In an internal audit function of 300 or 800 people, the chief audit executive cannot own every relationship, every regulator conversation or every audit universe. Between the CAE and the audit directors sits a layer that most career guides never name: the portfolio heads, divisional chief auditors and heads of audit for a business line or region, usually at managing director grade, who own a pillar of the organisation’s audit universe end to end. In a large bank there may be eight or twelve of them; in a global insurer or a diversified industrial, three or six. It is the most demanding seat in the profession below the CAE, the one most people aiming for the top job must pass through, and the least described. This guide sets out what the role owns, how the matrix with central methodology works, what regulators expect of the person in banks, the stature the seat requires with divisional chief executives, and the path from it to group CAE.
In this guide
- The leadership layer, located
- What a divisional chief auditor owns
- The matrix: business alignment vs central methodology
- The regulator-facing role in banks
- Stature with the divisional CEO
- Running a portfolio team of forty to two hundred
- How the role goes wrong
- The path in, and the path to group CAE
- Worked example: the capital markets chief auditor at a universal bank
- Frequently asked questions
- Related guides
The leadership layer, located
Titles vary by firm, which is one reason the layer is hard to see from outside. The By Role hub maps the grades across sixteen firms; the summary below places the divisional chief auditor in the ladder that large financial institutions use, with the corporate equivalents alongside.
| Rung | Typical grade (bank) | Typical title variants | Scope marker | Corporate equivalent |
|---|---|---|---|---|
| Chief audit executive | Group executive / executive committee member or direct report | Group Chief Auditor, General Auditor, Head of Internal Audit | The whole function; the group audit committee; the lead regulator | VP or SVP Internal Audit, CAE |
| Deputy CAE / Audit COO | Managing director | Deputy Chief Auditor; Chief Operating Officer, Internal Audit | The function’s operations, methodology, quality, people and reporting; stands in for the CAE | Deputy CAE; Director of Audit Operations |
| Divisional chief auditor / portfolio head | Managing director | Chief Auditor, Corporate & Investment Bank; Head of Audit, Consumer; Regional Head of Audit, EMEA; Head of Technology Audit | A business pillar’s or region’s entire audit universe; its divisional CEO and risk committee; its regulators | Senior director or VP for a business segment in large industrials; rare below $20 billion revenue |
| Senior director / head of audit for a sub-business | Executive director / SVP | Audit Director, Rates and FX; Senior Audit Director, Payments | A sub-portfolio; a set of audit directors; a named executive relationship | Senior director |
| Audit director | Director / VP | Audit Director; Senior Audit Manager (in some firms) | A team and a slice of the universe; delivers the plan | Director |
Two features distinguish the divisional chief auditor from the senior director below. The first is completeness: the role owns a whole pillar (the investment bank, the retail bank, the asset manager, a region) rather than a slice, so that the divisional CEO has one audit counterpart. The second is external exposure: in banks the role meets the regulators that supervise that pillar and answers for the function’s coverage of it. A senior director may be brilliant and still never sit alone with a supervisory team; a divisional chief auditor does so routinely. The career ladder guide describes the rungs below; this layer is where the ladder becomes a leadership job.
What a divisional chief auditor owns
The seat is best understood as a CAE role for one pillar, operating inside a group function. Seven things are owned, and the owner is accountable for them to the group CAE, to the divisional CEO and risk committee, and in banks to the supervisors.
