Internal Auditor Skills: The Twelve Competencies, by Level, and How to Build Each

Internal auditor skills are a specific set, not a list of virtues. The job is to form an independent, evidenced opinion on whether something is managed well enough for the risk it carries, and to get that opinion acted on by people who did not ask for it. Twelve competencies do that work, and they are not the same at every level: a staff auditor is judged on evidence and documentation, a manager on scoping and review, a chief audit executive on the audit committee relationship and the plan. This guide sets out the twelve, what each looks like in practice and how it fails, how the mix changes from staff to chief audit executive, how to build each one with the resources on this site, what the IIA’s Standards and competency framework require, how functions assess skills, communication at every level, the behavioural skills that decide careers, the 2026 shift toward data and AI, and a twelve-month development plan for a senior auditor.

It replaces the five-skill list that previously stood at this address and absorbs the former guides to soft skills and to communication by level. For what the skills are worth in the market, the interview questions guide shows how each is tested and the By Role hub where each level sits.

In this guide

• The twelve competencies
• How the mix changes by level
• How to build each skill
• What the Standards and the competency framework require
• Communication at every level
• The behavioural skills that decide careers
• Specialist tracks and the skills they add
• What a reviewer sees: the five skill gaps most often found in files
• The 2026 shift: data, analytics and AI
• How functions assess skills
• A twelve-month development plan for a senior auditor
• Frequently asked questions
• Related guides

The twelve competencies

The twelve fall into three groups: the technical core that produces a defensible conclusion, the professional disciplines that make the work reliable, and the relational skills that make it land. Every one can be learned; the groups differ in how long they take. The technical core is taught: a good function teaches evidence, testing and documentation in the first year through methodology, review notes and file reviews, and analytics in the second. The professional disciplines are habits formed under supervision, which is why the quality of a first manager matters more than the name of a first employer. The relational skills are learned by exposure to the people the function has to persuade, and they arrive last because the exposure does. An auditor who is strong in one group and weak in another is recognisable: the technically excellent senior whose findings are never acted on, the persuasive manager whose files would not survive a quality assessment.

Competency	What it looks like in practice	How it fails	How it is tested in interviews
1. Risk and control thinking	Starts from the objective of a process, identifies what could stop it, finds the controls that address those risks, and tests the ones that matter	Testing whatever is easy to test; a checklist instead of a risk assessment	“How would you scope an audit of X?”; the case study round
2. Evidence and testing	Knows what evidence supports what conclusion; designs tests with populations, samples and criteria; documents so a reviewer can re-perform	Inquiry treated as evidence; samples too small for the conclusion drawn	Walk-through of a past test; questions on sample sizes
3. Documentation and workpapers	Files that stand alone: purpose, source, procedure, result, conclusion, cross-referenced	Conclusions without a trail; files that only the preparer can read	Review of a redacted workpaper; the workpaper guide standard
4. Data and analytics	Tests populations rather than samples where data exists; builds repeatable queries; knows data lineage	Excel pivot tables presented as analytics; results that cannot be rerun	A data exercise; questions on tools and full-population tests
5. Technology and IT literacy	Understands applications, access, change, infrastructure and cloud well enough to audit the general controls and read a system diagram	Deferring every technology question to the IT auditor	Scenario questions on access or change management
6. Finance, accounting and regulatory literacy	Reads financial statements and the regulations that apply to the industry; knows where the numbers come from	Auditing a bank without understanding the balance sheet	Industry questions; the regulators’ expectations
7. Writing	Findings with condition, criteria, cause, effect and action; reports that executives read and act on	Hedged, passive, jargon-laden reports; findings that describe without rating	A writing sample; the finding makeovers standard
8. Professional scepticism and judgment	Questions what is asserted, weighs evidence, decides, and documents why; holds a position under pressure	Accepting management’s explanation; or, the opposite, refusing to conclude	Behavioural questions about disagreement; the scepticism guide
9. Interviewing and inquiry	Plans interviews, asks open questions, listens for what is not said, corroborates	Reading a questionnaire; leading questions; no follow-up	Role-play; the audit interviewing guide
10. Project and time management	Runs an engagement to budget and date; sequences fieldwork; escalates slippage early	Fieldwork that expands; reports issued months after fieldwork	“Tell me about an engagement that went off track”
11. Communication and influence	Tailors the message to the audience; negotiates findings without softening them; presents to executives and the committee	One message for everyone; findings negotiated away or imposed without agreement	Presentation round; the negotiating findings guide
12. Independence, ethics and courage	Reports what the evidence shows regardless of who is affected; manages conflicts; escalates through the reporting line	Ratings adjusted for the audience; issues deferred because the owner is senior	Questions about pressure, and the answers to them

How the mix changes by level

The twelve are all required at every level, but the ones that decide performance change as the job changes. The table gives the dominant competencies at each level and what “good” looks like; the day in the life guide shows the weeks behind it.

