BSides Buffalo 2026: What Is IT Audit: What IT Auditors Do and Why It Matters

The function of an IT auditor is often misunderstood in the greater cybersecurity and GRC landscape. This session cuts through the confusion and provides a clear, accessible overview of what IT auditors actually do, why the discipline exists, and how it fits into the broader governance, risk, and compliance landscape. Attendees will explore the different types of IT audits — from SOC 2 examinations and HITRUST assessments to HIPAA, CMMC, and ISO audits — and learn how each serves a distinct purpose in building organizational trust and compliance. The session will also cover how IT audits evaluate the design and effectiveness of controls across areas like access management, change management, endpoint security, and data protection. Whether you are a business leader trying to understand an upcoming SOC 2 examination, an IT professional preparing for your first audit, or a student exploring career paths, this session will give you a practical foundation for understanding how IT audit drives trust, accountability, and operational resilience.