The internal auditor who chooses where and how they work

🆕 New & Trending AI Tools for Internal AuditorReviewed September 2026

We track new AI-tool launches every week and refresh this list — here’s what’s gaining traction for Internal Auditor work right now.

The department, the plan, the year

An internal auditor works inside the organization, on the team that examines how the place actually runs. The year starts with a plan. You and your leaders look at the company's risks, at what changed since last year, and at what the audit committee wants assurance on. Out of that comes a list of audits: revenue at a business unit, access to the financial system, a plant's inventory process, a third party who holds customer data, a compliance program a regulator already cares about. The plan is a promise about where audit time will go. Changing it midyear is allowed when the business changes. Doing only the easy audits is how a department loses the board's trust.

This is the internal audit department, not a forensic practice and not the outside firm that signs the financial statements. You are employed by the company, you report in a way that can reach the audit committee, and your product is assurance plus findings management can fix. A typical week mixes planning meetings, document review, conversations with process owners, and writing. You are trying to learn whether a control exists, whether people perform it, and whether a gap is big enough to matter. Then you write that down so someone who was not in the room can act.

Public companies, banks, hospitals, universities, insurers, and government agencies all keep this function. Titles run from staff auditor to senior, manager, director, and chief audit executive. The daily texture changes with the industry, yet the spine stays familiar: a plan, fieldwork, a finding, a management response, and a report that can survive a committee's follow-up next quarter.

Fieldwork, findings, and the response

Fieldwork is where the plan meets the process. You read the procedure, you sit with the person who does the work, and you select transactions or events to see whether the control operated. Sampling, system reports, and walkthroughs are ordinary tools. You keep a record of what you looked at so a reviewer on your own team can retrace it. When something breaks, you write a finding that names the condition, the criterion you measured against, the cause if you can see it, and the effect. Vague findings ("controls need improvement") waste everyone's quarter. Specific findings give management something to accept, dispute with evidence, or fix.

The management response is part of the product. A process owner agrees or disagrees, names an action, and names a date. You evaluate whether that action would actually close the gap. Internal audit then follows up. An open finding that slips every quarter is a governance problem, not a paperwork problem. Your credibility depends on being fair in the original writeup and persistent afterward. People who treat every miss as a scandal stop getting the truth. People who soften every miss to stay liked stop being useful to the committee.

Writing quality decides how far a finding travels. A director will not forward a draft that buries the point under process history. Lead with what is wrong, how you know, and what you recommend. Keep the tone factual. You are not prosecuting a colleague. You are telling the organization where a control failed and what repair looks like. If a matter rises to suspected misconduct, the department has a path to the right leaders and, when needed, to specialists outside the ordinary audit. Your job in that moment is to preserve the record and follow the company's reporting path, not to freelance an inquiry.

In front of the audit committee

The audit committee is the board-level audience for this work. They approve or oversee the plan, they hear results, and they watch whether management closes what you opened. Staff auditors rarely present there on day one. They feel the committee anyway, because every finding is written as if a director might read it aloud. Managers and the chief audit executive carry the relationship: status of the plan, themes across audits, disagreements with management, and the department's own staffing. A calm, specific briefing beats a thick deck. The committee wants to know what deserves their attention this quarter.

Independence is the uncomfortable part of the design, and it is the point. Internal audit can sit inside the company and still need a reporting line that management cannot quietly mute. In a mature department, the chief audit executive can reach the committee chair. That structure protects a finding that a business leader would prefer to delay. If you are choosing a job, ask how the department reports, who approves the plan, and what happened the last time management disagreed with a rating. The answers tell you whether the charter on the intranet matches the culture in the building.

You will also coordinate with the external financial-statement auditors. They may rely on some of your work or simply want to understand what you covered. Coordination is professional courtesy and good planning. It does not make you their employee. Your scope comes from the internal plan and the risks the committee cares about, which often stretch past the accounts those outside auditors test. Operational audits, compliance audits, and reviews of how a major project is governed are ordinary internal work. Describe them that way when someone assumes you only tick and tie a balance sheet.

The CIA, granted by the Institute of Internal Auditors

The credential most closely tied to this seat is the Certified Internal Auditor, issued by the Institute of Internal Auditors. CIA is voluntary. It is not a licence to work, and plenty of capable auditors are hired before they hold it. What it shows is that you studied internal audit on purpose: how a function is governed, how engagements are performed, and the ethics the Institute expects of people who carry the credential. Employers in larger departments often pay for it and treat it as a promotion expectation by the time you reach senior or manager.

People prepare while they are already on a team. You learn the Institute's guidance through live audits first, then through the CIA study materials, so the vocabulary matches work you have seen. A bachelor's degree is the usual educational backdrop, often in accounting, finance, or business. A CPA is common in departments that spend a lot of time on financial controls, and it remains valuable. It answers a different brief. The CPA speaks to accounting. The CIA speaks to the internal audit profession. Holding both is a strong profile for a future chief audit executive. Holding neither is still compatible with a staff role if your writing and your judgment are already good.

