Internal Audit Career Path: Staff to CAE, Level by Level

Internal audit has one of the clearest career ladders in corporate life and one of the least explained. Job titles vary by employer, the same word means different things in a bank and a manufacturer, and the promotion criteria are rarely written down, so most auditors discover what the next rung requires by watching who gets promoted and guessing. This guide writes it down. It maps the ladder from staff auditor to chief audit executive, level by level: what each role owns, what it is judged on, how long people typically spend there, what the promotion signal is, and the deliberate move that sets up the next step. It then shows where ladders differ, in flat functions, in banks with officer grades, in professional services, and in co-sourced arrangements, and closes with a composite fifteen-year career walked rung by rung. Pay bands are from the Robert Half 2026 salary guide for US starting salaries and are read with the method in the internal auditor salary guide.

The ladder is drawn for an in-house function of roughly eight to fifty people, which is where most of the profession works and where every rung exists. Smaller functions compress it, larger ones and banks add grades, and the section on variants translates. Throughout, the roles are described by what they own, because that is what changes at each step; the titles are a local convention, and the by-role guides on the Internal Audit by Role hub go deeper on each seat.

In this guide

The ladder at a glance
Staff and senior: learning the craft, then owning it
Lead and manager: owning the engagement, then the people
Senior manager and director: owning the plan and the relationships
The leadership layer: chief audit executive and beyond
Where ladders differ: flat shops, bank grades, professional services, co-source
Tenure, promotion criteria and the move that is not a promotion
The promotion conversation: how to have it a year early
The deliberate move at each stage
A composite career, rung by rung
Related guides

The ladder at a glance

Seven rungs cover the profession. Each row of the table gives the titles the rung goes by, what the role owns, the typical years spent there before the next step, the signal that promotion is due, and the 2026 US starting-salary range where Robert Half publishes one. The years are typical, not required; the profession has senior auditors of thirty and directors of thirty-two, and it has excellent staff auditors who chose to stay staff auditors.

Rung	Titles it goes by	What the role owns	Typical years	The promotion signal	2026 US starting salary (Robert Half)
1. Staff auditor	Staff auditor, associate, auditor I, internal auditor, analyst	Assigned test steps and the workpapers that evidence them	2 to 3	Workpapers pass review with few notes; can run a process walkthrough alone; asks the right questions of the auditee	68,750 / 85,750 / 99,750 (low, middle, high)
2. Senior auditor	Senior auditor, auditor II or III, senior associate, assistant vice president in banks	A section of an engagement end to end: planning the tests, executing, drafting findings, coaching a staff auditor	2 to 3	Findings hold up in the closing meeting without the manager; can scope a section from a risk assessment; staff want to work for them	89,750 to 121,750
3. Lead or in-charge	Audit lead, in-charge, supervising senior, audit supervisor, senior auditor II, vice president in some banks	The whole engagement: scope, budget, team, auditee relationship, the draft report	1 to 3 (often a stage within senior)	An engagement delivered on budget with a report that needed little rewriting; the manager was informed, not needed	Overlaps senior and manager bands
4. Audit manager	Audit manager, manager, vice president in banks	A portfolio of engagements at once, the people on them, the quality of what goes to the director, the relationship with a set of auditee executives	3 to 5	Manages three engagements in parallel without any of them slipping; develops seniors into leads; the executives ask for them by name	115,500 to 157,750
5. Senior manager	Senior audit manager, senior manager, director in some banks, head of a coverage area	A coverage area of the audit universe: its risk assessment, its plan, its team, its findings trend, its executives; the methodology in that area	3 to 5	Owns a piece of the audit committee narrative; managers are developed and retained; the area’s plan is defended on evidence	Between manager and director bands
6. Director or head of audit	Audit director, head of internal audit (reporting to a CAE), managing director in banks, deputy CAE	The plan across several areas, the budget, the quality program, the co-source relationships, the function’s operating model; stands in for the CAE	3 to 7	Trusted by the committee in the CAE’s absence; runs the function’s operations; the succession candidate	142,000 to 228,500
7. Chief audit executive	Chief audit executive, general auditor, chief auditor, head of internal audit (reporting to the board)	The function: its mandate, independence, strategy, plan, resources, quality and reputation; the board relationship	5 to 10, often the last role	Not a promotion signal but an appointment: the board chooses, per the essential conditions in the Standards	Set by the board; above the director band, widely dispersed

