Role search
Get a Contract IT Auditor who can own sarbanes oxley compliance testing. Also called IT Auditor, Contract Information Technology Auditor
No postings. No stacks of resumes. No chasing. You choose from a short list of people who have done this before.
No upfront fee. You pay only if you engage someone we present.
Interim Headhunters starts with the work behind this request: An IT Auditor verifies that the digital systems driving your financial and operational reporting remain secure and compliant. You bring this person in when your existing team lacks the capacity to conduct thorough Sarbanes Oxley compliance testing, user access reviews or application control assessments.
This is what we do all day: place interim executives, interim managers and contract professionals.
Need someone now? Call 305-306-4829.
- No upfront fee
- 2 to 3 vetted consultants per assignment
- Matched to your industry
- You choose
- Interim plus permanent search
- Contract IT Auditor
- IT Auditor
- Contract Information Technology Auditor
The judgment call
What this hire really comes down to
An IT Auditor verifies that the digital systems driving your financial and operational reporting remain secure and compliant. You bring this person in when your existing team lacks the capacity to conduct thorough Sarbanes Oxley compliance testing, user access reviews or application control assessments.
Your hire must bridge the gap between technical system configurations and formal financial control requirements. It matters little if an auditor understands the theory of general controls if they cannot communicate specific remediation steps to your engineers.
SOC 1, SOC 2: Credential frameworks issued by the American Institute of Certified Public Accountants. A SOC 1 report tests controls relevant to financial reporting, while a SOC 2 report evaluates security, availability, processing integrity, confidentiality and privacy. These reports do not assurance system security, only that controls were tested against specific criteria.
SOX Compliance: A federal requirement mandating that internal controls are documented and tested for effectiveness. An IT auditor confirms that access controls, change management and data backups support these requirements.
Segregation of Duties: A control concept ensuring that no single person can perform multiple sensitive functions, such as creating a vendor and authorizing payments. An auditor validates this through access logs and permissions matrices.
What we check
What we check before you see anyone
- We verify technical fluency by questioning how candidates map complex user access rights to specific roles within your ERP or cloud environments. We require them to explain how they determine if segregation of duties conflicts are actual risks or mere configuration artifacts that do not affect financial data.
- We assess their ability to perform logic testing on automated control cycles. We look for concrete examples of how they validated that an application correctly calculates discounts, handles inventory valuation or flags unauthorized journal entries. We ensure they have moved beyond checking boxes to understanding the data flow.
- We evaluate their experience with specific compliance frameworks like SOC 1, SOC 2 or internal ISO standards. We confirm they know how to interact with your external auditors to minimize the time your full-time staff spends explaining their own processes.
- We test their documentation standards by reviewing sample work papers they have produced. We check for clarity, evidence of testing, and the inclusion of specific steps taken to reach their conclusions. If the work papers cannot stand up to an inquiry from a third party without the author present, they do not pass our screen.
Sourcing
Where we find them
Our source pool comprises professionals from public accounting firms, internal audit departments at large enterprises and specialized consulting groups. Public accounting alumni bring a strong emphasis on audit standards and rigorous evidence gathering. Those from internal audit backgrounds often possess a deeper understanding of how to influence business process changes within a company.
These professionals transition into contract work because they seek to solve discrete, high-impact problems without the administrative load of full-time management. They move when they have completed a long-term system implementation or audit cycle and desire a fresh challenge in a different industry.
Where searches go wrong
Mistakes we see
- Hiring managers often mistake a general cybersecurity analyst for a technical auditor. While security analysts harden systems, IT auditors focus on proving that controls are designed and operating effectively for compliance, which requires a specific mindset focused on evidence and materiality.
- Some firms prioritize auditors who only know one specific software module. We see this fail when the auditor cannot adapt their testing approach to the custom configurations or unique business processes that exist outside of standard vendor workflows.
- We often observe companies attempting to treat IT audit as a clerical function. When you undervalue the role, you receive basic compliance checklists that miss significant risks while exhausting your operational teams with redundant data requests.
