources