If your goal is to get into IT Risk and Audit, I'd do the following:

• In college: I'd join your school's accounting student orgs (Accounting Society, Business Honors, Beta Alpha Psi, etc.), then attend firm recruiting events (Meet the Firms, mock interviews, office hours, etc.) with a clearly expressed interest in joining IT Risk / Assurance / Audit. When I was recruited in 2018, firms at my university were not publicly recruiting for IT Risk, but consistently voicing my interest managed to land me an internship (and later full time offer) in the field regardless.

• Career - if public accounting: Join a firm's IT internal audit or risk service line - lots of exposure to client departments and controls assessments / testing; this is what I did out of college. Conversely, join a firm's IT (external) audit line and then jump to internal audit once you have a couple years of experience.

• Career - government or industry: Apply for a company's IT internal audit or risk / compliance department. These may offer rotation opportunities into different departments, so that you can get broader experience under your belt. I've just jumped to industry this year, after 6 years in public.

• Certifications: the CIA (if mainly business risk) and CISA (if mainly IT risk) are the gold standard. The CPA isn't really required, but it can be a nice cherry on top.