| Owned | What it means in practice | Who holds the divisional chief auditor to it |
|---|---|---|
| The pillar’s audit universe and risk assessment | Every auditable entity in the division identified, rated and cycled; refreshed for new products, acquisitions and reorganisations; see the bank audit universe | Group CAE; regulators who test universe completeness |
| The pillar’s audit plan and its delivery | Perhaps 60 to 200 engagements a year; plan completion, timeliness and budget variance are the divisional chief auditor’s numbers | Group CAE; the group audit committee through the CAE |
| The opinion on the pillar’s control environment | An annual or quarterly rated opinion on the division, built from the engagements and the issue population; the thing the divisional CEO and the regulators most want | Divisional CEO and risk committee; group audit committee; regulators |
| The issue population | Hundreds of open issues; ageing, re-dates, risk acceptances, thematic view; the escalation of what will not close | Divisional CEO (owner of remediation); group CAE |
| The regulatory relationship for the pillar | Exam meetings, information requests, MRA validation, continuous supervision contacts; see MRAs and MRIAs | Regulators; group CAE; the chief risk officer indirectly |
| The team | Forty to two hundred auditors across several locations; hiring, development, specialist capability (products, technology, quantitative) | Group CAE and audit COO |
| The relationship with the divisional executive | A standing counterpart to the divisional CEO, CFO, COO and CRO; present at the divisional risk committee | Divisional CEO; group CAE |
The opinion is the output that defines the seat. A divisional chief auditor who can state, with evidence, that the investment bank’s control environment is adequate with three named exceptions, and defend that statement to the divisional CEO who disagrees and the supervisor who is sceptical, is doing the job. One who can only report plan completion is an audit director with a bigger team. The quarterly pack guide shows how the opinion is built from the four committee questions at function level; the divisional version is the same structure for one pillar.
The matrix: business alignment vs central methodology
Large functions are organised as a matrix, and the divisional chief auditor sits at its most contested intersection. The vertical line runs from the auditor through the audit director to the divisional chief auditor to the group CAE: the business-aligned line that owns coverage of a pillar. The horizontal lines run from the centre: methodology, quality assurance, professional practices, data and analytics, reporting, and increasingly the specialist practices (technology audit, model audit, credit review) that serve every pillar. The role’s daily work is negotiating between the two.
| Decision | Business-aligned line (divisional chief auditor) owns | Central function owns | Where it is contested |
|---|---|---|---|
| What to audit | The pillar’s risk assessment and plan | Group-wide thematic reviews; the plan methodology; the group risk assessment framework | Group themes imposed on a pillar plan without capacity |
| How to audit | Engagement judgment: scope, sampling, rating within the methodology | The methodology, templates, rating scale, quality standards | A pillar that wants to deviate for product-specific reasons |
| Who audits | Hiring and assignment within the pillar team | Specialist practices allocated across pillars; headcount budget | Technology audit hours never sufficient for any pillar |
| How quality is assured | First and second review; the pillar’s own quality | Independent QA reviews; the QAIP; the external assessment | QA findings about a pillar’s engagements |
| What is reported | The pillar opinion and its divisional reporting | Group audit committee pack; group-wide metrics; regulatory submissions | Consistency of ratings across pillars |
| Issue management | The pillar’s issue population and escalation | The issue methodology, tracking system and group ageing reports | A pillar’s issue closure rate compared with its peers |
Two postures fail. A divisional chief auditor who treats the centre as overhead and runs the pillar as a private function produces inconsistent ratings, QA findings and a group CAE who cannot aggregate; eventually the regulator notices that the investment bank’s Mediums look like the retail bank’s Highs. A divisional chief auditor who defers to the centre on everything produces a pillar plan that misses what is specific to the business, which is the thing the seat exists to catch. The working posture is to own the judgment and adopt the method: argue for a methodology change through the professional practices group, and apply the current methodology faithfully while the argument is heard. The methodology manual guide shows what the centre is maintaining; the divisional chief auditor’s job is to make it work on products the manual’s authors have never seen.
The specialist practices are the matrix’s sharpest edge. Technology, model and quantitative audit capability sits centrally because no pillar can staff it alone, and every pillar needs more of it than it gets. The divisional chief auditor who gets the hours is the one whose plan states the risk in the specialists’ language and whose team can scope the work so that the specialists’ time is spent on judgment rather than on learning the business. That is a negotiation skill, exercised quarterly, and it is one of the seat’s least visible and most consequential activities.
