COMPUTING, DATA AND AI
IT / Information Systems Auditor
Checks that a company's computer systems are secure, reliable and follow rules and laws.
PCM or Commerce with Maths both work After a degree Private sector
Facts checked 29/10/2026
Is this for me?
People in this work enjoy
- Finding gaps and asking why something was done a certain way
- Working with both technical teams and business managers
- Steady, rule-based work where careful checking matters
It may not suit you if you dislike
- Long years of experience before full certification
- Travel to client sites and tight audit deadlines
- Being seen as the person who finds problems, which can be unpopular
- Class 11–12 subjects
- Class 12 in PCM for a B.Tech route, or Commerce with Maths for a B.Com or CA route. Computer Science or IT helps. Most degrees need a minimum percentage, so check the college's own rule.
- First degree
- A 3–4 year degree first: B.Tech or BCA (computer side), or B.Com or CA (finance and audit side). Many auditors come from either side.
- Entrance exams
- CISA, the certification from ISACA, is the main credential. The exam is open to anyone, and it is a computer-based test of about 150 questions (reported). You can sit it before you have work experience.
- Licence or registration
- CISA is a global certification from ISACA, not a government licence. To be fully certified you need about 5 years of verified audit, control or security work, plus yearly continuing learning.
What the work is like
Checking whether a company's IT systems, data and controls are safe and working as they should. Reviewing access rights, backups, software changes and data protection. Writing audit reports for management. Working with IT teams, bankers, auditors and regulators.
A day in the work
A typical day starts with reviewing the audit plan for the week and checking access logs or change records for one client. You may spend the late morning in a meeting with an IT manager, asking how backups and passwords are handled. The afternoon goes to testing controls, noting gaps and writing findings in plain language. The day ends with a short update to your team lead on what is still open.
The path, step by step
- Step 1 · Class 11–12Choose PCM if you want the B.Tech route, or Commerce with Maths if you want B.Com or CA. Get comfortable with computers, spreadsheets and logical thinking. Maths helps in both.
- Step 2 · After Class 12Do a degree in computer science, IT or BCA, or a B.Com or CA course. Learn networking, databases and basic security in your degree. Use college labs and free online courses to practise.
- Step 3 · During the degree or afterPass the CISA exam. You do not need work experience to sit it. Expect a computer-based exam with a passing mark on a scale of 200–800 (reported). (reported — check with the official body)
- Step 4 · First 5 years of workGet audit, control, assurance or security work in an IT firm, bank, insurer, consulting firm or company audit team. ISACA allows up to 3 years of the 5 to be waived for certain degrees and work, but at least 2 years must be direct IS audit or security work.
- Step 5 · Apply for certificationApply to ISACA within 5 years of passing the exam. Your employers verify the work experience through ISACA's process. You must also agree to ISACA's code of ethics.
- Step 6 · After certificationKeep the certificate active with continuing learning every year (reported as 20 hours a year, 120 hours in 3 years) and pay the yearly fee. (reported — check with the official body)
Ways in
- Computer routeB.Tech or BCA in CS or IT, then IS audit or security roles inside IT firms, banks and large companies.
- Finance routeB.Com or CA, then IT audit or IT risk roles inside audit firms, banks and insurers. CA students often add CISA later.
Time and money
| Stage | Time | Government college or body | Private college | Help available |
|---|---|---|---|---|
| Class 11–12 (PCM or Commerce with Maths) | 2 years | Your school's fees | — | — |
| Route 1: B.Tech in CS/IT — government college | 4 years | NIT Uttarakhand: ₹62,500 per semester (2026–27 tuition, general category), about ₹1.25 lakh a year | — | No help listed. Check the college's fee page |
| Route 1: B.Tech in CS/IT — private college | 4 years | — | NMIT Bengaluru: ₹4,50,000 per year (2026–27, seat category to confirm) | No help listed. Check the college's fee page |
| Route 2: B.Com or CA (finance route) | 3–4 years | Check the college's fee page | Check the college's fee page | No help listed. Check the college's fee page |
| CISA exam (any time after or during degree) | 1 day exam | About US$575 (ISACA members) or US$760 (non-members), plus US$50 application fee (reported, third-party) | Same as govt; exam is open to all | No help listed. Check the notice |
| First 5 years of work, then ISACA certification | About 5 years of work | Certification application and yearly renewal fees are in US dollars. Check the notice | Same as govt | Not a paid training post; you earn while you work. Pay not listed |
Total timeAbout 5 years after Class 12 for a degree plus work experience, plus exam time
Total costDepends mostly on the college you choose — compare fee pages.
Good to knowThe degree is self-funded and CISA fees are in US dollars, so rupee costs change with the exchange rate.
Fees from: ISACA support: requirements to become CISA certified · NIT Uttarakhand B.Tech fee structure 2026-27 (official PDF) · NMIT Bengaluru annual fee structure for BTech programs 2026-27 (official PDF). Fees change every year — check the college's own fee page before you pay.
What people earn
Pay depends on your starting degree, your experience and whether you work in an IT firm, a bank, an audit firm or a company's own team. Early roles pay modestly, and pay rises with certification and senior audit work.
Myth and fact
Myth: Passing the CISA exam makes you a certified auditor straight away.
Fact: The exam is only one step. Full certification also needs verified audit, control or security experience, and yearly continuing learning.
Try it now
- Class 7–9Join a school computer or coding club. Build a simple project, such as a small quiz or a tidy spreadsheet of class marks.
- Class 10–12Learn basic spreadsheets and how to check data for errors. Practise with a free sample dataset and write a one-page note on what you found.
- College or afterWatch a free NPTEL information security course at your own pace. Take notes on controls, risk and access, and compare them with what audit firms describe.Open link ↗
Good to know
- CISA is a certification, not a degree. Passing the exam does not make you a certified auditor yet. The experience rule must also be met.
- Experience must be recent. It must fall within the last 10 years before you apply, or within 5 years of passing the exam (per ISACA rules).
- Many government and bank audit jobs need work from CERT-In empanelled audit firms. CERT-In's rules say only staff declared to CERT-In may sign audit reports.
- Exam and renewal fees are in US dollars, so the rupee cost changes with the exchange rate.