Level	Dominant competencies	What good looks like	What derails people at this level
Staff auditor (0–2 years)	Evidence and testing; documentation; interviewing; time management	Clean files that need few review notes; tests completed to budget; evidence that supports the conclusion	Treating inquiry as evidence; hiding slippage; the first ninety days guide covers the start
Senior auditor and in-charge (2–5 years)	Risk and control thinking; writing; analytics; scepticism; project management	Scopes the engagement, runs fieldwork, drafts findings the manager can issue, supervises staff	Over-testing low-risk areas; findings that describe instead of conclude; the in-charge guide
Audit manager (5–9 years)	Review; communication and influence; judgment on ratings; business and regulatory literacy	Issues reports on time with ratings that hold; owns the relationships with the executives of the portfolio; develops seniors	Reviewing by re-doing the work; negotiating ratings instead of evidence
Director and senior manager (9–14 years)	Risk assessment and planning; influence at executive level; people leadership; methodology	Owns part of the plan and the issue program; presents to the committee; runs co-sourcing	Losing touch with the evidence; politics replacing independence
Chief audit executive	The audit committee relationship; strategy and risk literacy; courage; the function’s people and budget	A plan built from the organisation’s strategy; an annual opinion the committee trusts; a function examiners rate well	The chief audit executive guide covers the paths and the failures

How to build each skill

Skills are built by doing the work with feedback, and the table pairs each competency with the fastest route and the resource on this site that teaches it. Certifications are listed where they test the skill, not as a substitute for practice; the certification roadmap sequences them.

Competency	Fastest route	Resources on this site	Certification that tests it
Risk and control thinking	Build a risk and control matrix for every engagement before testing; have it challenged in planning	The work program guide; the RCSA guide	CIA Part 2
Evidence and testing	Learn sampling properly once; document every sampling decision	The attribute sampling guide; the sampling memo	CIA Part 2; CPA
Documentation	Write every workpaper for the reviewer who has never met you	The annotated workpaper examples	Quality reviews, not exams
Data and analytics	Learn SQL and one analytics tool; replace one sample test per engagement with a population test	The SQL for auditors guide; the documenting analytics guide	CIA Part 3; CISA
Technology literacy	Audit the general controls of the application you audit most; read the architecture	The IT general controls guides in the Topics hub	CISA
Finance and regulatory literacy	Read the annual report and the examination manual for the industry you audit	The financial services guide; the regulators guide	CPA; industry credentials
Writing	Rewrite every finding until it carries condition, criteria, cause, effect and action in plain words	The finding makeovers; the writing for the board guide	None; reviewers and readers
Scepticism and judgment	Write down the alternative explanations before accepting one; keep a decision log	The professional scepticism guide; the professional judgment guide	CIA Part 1
Interviewing	Plan every interview; record what was asked and answered; corroborate	The audit interviewing guide	None
Project management	Track budget and milestones weekly; escalate at 10 per cent variance	The in-charge guide	PMP for those who want it
Communication and influence	Present every finding to its owner before the report; take the hard conversation yourself	The negotiating findings guide; the difficult conversations guide	None
Independence and courage	Decide the rating from the evidence, then consider the audience; escalate through the line, not around it	The trusted advisor guide; the stature and influence guide	The Code of Ethics

What the Standards and the competency framework require

The IIA’s Global Internal Audit Standards, effective from January 2025, make competency a requirement rather than an aspiration: internal auditors must possess or obtain the knowledge, skills and abilities to perform their responsibilities, maintain them through continuing development, and the chief audit executive must ensure the function collectively has what the plan requires, obtaining it through hiring, development or co-sourcing. The IIA’s Internal Audit Competency Framework groups the same ground into four areas (professionalism, performance, environment, and leadership and communication) with behaviours at general awareness, applied knowledge and expert levels, and most functions build their competency matrix from it.

