No degree is called internal audit, and the profession hires from at least nine. The question for a student or a career changer is which degree gets the first job, which one still matters at manager, and which coursework matters regardless of the name on the diploma. This guide compares the nine degrees internal audit functions hire from, by what they teach, which track they lead to and how recruiters read them; sets out the coursework that matters whatever the major; weighs an undergraduate degree against a master’s and names the master’s programs that pay for themselves; explains how the degree interacts with the CIA, the CPA’s changing education rules and the CISA; covers why the profession is still rarely taught in undergraduate programs and where it is; shows how to present a non-traditional degree; and ends with three composite paths from degree to senior auditor.
It replaces the shorter ranked list that previously stood at this address and absorbs the former note on why internal audit is a mystery in undergraduate education. The internal auditor skills guide covers what the job requires once the degree has done its work, and the interview questions guide what recruiters test.
In this guide
- What the job needs from a degree
- The nine degrees, compared
- Degree by target track
- The coursework that matters whatever the major
- Undergraduate or master’s
- How the degree interacts with the CIA, CPA and CISA
- Why internal audit is rarely taught, and where it is
- Presenting a non-traditional degree
- How recruiters screen degrees: the five questions
- What to do in each year of the degree
- Degrees and routes outside the United States
- Three composite paths
- Frequently asked questions
- Related guides
What the job needs from a degree
Internal audit tests whether processes are managed well enough for the risk they carry, in every function of an organisation, and reports the result to people who did not ask. A degree serves that job in four ways: it teaches the organisation’s language (accounting and finance are the common tongue of every business and the only language the audit committee speaks fluently); it teaches a discipline of evidence and argument; it teaches the subject matter of one track (technology, data, law, risk); and it signals to recruiters that the candidate can be trained. Accounting degrees dominate because they do the first two well and the fourth best; information systems degrees have grown because technology is now the largest part of most audit universes; the rest compete on the third and have to prove the first two.
The degree’s weight falls every year after the first job. At entry it is most of the evidence a recruiter has; at senior it competes with two years of files and a credential; at manager it is a line on the resume that nobody reads, because the CIA or CPA, the engagements run and the executives persuaded have replaced it. That is why the choice should be made for the first three years rather than for a career: pick the degree that gets the track you want, add the coursework the track needs, and plan the credential that will carry the weight afterwards.
The nine degrees, compared
The table ranks nothing, because the right degree depends on the track and the market. It gives what each teaches that the job uses, what it misses, the tracks it leads to and how a recruiter reads it on a resume.
| Degree | What it teaches that the job uses | What it misses | Tracks it leads to | How recruiters read it |
|---|---|---|---|---|
| Accounting | Financial reporting, internal control, auditing standards, the structure of a business in numbers | Technology, data, operations; the broader risk view | Generalist, financial reporting, SOX, financial services; the default route into every function | The safe hire; also the expected route to the CPA, which many functions value at manager level |
| Finance | Valuation, treasury, capital markets, financial risk, corporate finance | Controls and auditing method; accounting depth | Financial services, treasury and market risk audit, model risk | Strong for bank internal audit; needs evidence of controls aptitude for generalist roles |
| Business administration and management | Operations, strategy, organisational behaviour, process thinking | Depth anywhere; recruiters know it | Operational audit, process audit, later leadership | Credible with an accounting minor or concentration; weak without one |
| Information systems and MIS | Systems analysis, databases, networks, security, IT governance frameworks | Financial reporting; audit method | IT audit, cyber, application controls, the fastest-growing part of most universes | In demand; often the quickest route to a specialist title and higher pay |
| Computer science and cybersecurity | Programming, architecture, security engineering | Business and control context; writing for non-technical readers | Technical IT audit, cloud, security assessment, analytics | Valued where the function has a technical track; must show interest in control rather than engineering |
| Data science, statistics and analytics | Data handling, statistics, modelling, programming | Controls, accounting, the judgment the job needs | Audit analytics, continuous monitoring, model risk | Rare and wanted; functions building analytics teams hire these over accounting graduates |
| Risk management and insurance | Enterprise risk frameworks, risk assessment, insurance and hedging | Audit method; accounting depth | ERM-focused audit, insurance industry, risk functions | Good fit for the risk-based audit model; small program count limits supply |
| Economics | Analytical reasoning, markets, policy, quantitative method | Everything applied: accounting, systems, controls | Financial services, regulatory and policy audit, analytics with added training | Respected for rigour; needs accounting coursework or a CPA path to be competitive |
| Law and compliance | Regulation, contracts, evidence, written argument | Numbers, systems, testing method | Compliance audit, regulatory affairs, investigations, financial services | Strong for compliance tracks and investigations; unusual for entry-level generalist roles |
Two observations across the table. The degrees that lead to the broadest set of first jobs are accounting and information systems, which together account for most entry-level hiring. And the degrees that lead to the best-paid specialist tracks (data, technology, finance) require the holder to prove the control and evidence aptitude that an accounting graduate is presumed to have, which the coursework section addresses.
