Does the company's internal auditor have to be an IT specialist?

No, the company's internal auditor checks the implementation of the Safety Management System (SMS) and not the functionality of IT and OT systems.