Requirement	What it means for the auditor	What it means for the function	Evidence a quality assessor looks for
Competency (knowledge, skills and abilities)	Know what the work requires and acquire it; do not perform work you are not competent for	A competency matrix against the plan; gaps closed by development, hiring or co-sourcing	The matrix; the gap analysis; co-sourcing decisions
Continuing professional development	A development plan and the hours behind it; for CIAs, the annual reporting requirement	A training plan tied to the matrix gaps, not to what is on offer	Training records against the plan
Due professional care	The care a competent, prudent auditor would apply: scepticism, evidence, documentation	Methodology and review that enforce it	Review notes; quality reviews of files
Collective competency for the plan	None directly	The chief audit executive’s assessment that the function can deliver the plan, with specialist skills identified	The plan’s skills assessment; use of guest auditors and co-sourcing
Ethics and professional courage	The Code of Ethics: integrity, objectivity, confidentiality, competency; the Standards’ new emphasis on courage	A culture that backs auditors who hold a position	Instances of escalation; the audit committee’s view

Communication at every level

Communication is one competency with five audiences, and the message that works for a process owner fails with a director. The table follows the career ladder with the audience, the purpose and the form at each level, which is the material the former guide to communication by level covered.

Level	Main audiences	Purpose	Form that works	Common failure
Staff auditor	Process staff; the in-charge	Get the evidence; report progress and problems early	Prepared questions; a daily note to the in-charge with status, blockers and what was found	Silence until the problem is unrecoverable
Senior and in-charge	Process owners; the manager	Agree facts during fieldwork; draft findings the owner recognises	Fact confirmation after each test; a draft finding shared before the closing meeting	Findings sprung at the closing meeting
Manager	Department heads and executives; the chief audit executive	Issue reports that are read and acted on; negotiate actions, not facts	A one-page summary with ratings and the three things that matter; the finding meeting before the report	Twelve-page reports that bury the rating
Director	Executives; the audit committee as presenter; regulators	Represent the function’s view of a portfolio of risks	Thematic reporting across engagements; the audit committee pack	Reporting engagements rather than risks
Chief audit executive	The audit committee chair; the chief executive; the board; examiners	Give the committee an opinion it can rely on and the information to govern	The annual opinion; the quarterly pack; the private session with the chair	Altitude lost in detail; the writing for the board guide covers the fix

The behavioural skills that decide careers

Technical skills get an auditor to senior; the behavioural skills decide whether they get further, because from manager onward the job is persuading people who outrank you to do things they would rather not. The five below are the ones the former soft-skills guide covered, with the behaviours that show each is present.

Skill	Behaviours that show it	How to develop it	How it is misread
Influence without authority	Findings accepted because the owner sees the risk, not because the committee will see the report; actions proposed by the owner	Lead with the business consequence; offer the owner the first chance to fix it; keep the escalation for the rare case	Mistaken for softness when the rating is unchanged
Adaptability	Moves from a treasury audit to a warehouse audit to a cloud migration without needing a new methodology; learns the process before judging it	Take the unfamiliar engagement; read the owner’s metrics before the first interview	Mistaken for lack of specialism
Emotional intelligence	Reads the room in a closing meeting; separates the person from the finding; notices when an interviewee is afraid	Ask what the owner is measured on; debrief every difficult meeting	Mistaken for people-pleasing
Resilience under pressure	Holds a rating when the owner escalates; keeps working when the plan is cut; recovers from a bad review	Keep the evidence file close; use the reporting line; the difficult conversations guide gives the scripts	Mistaken for stubbornness when the evidence is thin
Leadership before the title	Develops the staff on the engagement; improves the methodology; represents the function to the business	Volunteer for the methodology project; mentor one staff auditor	Mistaken for ambition

Specialist tracks and the skills they add

Most functions above twenty people have specialist tracks, and each adds a layer to the twelve rather than replacing any of them. The generalist competencies remain the entry requirement; the specialist layer is what the track is hired for and what its certification tests.

Track	What it adds to the twelve	Typical entry route	Credential
IT audit	Application and infrastructure controls, access and change management, cloud and third-party technology, cyber frameworks, data centre and resilience	Information systems degree or a technology role; generalists who take the IT general controls engagements	CISA; cloud and security certifications
Financial services	Balance sheet and regulatory literacy: credit, liquidity, interest rate and market risk, capital, examination expectations, the regulatory reporting stack	Banking or public accounting with bank clients; the external-to-internal transition guide	CIA plus industry credentials; CFA for treasury and market risk
Data analytics	Query and scripting languages, analytics tools, data lineage, continuous monitoring design, documenting analytics as evidence	Analysts from finance or operations; generalists who learn SQL and a tool	CIA Part 3; vendor tool certifications; data credentials
Forensic and investigations	Fraud schemes and red flags, interviewing under caution, evidence handling and chain of custody, legal process	Experienced auditors with a fraud engagement record; law enforcement and forensic accounting	CFE
Model risk and quantitative	Statistics, model development and validation standards, documentation review, performance monitoring	Quantitative degrees; risk modelling roles	FRM; actuarial and statistical credentials
Compliance and conduct	Regulatory inventories, compliance management systems, complaint analytics, fair lending and conduct testing	Compliance functions; legal; generalists on compliance engagements	CRCM and equivalents; CIA