Two observations about the shape. The ladder narrows sharply above manager: a function of thirty people has perhaps ten staff, ten seniors, five managers, three senior managers, one or two directors and one CAE, so from manager upward, promotion increasingly means waiting for a seat or changing employer, which is why the guide on exit opportunities is read most by managers. And the job changes in kind, not degree, at two rungs: senior to lead, where the auditor stops doing the work and starts being responsible for it, and manager to senior manager, where the auditor stops being responsible for engagements and starts being responsible for a slice of the organisation’s risk. People who are excellent one rung below each of those transitions are often unhappy one rung above, and the sections that follow are mostly about those two shifts.

Staff and senior: learning the craft, then owning it

The staff auditor’s job is to produce evidence that someone else can rely on without redoing it. That sounds modest and takes two years to learn properly, because it means understanding a process well enough to know what a control is for, selecting and executing a test so that the workpaper answers the question, writing the workpaper so a reviewer can follow it cold, and doing all of that inside a budget. The measures are concrete: review notes per workpaper falling from the dozens to a handful; walkthroughs the staff auditor can run alone, asking the questions in the workpaper example rather than reading them from a list; and the moment, usually somewhere in the second year, when a senior hands over a section and does not check every step. The first ninety days of that journey are mapped in the new staff auditor’s guide; the standards a workpaper has to meet are in workpaper best practices.

The senior auditor owns a section, which changes the question from “did I do the step” to “did we answer the objective”. The senior plans the tests for the section from the risk assessment, decides sample sizes, executes the difficult steps and delegates the routine ones, drafts the findings, and defends them to the auditee’s manager before the manager ever sees them. The promotion signal is the closing meeting: a senior whose findings survive the auditee’s pushback on the evidence alone, without escalation, is ready for the next rung, and one whose findings are routinely softened by the manager is not. The senior is also the first rung with a people component, coaching one or two staff auditors, and the reputation that follows a senior up the ladder is set here: seniors that staff auditors ask to work for are the ones who get the lead roles, because the manager needs engagements to run and knows who can run them. The writing discipline that separates strong seniors from adequate ones is the finding structure in the 5 Cs of audit findings, learned until it is automatic.

Lead and manager: owning the engagement, then the people

The lead, or in-charge, is the first rung at which the auditor is responsible for something they do not personally do. The lead owns the engagement: the scoping memo, the budget, the team’s allocation, the auditee relationship from opening to closing meeting, the workpaper review of the staff and seniors, and the draft report that goes to the manager. The shift is uncomfortable for the people who were best at the previous rung, because the instinct to redo a weak workpaper is now a failure of the role; the lead’s job is to make the senior’s workpaper good by review and coaching, and to report the engagement’s status truthfully upward when it is slipping rather than working weekends to hide it. Leads are judged on delivery against budget, on the quality of the report as received by the manager, and on whether the auditee would have them back. In many functions “lead” is a stage within the senior grade rather than a title, and the manager decides who is ready for it by giving them an engagement and watching.

The audit manager owns several engagements at once and, more importantly, the people running them. A manager’s week is review, coaching, the difficult conversations with auditee executives that leads cannot yet have, and the constant reallocation of a team across engagements that never go to plan; the craft is now judgment about what to review closely and what to let go, which reports need rewriting and which need a sentence, which finding to escalate and which to let the lead resolve. Managers are judged on their portfolio’s delivery, on the quality of what reaches the director, on how their seniors develop, and on whether the executives in their patch trust them. The failure mode is the manager who remains a lead, reviewing every workpaper, rewriting every report, and unable to run more than one engagement at a time; the guide on inside the internal audit department shows the manager’s seat from the function’s point of view.

