Organisations are increasingly expected to prove that their IT is under control. Clients ask for an ISAE 3402 or SOC 2 report, the external auditor wants to rely on IT general controls, DORA requires financial institutions to audit their ICT risk management internally, and the Dutch Cyberbeveiligingswet brings NIS2 supervision. An IT auditor assesses whether your controls are designed properly and whether they actually work. MVPeople Group is a hyper-niche cybersecurity recruitment firm based in Amsterdam. We place IT auditors in internal audit functions, in second-line risk teams and on readiness projects ahead of external assurance.
In short
You hire an IT auditor for independent assessment of IT controls: IT general controls, ISAE 3402 or SOC 2 readiness, internal ISO 27001 audits and audits against DORA or NIS2. MVPeople Group places IT auditors in the Netherlands, including Dutch RE auditors and CISA-certified specialists, as interim, seconded or permanent hires.
An IT auditor tests whether the control of information systems meets a standard or framework. That can be an external standard such as ISO 27001, COBIT or a regulatory framework, or your organisation's own internal control framework.
An IT audit usually answers three questions. Are the controls designed well? Have they actually been implemented? And have they operated effectively over a period of time? Typical topics include logical access, change management, backup and continuity, oversight of outsourced services and the security of critical applications.
The outcome is a report with findings and recommendations that the board, audit committee or regulator can act on. A good IT auditor writes findings so that management understands the risk and what needs to happen, without getting lost in technical detail.
The most common reason is capacity. Internal audit teams often have an audit plan they cannot complete with permanent staff, or lack specific IT expertise for a topic such as cloud or IAM.
Regulation is the second driver. DORA has applied since 17 January 2025 and requires the ICT risk management framework of financial entities, other than microenterprises, to be audited internally on a regular basis by auditors with sufficient ICT risk expertise and appropriate independence. Under NIS2, implemented in the Netherlands through the Cyberbeveiligingswet, supervision of essential entities can include regular and targeted security audits by an independent body. An IT auditor helps you test your readiness before the regulator does.
Other triggers are ISO 27001 certification, where the standard requires internal audits, and clients asking for assurance in the form of an ISAE 3402 or SOC 2 report.
In the Netherlands you will see the terms IT auditor and EDP auditor used interchangeably. RE stands for Register EDP-auditor: an IT auditor registered with NOREA, the Dutch professional body for IT auditors. Registration requires a recognised postgraduate IT audit programme, and RE auditors are bound by NOREA's professional rules and continuing education requirements.
CISA, Certified Information Systems Auditor, is an international certification from ISACA. The exam and experience requirements are the same worldwide, which makes CISA particularly useful in international organisations.
What matters is the engagement. Work that explicitly calls for an RE auditor requires one. For internal audits, readiness projects and second-line work, a CISA or comparable background is often sufficient. We help you make that call before the search starts.
ISAE 3402 is the international standard for assurance reports on controls at service organisations, focused on processes relevant to their clients' financial reporting. SOC 2 is a framework from the American AICPA, based on the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Both come as Type I, covering the design and existence of controls at a point in time, and Type II, which also tests operating effectiveness over a period.
The report itself is issued by an external audit firm. An IT auditor you bring in helps you get there: a readiness assessment, building the control framework and system description, testing controls before the external auditor arrives and following up on findings.
Independence matters. Someone who helped design your controls cannot audit those same controls independently. We take that into account when we put candidates forward.
In the IIA Three Lines Model, internal audit is the third line: independent from the management that owns the risks. A third-line IT auditor ideally reports to the audit committee and delivers the audit plan.
Many organisations also look for IT audit skills in the second line, for example in an IT risk or compliance function that monitors and tests controls; see /expertise/it-risk-management and /expertise/grc-compliance. The profile resembles an IT auditor, but the role and reporting line differ.
Through MVPeople you hire an interim IT auditor for a single audit or a peak in the audit plan. Through MVProfessionals we second IT auditors employed by MVPeople for longer assignments. Through MVPermanent we recruit an IT auditor or IT audit manager for a permanent role; see /services/mvpermanent.
We assess IT auditors on technical knowledge and on writing and communication skills. On the technical side we look at the standards and frameworks a candidate has worked with, the scale of previous audits and the sectors involved, such as financial services, government or IT service providers.
We also ask how they work: how do they build an audit programme, how do they determine sample sizes, and how do they discuss a difficult finding with management? An IT auditor who is technically strong but cannot win acceptance for findings adds little value.
We respond to your request within 4 hours. Suitable profiles are typically presented within 5 to 10 working days, and an interim IT auditor can often start within 2 weeks.
An RE auditor is registered with NOREA, the Dutch professional body for IT auditors, after completing a recognised postgraduate IT audit programme. CISA is an international ISACA certification based on an exam and work experience. If an engagement explicitly requires an RE, a CISA alone is not sufficient.
No, the report is issued by an external audit firm. An IT auditor you hire prepares you for it through a readiness assessment, the control framework, the system description and testing controls in advance. That reduces the chance of findings in the external report.
A Type I report assesses the design and existence of controls at a specific point in time. A Type II report also tests whether the controls operated effectively over a period. Clients usually ask for Type II because it provides more assurance.
Yes, DORA requires the ICT risk management framework of financial entities, other than microenterprises, to be audited internally on a regular basis. The auditors need sufficient ICT risk expertise and appropriate independence. Many institutions bring in IT audit capacity temporarily to meet this requirement.
An interim IT auditor can often start within 2 weeks. We respond within 4 hours and typically present suitable profiles within 5 to 10 working days. Availability tightens towards year end, around the annual financial statement audits, so it pays to request early.
Lead a growing team driving information security, quality, and privacy strategy across a major public health organisation. Shape culture, build frameworks, and connect disciplines in a dynamic healthcare environment.
Lead compliance efforts under the Dutch Breach Incident Obligation (BIO) regulation. You ensure your organisation meets mandatory incident reporting and security monitoring requirements.
Lead security strategy and governance for a growing organisation. You shape security culture, manage risk frameworks, and report to senior leadership on the security posture.
Lead security governance and risk management for a major organisation. Design and implement security strategies, policies, and controls across the enterprise.
Last updated by Mathijs Visser, Co-founder and Lead Consultant MVPeople Group.
Tell us which audit or project you are planning. We respond within 4 hours with available profiles.
