As with most careers, it is difficult to predict where they will lead. Certainly it is common for CISA’s in public accounting firms to move into line management. Other possibilities are to move to industry and become an internal auditor, IT risk or IT security manager, or a CIO.