Senior manager and director: owning the plan and the relationships

The senior manager owns a coverage area, which is the second change in kind. The senior manager for treasury, or technology, or the retail business, owns that area’s risk assessment, its share of the annual plan and the argument for it, its team, its findings trend over years, and its executives, the ones the manager escalates to and the ones who call the senior manager when something goes wrong before an audit is scheduled. Success is measured over years rather than engagements: whether the area’s plan was the right plan in hindsight, whether the findings led to change, whether the area’s managers developed and stayed, and whether the senior manager’s section of the audit committee pack is the one the committee asks about. The methodology for the area often lives here too, the test programs and the specialist knowledge, which is why senior managers are the rung most likely to hold a second credential, the CISA for technology or the CFE for fraud-heavy areas, as the roadmap in certifications by career stage sets out.

The director, or head of audit reporting to a CAE, owns the plan across areas and the function’s machinery: the budget, the resourcing model, the co-source relationships, the quality program and the external assessment, the methodology, the audit management system, and the reporting to the committee that the CAE presents. The director stands in for the CAE and is usually the succession candidate, which means the role is judged as much on the committee’s confidence as on operations. The transition to director is the one most senior managers underestimate: the work shifts from a domain the director knows deeply to a function the director must run, including the areas they never audited, and the relationships shift from executives to the board. Directors who succeed are the ones who spent their senior manager years learning how the whole function works rather than only their area, and who can present to a committee in the register described in the audit committee presentation template.

The leadership layer: chief audit executive and beyond

The chief audit executive is not the top of the ladder so much as a different ladder. The CAE is appointed by the board, reports functionally to it, owns the function’s mandate, independence, strategy, plan, resources and quality, and is evaluated by the audit committee against the essential conditions the Standards now set out. The job is mostly relationships and judgment: what to audit, what to escalate, what to say to the committee and how, whom to hire and whom to move on, when to accept management’s risk acceptance and when to record it and disagree. Almost nothing a CAE does in a week resembles what a senior auditor does, which is why the best fieldwork auditors are not automatically the best CAEs and why the first ninety days in the role, mapped in the new CAE’s guide, are a distinct discipline. Beyond the CAE, the ladder forks: a larger CAE role, a chief risk officer or chief compliance officer seat, a board or audit committee position after retirement, or a portfolio of advisory and committee roles. The exit routes at every rung, with their translations and their compromises, are the subject of the exit opportunities guide.

Where ladders differ: flat shops, bank grades, professional services, co-source

The seven-rung ladder is the reference; four common settings bend it, and knowing which one you are in explains a great deal about titles, pace and pay. The table translates the rungs into each setting and names the trap each setting sets.

Setting	How the ladder maps	What is different	The trap
Flat function (one to eight people)	Staff, senior, and the head of audit; the manager rung exists only as the head’s deputy, if at all	Everyone does everything; a senior scopes, tests, writes and presents; breadth comes early, depth and people management come late	Titles inflate (a senior called a manager) and do not translate outside; the head of audit seat may never open
Banks and large financial institutions	Officer grades overlay the rungs: associate or analyst, assistant vice president (senior), vice president (lead or manager), director or senior vice president (senior manager or director), managing director (director or CAE)	Grades are pay bands as much as roles, and promotion between them can be a title change with the same work; coverage areas are specialised (credit, treasury, technology, compliance); regulators know the function’s leaders by name	Mistaking grade progression for role progression; a VP who has never run an engagement end to end is common and exposed on leaving
Professional services (co-source and advisory practices)	Associate, senior, manager, senior manager, director, partner; the manager rung arrives faster, often at year four or five	Faster promotion, broader client exposure, heavier hours, sales expectations from senior manager upward; methodology is the firm’s	Leaving for in-house at senior manager and discovering that the in-house equivalent is manager, because the firm’s title ran a rung ahead
Co-sourced or outsourced in-house seat	A head of audit or a small in-house core managing an external provider that supplies the rungs below	The in-house role is management of the provider, the plan and the committee; the craft rungs are outside	The in-house head loses fieldwork currency and the provider’s staff never learn the organisation; both are addressed by the arrangement described in co-sourcing vs outsourcing