Degree by target track
Students who know which track they want can choose the degree and the minor for it. The table gives the combination that the track’s hiring managers look for and the first credential that confirms it.
| Track | Best degree | Minor or concentration that completes it | First credential | Where the first job usually is |
|---|---|---|---|---|
| Generalist internal audit | Accounting | Information systems or data analytics | CIA; CPA where the function values it | Corporate internal audit; the firms’ internal audit practices |
| Financial services internal audit | Accounting or finance | Economics, statistics or risk management | CIA; CPA; later FRM or CFA for treasury and market risk | Bank, insurer and asset manager audit functions; the financial services guide describes them |
| IT audit | Information systems | Accounting | CISA | Large functions with technology teams; the firms |
| Data analytics in audit | Data science, statistics or information systems | Accounting | CIA Part 3; tool certifications | Functions building analytics teams; often a lateral move after two years |
| Forensic and investigations | Accounting | Criminal justice, law or information systems | CFE after the experience requirement | Forensic practices, corporate investigations, government |
| Compliance and regulatory audit | Law, accounting or business with a compliance concentration | Finance | CIA; compliance credentials by industry | Financial services, healthcare, government |
| Public sector and performance audit | Public administration, accounting or economics | Statistics | CIA; CGAP or CGFM in the US | Government audit offices, inspectors general, public bodies |
The coursework that matters whatever the major
Recruiters read transcripts for a handful of courses, and a student in any major can take most of them. The list is what a hiring manager wants to see and why.
| Course | Why it matters to the job | Who should add it |
|---|---|---|
| Financial accounting and intermediate accounting | The language of every audit committee and the basis of financial process audits | Every non-accounting major; two courses minimum |
| Auditing or assurance | Evidence, testing, sampling and documentation, the method itself | Every major that offers it; the single most useful course for the first job |
| Accounting information systems | How transactions flow through systems and where controls sit | Accounting majors in particular, who otherwise learn systems on the job |
| Management information systems or database | Data structures, queries, access control | Accounting and business majors; the course that makes SQL learnable |
| Statistics | Sampling, analytics, model risk; the basis of population testing | Everyone; a second course in applied statistics for the analytics track |
| Business law or regulation | Contracts, compliance, evidence; the criteria for compliance audits | Technology and data majors |
| Writing-intensive courses | Findings and reports are the product; writing is the competency most often found weak | Everyone, and especially technology majors |
| Internal audit, where offered | The profession itself: the Standards, the risk-based model, the engagement cycle | Anyone at a university with the course; see the next section |
Undergraduate or master’s
An undergraduate degree with the right coursework and an internship gets the first job; a master’s is worth its cost in four situations and not otherwise. The table weighs the common programs.