The regulator-facing role in banks
In a supervised bank the divisional chief auditor is a named counterpart for the supervisory teams that cover the pillar: the capital markets examiners for the investment bank, the consumer compliance team for the retail bank, the host regulators for a region. The supervisors use internal audit’s coverage as an input to their own risk assessment, test the function’s independence and competence as part of governance reviews, and expect the person in the seat to know the pillar’s control environment better than anyone who is not running it. The expectations are specific and the consequences of failing them are visible to the board.
| Supervisory expectation | What the divisional chief auditor must be able to do | What supervisors test | Reference points |
|---|---|---|---|
| Universe completeness | Show that every material activity in the pillar is in the universe, rated and cycled; explain the ones not audited recently | Reconcile the universe to the pillar’s legal entities, products and systems; probe new activities | Interagency supervisory guidance on internal audit; the banking guide |
| Risk-based coverage | Defend the plan’s allocation against the pillar’s risk profile; explain deferrals | Compare coverage with the supervisors’ own view of risk; ask about the trading desk that was not audited in three years | Standard 9.4; supervisory letters |
| Independence and stature | Demonstrate access, escalation and the ability to issue unsatisfactory reports about the divisional CEO’s business | Interview the divisional CEO about audit; read escalation records; look for softened ratings | Standard 7.1 and the charter |
| Issue validation | Show that the function validates remediation of supervisory findings independently and rigorously | Re-test closed MRAs; examine the validation workpapers | See the MRA lifecycle and issue validation guides |
| Competence | Show that the team can audit the pillar’s products: derivatives, structured finance, model-heavy activities | Review engagement quality; ask technical questions; examine staff credentials and training | Standards 3.1 and 10.2 |
| Candour | Tell the supervisors what the function actually thinks, including about management | Compare what audit says privately with what it reports; watch for management-scripted answers | The supervisory relationship itself |
The seat’s regulatory exposure is also its political exposure. A divisional chief auditor who tells the supervisors that the investment bank’s trade surveillance is inadequate has said something the divisional CEO will hear within hours, and the consequence of saying it is the supervisors’ continued trust, which is worth more to the bank than the CEO’s comfort. Divisional chief auditors who survive and are promoted are those who have said such things carefully, with evidence, after telling the divisional CEO first, and who have been backed by the group CAE when the CEO complained. The what regulators expect and supervisory findings guides describe the regulators’ side of the relationship.
Stature with the divisional CEO
The divisional CEO of an investment bank or a consumer bank runs a business with its own P&L, often larger than most listed companies, and is used to counterparts at their own level. The divisional chief auditor has to be one, and the stature is earned the way the trusted advisor guide describes at function level, compressed and at higher stakes.
| Stature marker | What it looks like | How it is earned | How it is lost |
|---|---|---|---|
| Direct access | A standing one-to-one with the divisional CEO; a seat at the divisional executive and risk committees | Negotiated at appointment; maintained by being useful in the room | Being briefed through the CFO; missing meetings |
| First call on bad news | The CEO or COO calls the divisional chief auditor when something breaks, before the regulator does | Reliability over years; a record of handling bad news without ambush | One finding that reached the group committee before the CEO knew |
| A view that changes decisions | The CEO defers a product launch or a system cutover on the divisional chief auditor’s stated concern | Insight delivered with evidence; no reflexive objection | Objecting to everything; being wrong once, loudly |
| Equal footing in disagreement | The CEO disputes a rating in the risk committee and loses, civilly | The group CAE’s visible backing; the rating rule applied consistently | A softened rating that the regulator later overturns |
| Knowledge of the business | The CEO does not have to explain the product | Years in or around the pillar; a team with product fluency | A team of generalists auditing structured products |
| Presence | The CEO’s direct reports treat the divisional chief auditor as a peer, not as a visitor | Grade, conduct and the CEO’s own example | The CEO treating audit as a compliance cost in front of the executive team |
Grade matters here, which is why the seat is at managing director level in banks. A divisional CEO deals with managing directors as peers and with executive directors as staff, and an audit counterpart below the MD line is structurally a visitor. Functions that have tried to run the layer at a lower grade to save cost have usually found the stature gap showing up in softened ratings and surprised committees, and have regraded the seat. The becoming a CAE guide describes how group CAEs earn the equivalent standing with the group CEO; the divisional version is the same relationship one level down, with the added complication that the divisional CEO is also, in a sense, the auditee.