Tenure, promotion criteria and the move that is not a promotion

The typical years in the table add up to somewhere between twelve and twenty years from staff auditor to director, and the range is wide because the ladder is climbed at very different speeds by people who are equally good. Three things set the pace. Function size, because the seats above manager have to exist and be vacated. Breadth, because a senior manager needs to have seen more than one coverage area and the auditors who rotate deliberately arrive at the senior manager rung with the range it needs. And the external move: as the salary guide explains, the merit cycle lags the market and the promotion queue lags the ladder, and the auditors who move employers every three to four years in their first decade usually reach manager and senior manager sooner and better paid than those who wait, at the cost of the institutional knowledge that makes the director and CAE rungs possible. The pattern most careers follow is two or three moves in the first ten years and then a long tenure where the senior seats are.

Promotion criteria are rarely written but are consistent enough to state. Below manager, the criterion is craft plus reliability: the work is right, on time, and needs less review each year. At manager, it is delivery plus people: the portfolio lands and the seniors grow. At senior manager, it is judgment plus relationships: the plan is right and the executives trust the person. At director and beyond, it is the committee’s confidence, which is built over years of being right in front of it. What is not a criterion, at any rung, is years served, and the auditor who cites tenure in a promotion conversation has usually lost it. One more move belongs here because it is not a promotion and is often mistaken for a demotion: the lateral into the business, a second-line risk role or a compliance role for two or three years, and back. For the senior manager and director rungs it is frequently the making of the candidate, because it produces exactly the breadth and the executive relationships those rungs are judged on.

The promotion conversation: how to have it a year early

Because the criteria are unwritten, the most useful conversation in an internal audit career is the one that writes them down, and it should happen a year before the promotion is wanted rather than in the appraisal where it is decided. The form is simple. Ask the manager, or the director, what the next rung is judged on in this function, in their words; write it down; ask which of those things they have seen from you and which they have not; and agree what evidence would show the missing ones over the next year, with names of engagements where it could be produced. Then produce it. The conversation does three things at once: it turns a vague hope into a checklist the manager has co-authored, it tells the auditor early if the seat above is not going to open so that the external or lateral move can be planned rather than forced, and it makes the eventual promotion case a matter of record rather than advocacy. Auditors who have this conversation are promoted sooner not because they lobbied but because they stopped guessing; the ones who wait for the appraisal learn the criteria in the same sentence that tells them they did not meet them.

The deliberate move at each stage

Careers are shaped less by promotions than by a handful of deliberate choices made a rung early. The table gives the move that sets up each transition, the reason, and the timing; each is something the auditor can do without anyone’s permission.

At this rung	The deliberate move	Why it works	When
Staff	Pass the CIA, or at least Part 1, and ask for the engagement types you have not seen	The credential removes the first filter; breadth at staff level is cheap and later becomes expensive	Months 6 to 24
Senior	Take the lead on a small engagement before the title exists; learn one specialism (technology, fraud, a regulated domain) to working depth	Leads are chosen from seniors who already behave like leads; a specialism is what senior managers are built from	Year 2 of senior
Lead	Run the closing meeting and the executive conversation yourself; write the report the manager does not rewrite	The manager rung is about executives and quality; both are demonstrated here or nowhere	Every engagement
Manager	Consider the external move if the queue above is static, and the lateral into the business if the ladder is long; develop two seniors into leads	The narrow ladder above manager rewards breadth and mobility; people development is the senior manager’s evidence	Year 3 of manager
Senior manager	Learn the whole function: the budget, the quality program, the committee pack; present a section to the committee	Directors are judged on the committee and the function, not on the area	Year 2 of senior manager
Director	Take the CAE seat somewhere smaller, or become the deputy who stands in; build a board-level network	The CAE role is an appointment by a board that has to know you; the first CAE seat is usually a smaller one	Year 3 of director
CAE	Decide the next fork early: bigger CAE seat, chief risk or compliance seat, or the portfolio life; keep an area of personal technical depth	CAE tenures end, often on a board’s timetable; the options are built before they are needed	Year 3 of CAE

A composite career, rung by rung

The career below is a composite, assembled from the shape most successful internal audit careers share rather than from any one person, and it is written to show the timings, the moves and the moments where the job changes in kind. It follows an auditor who joins a mid-sized manufacturer’s function of twelve from a graduate program and ends, fifteen years later, as a chief audit executive.