| Program | When it pays | When it does not | Typical use |
|---|---|---|---|
| Master of accountancy (MAcc, MSA) | To reach the CPA education requirement where the state still requires 150 hours; to convert a non-accounting undergraduate degree | For an accounting graduate in a state with the bachelor’s-plus-experience pathway | The one-year bridge to the CPA and to the firms |
| Master of science in internal audit or in accounting with an internal audit track | At the universities with established programs, for the placement network as much as the content | Where the program is new or the network thin | Direct placement into large functions and the firms’ internal audit practices |
| Master of science in information systems, cybersecurity or analytics | To move into the IT audit or analytics track from an accounting or business background | For an information systems graduate who can get the same from a certification and a role | Mid-career specialisation |
| MBA | For leadership roles after five or more years; for a career changer entering through a top program’s recruiting | Early in a career, where it delays the experience the CIA and the job require | Director and chief audit executive paths; the chief audit executive guide weighs it |
| Master of laws or compliance master’s | For compliance and regulatory tracks in financial services and healthcare | For generalist audit | Compliance audit leadership |
Three tests settle whether a master’s is worth it for a given person. The placement test: does the program publish where its graduates go, and are internal audit functions and the firms’ internal audit practices on the list, or is the placement into accounting roles from which internal audit would be a second move? The credential test: does the program change the credential timeline, by meeting an education requirement or shortening an experience requirement, or does it only delay the experience? The cost test: tuition plus the salary forgone, against the pay difference the program’s graduates report in the first three years, which for most master’s programs in accounting is modest and for a strong internal audit program with a placement network can be large. A program that passes all three is a good decision; one that passes none is a year of deferred earnings with a diploma.
The experience requirement of every credential sets the trade-off: the CIA needs two years of experience with a bachelor’s degree and one with a master’s, so a one-year master’s and a year of work reach the same point as two years of work, at the cost of tuition and a year’s salary. The CIA versus CPA comparison and the certification roadmap set the sequence.
How the degree interacts with the CIA, CPA and CISA
The credentials have education rules of their own, and the degree choice should anticipate them. The certifications comparison covers the credentials in full; the table gives the education interaction.
| Credential | Education requirement | How the degree choice affects it | Timing |
|---|---|---|---|
| Certified Internal Auditor (CIA) | A bachelor’s degree or higher from an accredited institution (alternative routes exist for other qualifications and for long experience), plus two years of internal audit experience, reduced to one year with a master’s degree | Any degree qualifies; the master’s shortens the experience requirement by a year. Holders of qualifying accounting designations have the one-part challenge exam route | Start studying in the first year of work; the CIA exam hub has the material |
| Certified Public Accountant (CPA, United States) | Historically 150 semester hours including accounting and business coursework; since 2025 a growing number of states offer a bachelor’s degree plus two years of experience as an alternative pathway, with mobility rules evolving by state | An accounting degree is the natural route; non-accounting majors need the accounting coursework either way. Check the state board’s current rules before planning a fifth year | During or just after the first job for those on the accounting route |
| Certified Information Systems Auditor (CISA) | No degree requirement; five years of experience, with waivers of up to three years for degrees and other credentials | An information systems or related degree shortens the experience requirement | After two to three years in an IT audit role |
| Certified Fraud Examiner (CFE) | A bachelor’s degree and two years of related experience, with points for education and credentials | Accounting, criminal justice and law degrees all count | After the first investigations exposure |
Why internal audit is rarely taught, and where it is
Most business graduates meet internal audit for the first time in a job description, and the reasons are structural. Accounting departments teach external audit because the CPA exam tests it and the firms recruit for it; internal audit has no licensing exam that universities build curricula around, its employers are thousands of companies rather than four firms with campus recruiting machines, and its subject matter (risk, controls, governance, technology, operations) cuts across departments that each teach a fragment. The result is a profession that recruits people who discover it by accident, usually from public accounting after a few years, as the external-to-internal transition guide describes.
The exceptions are the universities in the IIA’s Internal Audit Education Partnership program, which designates schools with internal audit courses and tracks, from a single course to full master’s programs, and whose graduates enter the profession directly through the program’s employer networks. A student who wants internal audit from the start should look for one of those programs, or for an accounting or information systems program that offers the auditing and accounting information systems courses above and an internal audit internship, which large corporate functions and the firms’ internal audit practices offer every summer.
Students at universities without any internal audit teaching have three substitutes. The IIA’s student membership and local chapter give access to practitioners, events and the profession’s publications at little cost. The public audit reports of government audit offices and inspectors general are the most accessible examples of what the work produces: a reader who has studied ten of them knows more about findings, criteria and recommendations than most graduates. And an internship in any internal audit function, found through the chapter or by writing to the chief audit executive of a local company, substitutes for the course better than the course substitutes for the internship.
Presenting a non-traditional degree
Functions hire history, engineering, nursing and psychology graduates every year, usually into roles where the degree is the specialism (healthcare audit, engineering and construction audit, culture and conduct work). The resume has to do the translation the degree does not: the coursework or the self-study in accounting and systems, named; the evidence of analytical and written work (a thesis, a research project, a data project); any exposure to controls, compliance or audit in a previous job; and a reason for the move that is about the work. The internal audit resume guide gives the bullet formula, and the first credential (the CIA, or CISA for technology) removes the question within three years.