Running a portfolio team of forty to two hundred
The divisional chief auditor runs a function inside a function: several audit directors, a specialist mix, often multiple locations and time zones, a budget in the tens of millions, and a plan of a hundred or more engagements. The management disciplines are those of a CAE at smaller scale, and the portfolio guide’s mechanics apply one level up: the directors run portfolios; the divisional chief auditor runs a portfolio of portfolios.
- A leadership team, not a span. Four to eight audit directors who own sub-portfolios, meet weekly as a team, and are developed as successors; the divisional chief auditor should be able to name two people who could do the job.
- Product capability as a deliberate build. A capital markets audit team needs people who have traded, structured or risk-managed the products; a consumer team needs people who understand collections, underwriting and conduct. The hiring mix is a strategic choice, not an HR process.
- Location and regulatory footprint. A regional head carries host-regulator relationships and local governance requirements; a product head carries global product risk across locations. The plan is built with both axes in view.
- Quality as a pillar metric. QA results, rating consistency and timeliness reported for the pillar against the function’s other pillars; the divisional chief auditor owns the comparison.
- Thematic insight as the differentiator. Across a hundred engagements the pillar’s systemic problems become visible: the same control weakness in six desks, the same data lineage gap in three systems. Reporting the theme, not the hundred findings, is what the divisional CEO and the group committee value most; the KPIs guide includes the measures that track it.
- Succession as a duty. The layer is the group CAE’s succession pool, and the divisional chief auditor’s own succession pool is the senior director layer; both are managed explicitly in functions that do this well.
How the role goes wrong
| Failure | Symptom | Cause | Consequence |
|---|---|---|---|
| Capture by the division | Ratings softer than other pillars’; issues re-dated without escalation; the CEO never surprised because nothing hard is reported | Proximity, shared incentives, the CEO’s charm | The regulator finds what audit did not; the group CAE loses confidence; the seat is refilled |
| Private function syndrome | Methodology deviations; QA findings; ratings the centre cannot reconcile | Treating the centre as overhead | Group reporting breaks; the regulator questions consistency |
| Plan delivery without opinion | Excellent completion metrics; no stated view on the pillar’s control environment | Managing to the numbers the group tracks | The divisional CEO and the regulator get nothing they could not get from a tracker |
| Specialist starvation | Technology and model coverage of the pillar thin for years | Losing the quarterly negotiation; a plan that does not state the risk in the specialists’ terms | The uncovered area is where the incident happens |
| Regulator mismanagement | Supervisors surprised; information requests late; candour doubted | Treating the regulator relationship as the CRO’s job | Supervisory findings about the audit function itself |
| No bench | The divisional chief auditor leaves and the pillar’s coverage wobbles for a year | Directors run as a span, not developed as successors | The group CAE hires externally; the layer loses its succession role |
The path in, and the path to group CAE
Three routes lead into the seat, and the route shapes how the first year goes.
| Route | Typical profile | First-year strength | First-year gap | Share of appointments (indicative) |
|---|---|---|---|---|
| Promotion from senior director in the same pillar | Twelve to twenty years in audit, most of it in or around the pillar | Product fluency; the team knows them; the regulators know them | Stature with the divisional CEO, who knew them as staff; the matrix seen only from below | Largest |
| Lateral from another pillar or another bank | A divisional chief auditor or senior director elsewhere | Fresh eyes; methodology perspective; no capture risk | Product learning curve; relationships from zero | Common |
| From the business or the second line | A former COO, CRO or head of a control function in the pillar | Stature and product knowledge from day one | Audit methodology and independence habits; a one-year restriction on auditing their former area; regulator scepticism about independence | Smaller, and scrutinised |
The path from the seat to group CAE is the most common route to the top of the profession in large organisations, and it has its own pattern. Group CAE searches look for someone who has owned a pillar’s opinion, faced a lead regulator alone, run a function of scale, and disagreed with a divisional CEO in front of a committee and been proved right. The divisional chief auditor of the largest or most complex pillar is usually the internal candidate; the deputy CAE or audit COO is the other. Candidates from the layer who do not get the group job are frequently hired as group CAE by a smaller institution, which is why the seat is also the profession’s main export route. The first ninety days as CAE and hiring a CAE guides describe what the destination looks like from both sides; the CAE compensation guide covers the package.