What a reviewer sees: the five skill gaps most often found in files

Reviewers and quality assessors see the same five gaps in most functions, and each maps to a competency above. Knowing them is the cheapest development plan there is, because each is visible in the next file you prepare.

Gap	How it appears in the file	Competency	The fix
Inquiry as evidence	A control is concluded effective because the owner said it operates; no document, observation or reperformance	Evidence and testing	Every control conclusion needs a second source; write the test so that the owner’s statement is the least important input
Conclusions without criteria	A finding says the process is weak without saying against what standard	Writing; risk and control thinking	State the criteria (policy, regulation, control objective) in the finding and in the test
Samples too small for the conclusion	Five items tested, “no exceptions noted”, a population of thousands	Evidence and testing	Size the sample to the assurance the conclusion claims, and say so in the sampling memo
Scope creep and silent slippage	Fieldwork hours double the budget with no record of why; the report issues three months after fieldwork	Project management; communication	Weekly budget tracking; escalate at the first 10 per cent variance; agree scope changes in writing
Ratings that drift	The draft rated the finding High; the issued report says Medium; the file does not say what changed	Independence; judgment	Record every rating change with the evidence that justified it; if the evidence did not change, the rating does not

The 2026 shift: data, analytics and AI

The competency that has moved most since 2023 is the fourth. Functions now expect seniors to test populations, managers to read a query, and everyone to use generative AI tools for drafting, summarising and analysis under a usage policy, while knowing what the tools cannot be trusted to do. The skills that result: data acquisition and lineage (where the data comes from and whether it is complete); query and scripting literacy (SQL at least; a scripting language or an analytics tool); documenting analytics as evidence so a reviewer can rerun it; prompt discipline and verification when using AI assistance; and the ability to audit AI systems the organisation deploys. The generative AI across the audit lifecycle guide sets out the use cases and review gates, the AI usage policy the rules, and the AI governance audit guide the engagement. None of this replaces the first three competencies; an analytics result that no one can explain to a process owner is not a finding.

How functions assess skills

Functions assess competency in four places, and an auditor who knows where should prepare for each. The quality assurance and improvement program assesses the function; the performance review and the competency matrix assess the individual; the interview assesses the candidate. The assessments differ in what they can see. A file review sees evidence, testing, documentation and writing and nothing else, so an auditor whose files are clean is credited with competence they may not have in the room, and one whose files are weak is discounted regardless of what they can do with a process owner. A performance review fed by manager and owner feedback sees communication and influence but tends to miss scepticism, because the owners who were challenged rarely volunteer praise. The competency matrix sees whatever the self-assessment and the manager say, which is why the better functions calibrate it against file reviews and engagement outcomes rather than opinion.

Mechanism	What is assessed	Evidence used	How to prepare
Competency matrix	Each auditor against the competencies the plan requires, at awareness, applied or expert level	Self-assessment, manager assessment, engagement reviews	Keep a log of engagements by competency; ask for the gaps
Engagement and file reviews	Documentation, evidence, testing, writing	Review notes; quality reviews of closed files	Treat every review note as data; track the recurring ones
Performance review	Delivery, judgment, communication, development	Engagement feedback from managers and owners	Ask owners for feedback at the closing meeting, not at year end
External quality assessment	The function’s collective competency against the Standards	Matrix, training records, file reviews, stakeholder interviews	Know what the assessor will ask of your files
Interviews	All twelve, through questions, cases and writing samples	The interview questions guide; the manager and director interviews guide	Prepare one example per competency with the situation, what you did and the result

A twelve-month development plan for a senior auditor

A plan for a senior auditor with three years’ experience who wants to be ready for manager, built on the competencies that decide the next level. The quarters assume four engagements a year and a function that allows some choice of assignment.