How recruiters screen degrees: the five questions
A degree is read in context: the same accounting transcript means one thing from a program whose graduates the function has hired before and another from one it has not, and the first hire from a new program carries the burden of proof for everyone who follows. That is not a reason to choose a program by brand; it is a reason to make the transcript answer the questions below so clearly that the program’s name does not have to.
Hiring managers and campus recruiters apply the same five questions to a degree, and a student who knows them can answer each on the resume. Does the transcript show accounting and auditing, whatever the major? Is there evidence of work with data: a statistics sequence, a database course, a project with a dataset? Is there writing: a thesis, a research paper, a writing-intensive course, anything that shows the candidate can produce a page an executive would read? Was there an internship or a job with exposure to controls, compliance, finance or systems, and can the candidate describe what they did with a number in it? And is there a reason for internal audit rather than accounting or consulting, which separates the candidates who found the profession from the ones who found the posting? A technology or data degree that answers the first and third questions beats an accounting degree that cannot answer the second and fourth.
What to do in each year of the degree
The degree is four years of choices, and the ones that matter for internal audit are listed by year. The plan assumes a US four-year program; three-year programs compress the first two years.
| Year | Coursework | Experience | Profession |
|---|---|---|---|
| First | Financial accounting; a statistics course; a writing-intensive course | A part-time job with any exposure to money, records or systems | Join the student chapter of the IIA or the accounting society; read one internal audit report (public sector audit offices publish theirs) |
| Second | Intermediate accounting; management information systems or database; business law | A summer role in finance, operations or IT at any organisation | Attend one IIA chapter event; ask an internal auditor what the week looks like |
| Third | Auditing; accounting information systems; the internal audit course if offered; a second statistics or analytics course | A summer internship in an internal audit function, a firm’s internal audit or risk practice, or a government audit office | Decide the track; sit the first CIA part if eligible under the student rules, or plan the CPA path |
| Fourth | Electives for the track (security, data, finance, compliance); a thesis or project with data and a written report | A second internship, or a part-time role in the function that may hire you | Apply from September; the resume guide and the interview guide are the preparation |
Degrees and routes outside the United States
The pattern is the same everywhere (an accounting or business degree, a professional credential, the CIA as the profession’s own mark) with national differences in the credential and in the route from school. The table gives the common routes in the markets this site’s readers most often ask about.
| Market | Common degree route | Professional credential route | Note |
|---|---|---|---|
| United Kingdom and Ireland | Accounting and finance, business, or any degree followed by a training contract | ACA, ACCA or CIMA, often earned in a firm, then a move to internal audit; the Chartered IIA’s own qualifications for those who start in internal audit; degree apprenticeships in audit at the large firms | Internal audit roles in financial services are supervised under the Senior Managers regime, and functions value the accounting credential at manager level |
| Canada | Accounting or business; co-op programs with audit placements | CPA Canada through the professional education program, then CIA | Co-op terms in internal audit functions are a direct route |
| Australia and New Zealand | Accounting, commerce or information systems | CA ANZ or CPA Australia, then CIA; CISA for technology | The IIA-Australia’s graduate programs place directly |
| India | B.Com, BBA or engineering followed by the CA, or an MBA | Chartered Accountancy (ICAI) is the dominant route; the CIA is growing in multinationals and shared-service centres | Internal audit at the large firms’ Indian practices is a common first job |
| Continental Europe | Business administration, economics or law | National accounting credentials, then the CIA through the IIA’s national institutes | Internal audit functions in banks and insurers are regulated and hire from risk and finance as well as accounting |
| Middle East and Africa | Accounting, finance or business, often from international programs | ACCA and CPA routes, then the CIA, which is widely recognised in government and large companies | Public-sector internal audit is a large employer in several countries |
Three composite paths
The paths below are composites of transitions seen across many functions, with no real individuals, each chosen for the decision that made it work.