Years one and two are staff. The first ninety days are spent not understanding what a control is for and being told, correctly, that this is normal; by month six the workpapers come back with a handful of notes rather than a page, and by the end of year one the auditor runs walkthroughs alone. CIA Part 1 is passed in month nine on the employer’s reimbursement, Parts 2 and 3 by the end of year two. A request to be put on the technology and the plant audits, rather than the finance ones the auditor came from, is granted because nobody else asked. Promotion to senior comes at the start of year three, with a raise that the auditor later learns was well under the market for the role.

Years three to five are senior, and the second half is lead in all but title. The auditor owns sections, then engagements: a procurement audit that produces the function’s first data-analytics finding, an inventory audit at the largest plant that the plant manager tries to soften in the closing meeting and cannot, because the counts were the auditor’s own. The manager hands over the annual plant audit as a lead in year four and stops attending the closing meetings in year five. The auditor takes the CISA in year four, having become the person the function sends to the ERP audits, and sits on a cross-functional ERP upgrade project as the audit observer, which is where the executives first learn the auditor’s name. At the end of year five, with the manager seat occupied by someone eight years from retirement, the auditor moves to a regional bank’s audit function as an assistant vice president, a title that maps to senior and pays like the manager seat that was not available.

Years six to nine are the bank. The move costs the plant knowledge and buys a coverage area: the bank puts the auditor on technology and operations, where the CISA and the ERP experience are immediately useful, and promotes to vice president, the bank’s manager grade, in year seven. The auditor runs four engagements at a time, develops two seniors into leads, and has the first real difficult conversation with an executive, a chief information officer who disputes a High finding on privileged access and loses on the evidence. In year eight the auditor takes a two-year lateral into the bank’s second-line operational risk function, a move the audit director suggests and the auditor initially reads as a demotion; it is where the auditor learns how the business makes risk decisions and meets every executive in the bank in a role that is not adversarial. The auditor returns to internal audit in year ten as a senior manager owning technology and operational risk coverage, a rung that would have taken three more years by promotion.

Years ten to thirteen are senior manager. The area’s plan is the auditor’s, defended to the committee in a section of the pack the auditor presents personally from year eleven, and the findings trend over three years is the area’s story, which the committee chair remembers. The auditor learns the whole function deliberately: sits in on the budget, runs the internal quality assessment for a year, and manages the external assessment in year twelve when the director asks. Promotion to director follows in year thirteen, when the incumbent leaves for a CAE role elsewhere, and the auditor becomes the deputy who stands in for the CAE, presenting to the committee in the CAE’s absence twice in the first year.

Year fifteen is the first CAE seat, at a smaller bank whose audit committee chair sat on a panel with the auditor two years earlier and remembered. The seat is smaller than the director role in headcount and larger in every other way, and the first ninety days follow the arc described in the CAE guide: reading, listening, a health check against the Standards, the report to the committee that asks for a charter, a private session and one more auditor. Fifteen years, three employers, two credentials, one lateral, and every transition where the job changed in kind made deliberately and a rung early. It is not the only shape a good career takes, but it is the commonest.

Comments

Leave a ReplyCancel reply

Financial Statement Fraud: How the Numbers Get Cooked, and Who Should Catch It

Procurement Fraud Schemes: Bid Rigging, Kickbacks and Phantom Vendors, and How to Find Them

When Internal Audit Finds Fraud: The First 48 Hours Protocol

The Field Desk Series

The Internal Audit Career Ladder: Staff to CAE, Level by Level