Audit Analyst

Smartsuite; Newport Beach (CA); On-site; USD 110,000 - 170,000; Full time

Job summary

Capitolis in Newport Beach, CA seeks an Audit Analyst to transform ERP and financial data into actionable insights. You will extract data for testing, design analytics and continuous auditing routines, and build dashboards that surface high-risk areas and control performance.

Reporting to the Audit Manager, you will support engagement teams with sampling and trend analysis, maintain the function's data tools, and ensure accurate, timely analytics across internal controls and SOX compliance.

Qualifications

• Experience extracting data from ERP/financial systems and preparing testing datasets.
• Ability to design analytics and continuous auditing routines.
• Experience building dashboards highlighting high-risk areas and control performance.

Responsibilities

• Extract and prepare data from ERP and financial systems for testing.
• Design analytics and continuous auditing routines.
• Monitor transactional data for anomalies and exceptions.
• Build dashboards of high-risk areas and control performance.
• Support engagement teams with sampling and trend analysis.
• Maintain the audit function's data and reporting tools.

Skills

Data extraction

Data analysis

Data visualization

Continuous auditing

Dashboard development

Cross-functional collaboration

SOX knowledge

Tools

SmartSuite

Internal Audit Management

Issues Management

SOX Compliance

Job description

Governance, risk and compliance

SmartSuite for the Audit Analyst

The Audit Analyst provides data extraction, analysis, visualization and continuous auditing support for the audit function. They integrate data from ERP and financial systems, monitor transactions for anomalies and build dashboards of high-risk areas and control performance.

Start free trial

Schedule a demo

Reports to:

Audit Manager

What you own

The Audit Analyst provides data extraction, analysis, visualization and continuous auditing support for the audit function.

• Extract and prepare data from ERP and financial systems for testing
• Design analytics and continuous auditing routines
• Monitor transactional data for anomalies and exceptions
• Build dashboards of high-risk areas and control performance
• Support engagement teams with sampling and trend analysis
• Maintain the audit function's data and reporting tools

At a glance

The GRC processes this role owns, touches and depends on.

Owns

accountable for the process

Internal audit

Touches

contributes or approves

Reporting

Risk management

Depends on

consumes its output

Issues and actions

How the GRC processes connect

Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Audit Analyst: navy is owned, blue is touched, grey is depended on.

1. First line - The business and its control owners - Run the processes, own the controls, fix the issues
2. Second line - Risk, compliance and the domain programmes - Set the frameworks, assess, monitor and advise
3. Third line - Internal audit - Independent assurance to the board and audit committee

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Audit Manager

Direct reports

None

Works closely with

• Internal Auditor
• Risk Analyst
• Controls Testing Lead

How SmartSuite supports the Audit Analyst

The audit function relies on you for the data behind its conclusions: extracts from ERP and financial systems, continuous auditing routines and dashboards that point engagement teams at risk. SmartSuite gives an Audit Analyst one place to hold that data, raise anomalies as tracked exceptions and show the Audit Director where control performance is weakening.

Turn financial and ERP data into audit insight

• Full-population test data beside the procedure

  Attach extracts, sampling logic and analysis results directly to the testing procedure they support, so an engagement team opens the working paper and finds the data that justifies the conclusion.

• High-risk areas ranked live

  Build views that rank auditable areas by risk rating, exception volume and control performance, read live from Internal Audit Management records rather than refreshed by hand each month.

• Trend analysis across audit types

  Compare patterns across operational, IT, finance and compliance audits in one place, so you can tell the Audit Manager which themes recur and which risk ratings are drifting.

Support engagement teams and the risk function

• Anomalies routed to an owner

  When a continuous auditing routine flags an anomaly, log it in Issues Management with an owner and a due date, so it is routed for review instead of sitting in an analysis file.

• Analytics linked to risks, KRIs and controls

  Connect your routines to the risks and key risk indicators they monitor, so the Risk Analyst and Controls Testing Lead see the same signal you do and audit effort follows exposure.

• Questions answered inside the audit record

  Use in-record conversations and mentions to answer an Internal Auditor's query about a sample or a threshold where the data lives, keeping the discussion with the working papers.