| Path | Degree and coursework | First steps | Where it led |
|---|---|---|---|
| Accounting graduate to financial services audit manager | Accounting with an information systems minor; auditing, AIS and two statistics courses; a summer internship in a bank’s internal audit function | Hired into the bank’s audit rotation program; CIA at two years; moved to the treasury and ALM portfolio | Audit manager at seven years; the liquidity audit program was the first thing read on joining |
| Information systems graduate to IT audit senior manager | MIS with accounting coursework; a security elective; a co-op in an IT department | Hired by a firm’s IT audit practice; CISA at three years; moved in-house to a retailer’s technology audit team | Senior manager running application and cloud audits; the generalist skills added through two operational engagements |
| Economics graduate to audit analytics lead | Economics with applied statistics and a database course; a data project as a thesis | Hired as a financial analyst; moved into internal audit as a data specialist after building a monitoring routine for the audit team; CIA at four years | Analytics lead for a 40-person function; the SQL for auditors guide and the documenting analytics guide were the team’s standards |
Frequently asked questions
What degree do you need to be an internal auditor?
A bachelor’s degree in a business-related field is the usual requirement, and accounting is the most common, followed by information systems, finance and business administration. The job does not require a specific major: what it requires is the accounting and systems coursework, evidence of analytical and written ability, and later the CIA or another credential. Many functions hire from economics, data science, law and unrelated majors for specialist tracks.
Is accounting the best degree for internal audit?
It is the safest, because it teaches the language of every audit committee, the controls and auditing method, and leads to the CPA, which many functions value at manager level. It is not the only good one: information systems leads to the fastest-growing track and often to higher early pay, and data and finance degrees lead to well-paid specialisms. An accounting degree with a systems or data minor is the strongest combination for a generalist career.
Do I need a master’s degree for internal audit?
No. A master’s pays in four cases: to meet the CPA education requirement where the state still requires 150 hours, to convert a non-accounting degree, to enter through a university internal audit program with a strong placement network, or to specialise mid-career in technology or analytics. It shortens the CIA experience requirement from two years to one. An MBA pays later, for leadership roles, not at entry.
Can I become an internal auditor without an accounting degree?
Yes, and many do: information systems, finance, data science, economics, law and unrelated majors all enter, usually into the track where the degree is the specialism. Add the accounting and auditing coursework (two accounting courses and an auditing course at minimum), present analytical and written work on the resume, and earn the CIA or CISA within three years, after which the degree question disappears.
What is the best degree for IT audit?
Information systems or management information systems, with accounting coursework and a security elective, followed by the CISA after the experience requirement. Computer science and cybersecurity degrees also lead there for the technical track, provided the candidate shows interest in control and in writing for non-technical readers rather than in engineering alone.
Which universities teach internal audit?
The universities in the IIA’s Internal Audit Education Partnership program, which designates schools offering internal audit courses, concentrations and master’s programs with employer networks that place graduates directly. Outside those programs, look for an accounting or information systems program that offers auditing, accounting information systems and an internal audit internship.
Does the CPA still require 150 hours?
In many states, but the rule is changing: since 2025 a growing number of states offer a bachelor’s degree plus two years of experience as an alternative pathway, and the mobility rules between states are being revised. Check the state board’s current requirements before planning a fifth year or a master’s solely for the hours.
How should I choose between accounting and information systems?
By the track you want and the market you are in. Accounting leads to the broadest set of first jobs, to the CPA and to generalist and financial services careers; information systems leads to IT audit, which is the largest growth area in most functions and often pays more early. The combination (either major with the other as a minor) is better than either alone, and both lead to the CIA.
Related guides
- Internal Auditor Skills — the twelve competencies the degree has to lead to
- Internal Audit Interview Questions — what recruiters test at entry
- Internal Audit Resume Guide — presenting coursework and projects
- Your First 90 Days as a Staff Internal Auditor — what happens after the degree
- Internal Audit Certifications Compared — CIA, CPA, CISA, CFE and the rest
- CIA vs CPA — which credential first
- A Certification Roadmap by Career Stage — what to earn when
- The CIA Challenge Exam — the accelerated route for accounting designation holders
- From External Audit to Internal Audit — the route most accounting graduates take
- Is Internal Audit Accounting? — how the two fields differ and overlap
- A Day in the Life of an Internal Auditor — what the job looks like at each level
- Career Growth category — every careers guide in one archive
Leave a Reply