The search
How the Contract IT Auditor search runs
- First, we define your primary audit objective. We determine if you require broad coverage for an annual SOX review or a deep-dive investigation into a specific high-risk system upgrade. This distinction dictates whether we prioritize deep compliance procedural knowledge or advanced technical systems engineering experience.
- Second, we isolate candidates by the scale and complexity of the environments they have previously audited. We filter for individuals who have worked on systems similar in size to your footprint, as a person comfortable auditing a small, static server environment will likely struggle with a distributed, high-volume cloud infrastructure.
- Third, we conduct a technical panel to confirm they understand the interaction between your finance team and IT staff. We ensure the candidate speaks the language of your IT managers well enough to resolve technical remediation items without constant translation from your side.
Questions
How does an IT auditor differ from a security engineer?
An IT auditor evaluates whether existing security and financial controls function as intended. A security engineer designs and implements the systems to block threats and manage risk.
Do I need an auditor with a specific certification?
Certifications like CISA or CIA indicate a baseline of standard knowledge. The actual value comes from their experience in your specific industry and system environment.
Can an auditor also fix the security gaps they find?
Usually not. Independence requirements often prevent auditors from implementing the fixes they suggest. They provide the findings so your team can perform the work.
What is the fee structure for this role?
No upfront fee. You pay only if you hire.
What replacement terms apply?
We offer a candidate replacement guarantee on standard search agreements. The applicable period and exact terms are set out in the signed client recruiting agreement.
How are recruiting fees agreed?
No upfront fee. You pay only if you engage someone we present. We scope the assignment before quoting; the fee page explains our model.
How soon can we see options?
Availability depends on the assignment and the people who fit it. We qualify interest and commitments rather than promising a shortlist date before the search is scoped.
What if the scope grows?
Discuss new responsibilities before adding them to the engagement. Agree the priorities and record any change to the brief and terms.
Can we extend an engagement?
Discuss what remains unfinished and whether the same responsibility is still needed. Extensions depend on the person's commitments and the agreed engagement terms.
Can the appointment become permanent?
A permanent move can be discussed if both sides want it. Review the future role and the applicable agreement instead of assuming that temporary coverage automatically converts.
How is a confidential search handled?
Tell us what can be disclosed and whom we must not contact. We agree those boundaries before approaching people; do not send sensitive records with an initial brief.
What are the replacement terms?
We offer a candidate replacement guarantee on standard search agreements. The applicable period and exact terms are set out in the signed client recruiting agreement.
What do you not do?
We do not sell job-board reposting as a search or bill hourly for recruiting work. We do not take a retainer unless expressly agreed, and an introduction does not authorize an engagement.
Tell us the seat
No upfront fee. You pay only if you hire. Share the title, the situation and the timing. A person reads it.
Contract IT Auditor by industry and related roles
Executive roles above this one
More FP&A, Audit & Tax Professionals roles
The Six-Step Search
What do you get at each step of the search?
We agree what the person must own before contacting anyone. You see how the search is scoped and which backgrounds we pursue. We speak with candidates about the work before presenting them. The Six-Step Search gives you useful written notes and support through interviews, rather than a pile of applications.
- 01
Scope call
We talk through the seat, the business and what has to change.
You get: A one-page role brief you approve before we search.
- 02
Market map
We work out where people who have done this job actually sit.
You get: A short note on the pool and how we plan to reach it.
- 03
Direct outreach
We approach people who are not looking at job boards.
You get: Progress updates so you are never chasing us.
- 04
Screening
We interview every candidate on the work, not the resume.
You get: Written notes on fit, availability and terms for each person.
- 05
Shortlist and interviews
You meet a short list. We handle the scheduling.
You get: Several vetted options and a debrief after each interview.
- 06
Offer and start
You choose. We help settle terms and the start date.
You get: Confirmed terms, a start date and check-ins after day one.
Tell us who you need.
No upfront fee. You pay only if you engage someone we present.
Send us the seat. We will take it from there.
No upfront fee. You pay only if you engage someone we present.