Quarter	Focus	Actions	Evidence of progress
Q1	Risk and control thinking; analytics	Scope the next engagement from the objective and risks before looking at last year’s program; replace one sample test with a population query; start SQL	A planning memo the manager accepts without rework; a documented query
Q2	Writing; influence	Draft every finding to the condition-criteria-cause-effect-action standard; present each to its owner before the closing meeting; take the difficult conversation	Findings issued with fewer review changes; owners proposing the actions
Q3	Review and supervision; technology	Supervise a staff auditor and review their file with written notes; take an IT general controls engagement or a technology component	A file you reviewed that passed the manager’s review; one technology finding
Q4	Business and regulatory literacy; the exam	Read the annual report and the examination manual for your industry; sit CIA Part 2 or the challenge exam if eligible	An engagement scoped from the industry’s risks; the exam passed
Throughout	Scepticism, documentation, courage	Keep a decision log of judgments and the evidence behind them; escalate once through the line when the evidence requires it	A log the manager can read; a rating held

Frequently asked questions

What are the most important skills for an internal auditor?

Twelve, in three groups: the technical core (risk and control thinking, evidence and testing, documentation, data and analytics, technology literacy, finance and regulatory literacy, writing), the professional disciplines (scepticism and judgment, interviewing, project management) and the relational skills (communication and influence, independence and courage). At staff level evidence and documentation decide performance; at senior level scoping and writing; from manager onward communication, judgment and courage.

What skills do you need to become an internal auditor?

To enter: analytical ability, attention to evidence, clear writing, basic accounting or business literacy, and willingness to ask questions of people who outrank you. A degree in accounting, finance, business, information systems or a related field is the usual route (the degrees guide compares them), and the CIA or CPA follows within a few years. Data skills (SQL, an analytics tool) now shorten the path to senior.

Are soft skills or technical skills more important in internal audit?

Technical skills get you to senior; behavioural skills get you further. A finding has to be right before it can be persuasive, so evidence, testing and writing come first, and an auditor without them is not credible however well they communicate. From manager onward the job is getting executives to act on conclusions they did not want, and influence, adaptability, emotional intelligence and courage decide who succeeds.

What does the IIA require on competency?

The Global Internal Audit Standards, effective January 2025, require auditors to possess or obtain the knowledge, skills and abilities their work requires and to maintain them through continuing development, and require the chief audit executive to ensure the function collectively has what the plan needs, through development, hiring or co-sourcing. The IIA’s Internal Audit Competency Framework gives the behaviours at awareness, applied and expert levels across four areas, and most functions build their competency matrix from it.

How do I improve my analytical skills as an auditor?

Replace sample tests with population tests on every engagement where the data exists; learn SQL and one analytics tool; document every query so a reviewer can rerun it; and build the risk and control matrix from the process objective before testing. Analysis is a habit of asking what the whole population says and what would have to be true for the control to work, not a tool.

What skills will matter most for internal auditors in the next few years?

Data acquisition and lineage, query literacy, documenting analytics as evidence, disciplined use of generative AI tools with verification, and the ability to audit the AI systems organisations deploy, alongside the unchanged core: evidence, judgment, writing and courage. Functions are hiring for the data skills now and expecting seniors to have them.

How are internal audit skills assessed?

Through the function’s competency matrix (self and manager assessment at awareness, applied or expert levels), engagement file reviews, performance reviews fed by manager and process-owner feedback, the external quality assessment of the function, and interviews for candidates. Keep a log of engagements by competency and treat review notes as data on where you stand.

Which certification best develops internal audit skills?

The CIA, because its three parts test the core competencies directly: Part 1 the Standards, independence and ethics; Part 2 the practice of engagements; Part 3 business knowledge, technology and data. The CPA tests accounting and financial reporting depth, CISA technology, CFE investigations. The certifications comparison and the roadmap by career stage cover the sequence.

Related guides

• Internal Audit Interview Questions — how each competency is tested, with answers
• Your First 90 Days as a Staff Internal Auditor — the skills that matter at the start
• Running Your First Engagement as In-Charge — the senior-level skills in practice
• The Trusted Advisor Path — influence and independence at manager level and above
• How to Become a Chief Audit Executive — the competencies the top job requires
• Professional Skepticism — the core discipline, with traps and drills
• Audit Interviewing — question design and listening craft
• Finding Makeovers — the writing standard for findings
• SQL for Auditors — twenty queries mapped to audit questions
• A Certification Roadmap by Career Stage — what to earn when
• From External Audit to Internal Audit — what transfers from public accounting
• Career Growth category — every careers guide in one archive