Another thing the IT auditor should do is gain a good understanding of the IT function, including the managerial and operational aspects of IT. Depending on the entity, there could be a fairly long list of technologies or systems that will need to be evaluated for risk in operations.