Give leadership evidence that stands up to review

• SOX testing fed by the same analytics

  Attach transaction analysis results to SOX Compliance test records, so control owners and external auditors receive analysis with a traceable history rather than a one-off extract.

• Access limited to the right readers

  Granular permissions keep sensitive transaction data and audit documentation visible only to authorized engagement members, which matters when your extracts contain payroll, payments or patient billing.

• Briefings drafted from the results

  Use the AI Assistant in a SmartDoc field to turn analysis results into a draft briefing for the Audit Director, pulling in live record data so the figures come from the records you maintain.

Internal audit. Holds extracts and analysis results from ERP and financial systems beside the testing procedures they support, and builds dashboards showing high‑risk areas, exceptions and control performance.

Issues and actions. Logs the exceptions that continuous auditing routines flag as tracked items with owners and due dates.

Reporting. Delivers analytics‑driven insight to the audit function and leadership.

Products this role uses most

Internal Audit Management

Plan, execute, and report on audits with complete assurance oversight — linking findings to risks, controls, and remediation actions in a single workspace.

Issues Management

Track and remediate issues across audits, risk, and compliance with structured workflows, clear ownership, and real‑time visibility into resolution status.

SOX Compliance

Manage SOX compliance with structured control testing, evidence tracking, and real‑time visibility into financial reporting controls and audit readiness.

Industry reference

The IIA's Global Technology Audit Guides on data analysis technologies (GTAG 16) and continuous auditing and monitoring (GTAG 3, third edition, 2025) and the 2024 Standards' expectations on technology-enabled auditing describe the analyst's remit: full‑population testing, continuous monitoring routines and dashboards that direct audit effort to risk.

Data sources are sector‑specific. Banks analyze transaction, loan and payment data under Basel and BCBS 239 data‑quality expectations; healthcare analysts test claims and billing against CMS rules; government analysts follow GAO's Yellow Book when analytics support audit conclusions; technology analysts work with access logs and change records for Soc 2 and ITGC testing.

Related roles

Audit Manager

See the role

Explore Further

Guides and definitions from the GRC Knowledge Center and the What‑is glossary, chosen for this role.

Frequently asked questions

The Audit Analyst provides the data behind the audit function: extracting and preparing data from ERP and financial systems for testing, designing analytics and continuous auditing routines, monitoring transactions for anomalies and building dashboards of high‑risk areas and control performance. They support engagement teams with sampling and trend analysis and maintain the function's data and reporting tools. In SmartSuite that work sits in Internal Audit Management, where the data, dashboards and exceptions live beside the engagements that use them.

Data from ERP and financial systems can be brought into SmartSuite through its REST API, webhooks and iPaaS connectors, and the analyst attaches extracts and results to the testing procedures in Internal Audit Management and builds dashboards on them showing high‑risk areas, exceptions and control performance. Because the dashboards read from the same records the engagement teams work in, an audit manager can move from a flagged area straight to the engagement that covers it, and the analyst does not rebuild the same view for every request.

When a continuous auditing routine in the analyst's analytics tools flags an anomaly in transactional data, the exception is logged in Issues Management as a tracked item rather than a row in a spreadsheet. Each item has an owner and a status, so the analyst can see which exceptions the engagement team has reviewed, which were confirmed as findings and which need tuning. Over time that history shows which routines produce useful signal and which need tuning.

The analyst delivers analytics‑driven insight to the audit function and leadership through SmartSuite reporting, so the Audit Director sees the same dashboards of risk areas and control performance that the analyst maintains. Engagement teams led by the Audit Manager draw on the analyst's sampling and trend analysis within their engagements, and the Risk Analyst and Controls Testing Lead can use the same control performance data, which keeps the audit, risk and controls views consistent.

Start with the ERP and financial system extracts the function already tests, since they can be brought into SmartSuite through its REST API, webhooks or iPaaS connectors, and add transaction monitoring routines as they are designed. SOX Compliance holds the financial reporting control status the analyst's dashboards can draw on, so control performance is reported without a separate pull. New customers can start with SmartSuite Onboarding, a guided four‑week program around one or two priority workflows, and widen data coverage as routines prove useful.

See SmartSuite for your role

Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.