Say where you are in the process when you interview. "I sit on a SOX and operational team and I am midway through the CIA" is a clear sentence. A vague interest in credentials someday is harder to trust. If your department also touches information systems, a technology credential can complement the CIA later. Start with the audit craft. Tools change. The habit of a fair finding does not.

How departments hire

Campus recruiting still feeds staff classes, especially at companies with rotational programs. Experienced hiring looks for a person who has owned a workpaper, written a finding, and talked to a prickly process owner without turning the meeting into a fight. Public accounting alumni move across often. So do people from risk, compliance, and finance roles who have learned to test rather than only to operate a process. Bring a writing sample if the employer allows it, with confidential details removed. A one-page finding, rebuilt from a public case or a scrubbed real one, shows more than a list of software names.

Interviews often pose a control scenario. You might hear about a purchasing process, a system access review, or a branch that reports perfect numbers. Talk through what you would want to understand, what you would look at, and how you would write the result if the control failed. Stay with professional judgment. You are showing that you can plan an audit and report it. Managers listen for whether you can tell a big gap from a paperwork nick, because a department that rates everything "high" teaches the committee to ignore it.

Ask about the plan and the committee in the same conversation: how much of the year is financial versus operational, whether you will travel, who reviews your drafts, and how the chief audit executive meets the committee. A department that cannot describe its reporting line is a harder place to learn the craft, even if the salary looks attractive. You are choosing a professional home, not only a busy season.

Staff auditor to chief audit executive

Staff auditors execute pieces of an engagement under a senior's scope. You learn workpapers, sampling, and how to ask for a document twice without an apology essay. Seniors run the engagement day to day, coach the staff, and draft the report. Managers own several audits, the relationship with a business unit, and the quality of what goes upward. Directors shape the plan for a slice of the risk universe. The chief audit executive owns the function: the charter, the plan presented to the committee, the people, and the message when the news is bad.

Promotion follows evidence. Keep findings that were accepted, follow-ups that closed, and reviews where a manager said your draft was the one they could send. Add the CIA when you are ready for the senior and manager stretch. If you want the chief's job someday, you will also need presence with a board, a sense of which risks deserve the year's scarce hours, and the spine to report a result a powerful executive dislikes. Some excellent auditors stop at senior or manager because they like the workpaper more than the politics, and the pay can still move. Decide on purpose. The committee path and the craft path are both real, and they start to diverge once you are the person editing other people's findings.

Wages inside the accountants and auditors series

Occupational Employment and Wage Statistics for May 2025 cover Accountants and Auditors, a wide series that includes this internal department alongside many other accounting seats. Entry pay is $56,020. The national median is $83,680. The high end of the published range in the District of Columbia is $185,220, where headcount was high enough for the Bureau to release a high end. That high end is not the state median. The District of Columbia median is $111,530. New York's median is $102,640, New Jersey's is $100,830, Massachusetts's is $99,460, and Connecticut's is $97,550. The step from entry to the national median is $27,660. From the national median to the District of Columbia high end is $101,540. The national median sits $27,850 under the highest state median. The spread between the highest state median and the lowest is $68,000.

Read the blend before you treat a number as your personal market. External reporting roles, corporate accounting, and internal audit share the series, so a median is a shared middle, not a quote for one title. Even so, the geography is instructive. The District of Columbia median of $111,530 stands $27,850 above the national median of $83,680. New York at $102,640 and New Jersey at $100,830 cluster together. Massachusetts at $99,460 and Connecticut at $97,550 sit just under that pair. The $68,000 gap between the highest and lowest state medians is large. The $185,220 high end in the District of Columbia is $101,540 above the national median, and it remains a range top, distinct from the $111,530 median in the same place.

Bringing the figures into an offer

Place the offer against $56,020 and $83,680 first. A staff seat near entry is coherent for a new graduate in a structured program. If you have already written findings, survived a busy season, or finished part of the CIA, an offer parked at the entry figure deserves a conversation about the $27,660 path to the national median. Ask which level maps to senior, what the range is for that level, and when the company reviews pay. Tie the ask to work the department can recognize: a closed audit, a finding the committee tracked, a skill such as data reporting that shortens fieldwork for the whole team.

City changes the anchor. A District of Columbia offer should be compared with $111,530, not only with the national median. New York at $102,640 and New Jersey at $100,830 are the right companions if you are choosing among those offices. Massachusetts at $99,460 and Connecticut at $97,550 give you a Northeast cluster that still sits above $83,680. When a recruiter cites $185,220, translate it out loud in your own notes: high end of the published range in the District of Columbia, $101,540 above the national median, and a different statistic from any state median, including the $111,530 median there. Manager and chief audit executive seats are where pay can travel toward the upper part of what an employer will do. Negotiate those with scope: size of the plan, whether you present to the committee, and how many auditors you will lead. The published figures keep the talk attached to a real scale.

Careers related to Internal Auditor