The first 180 days in the seat
Whichever route brought them in, new divisional chief auditors face the same opening sequence, and the ones who stumble usually do so by skipping a step. The table sets out the sequence as it runs in functions that onboard the layer deliberately; the first ninety days as CAE guide is the group-level counterpart.
| Window | Priority | Deliverable | Trap to avoid |
|---|---|---|---|
| Days 1 to 30 | Relationships: divisional CEO and direct reports, group CAE, audit COO, the central practice heads, the lead supervisory teams | A standing meeting cadence agreed with each; the regulators told who the new counterpart is | Starting with the plan before the people; letting the first regulator contact be an exam meeting |
| Days 1 to 60 | Read the pillar: universe, risk assessment, open issues, the last three years of unsatisfactory reports, QA results | A written view of where coverage is thin and where ratings look soft, shared with the group CAE | Accepting the inherited universe as complete |
| Days 30 to 90 | The team: directors assessed, product capability gaps named, two potential successors identified | A capability plan with hiring asks, taken to the audit COO | Reorganising before understanding |
| Days 60 to 120 | The plan: re-cut the current year where the risk view demands it; negotiate specialist hours for next year | A revised plan with stated coverage limitations, taken to the divisional risk committee in writing | Promising coverage the hours cannot deliver |
| Days 90 to 180 | The opinion: write the first pillar control-environment view, even if interim, and present it to the divisional CEO before the committee sees it | The first opinion, with exceptions named and evidenced | Waiting a full year to say anything about the pillar as a whole |
Worked example: the capital markets chief auditor at a universal bank
A composite, with no bank named. The capital markets chief auditor at a large universal bank owns an audit universe of about 190 entities across rates, FX, credit, equities, prime services, securitised products and the division’s technology and operations, with a team of 140 in six locations and a plan of roughly 110 engagements a year. The seat is a managing director role reporting to the group chief auditor, with a standing one-to-one with the division’s CEO, a seat at the divisional risk committee, and named relationships with the market-risk and capital-markets supervisory teams of two lead regulators.
In one year the role’s content looked like this. The plan negotiation with the centre secured 9,000 technology audit hours against a request for 14,000, on the strength of a risk statement that named the four trading platforms with end-of-life components; the gap went to the divisional risk committee as a coverage limitation, in writing. The trade surveillance audit, a 1,400-hour engagement with 400 hours of central data analytics, produced an unsatisfactory report: 3,100 alerts unreviewed for more than thirty days and two products traded for a quarter before new-product approval closed. The divisional CEO disputed the rating in the risk committee; the chief auditor had briefed him a week earlier, had the group chief auditor’s backing, and held the rating with the trading controls evidence on the page; the CEO’s response committed to a surveillance platform upgrade with a date. The lead regulator’s subsequent capital markets review cited the audit as evidence that the function’s coverage was credible, which was worth more to the division than the rating had cost it.
The issue population, 410 open items at the start of the year, was cut to 290 by a quarterly escalation rhythm that sent every second re-date on a High to the division’s COO and every risk acceptance above a threshold to the group audit committee; three items were accepted by the divisional CEO and reported as such. The team’s product capability was rebuilt around four hires from the business (two former traders, a former product controller and a former quant) under the one-year restriction, and two audit directors were given sub-pillar opinions to write and present, as succession development. At year end the chief auditor wrote the division’s annual control-environment opinion (adequate with four significant exceptions, two of them regulator-visible), presented it to the divisional risk committee and the group audit committee, and was one of two internal candidates considered when the group chief auditor retired eighteen months later. She did not get that job, and was hired as group chief auditor by a mid-sized bank the following year.
Frequently asked questions
What is a divisional chief auditor?
The head of internal audit for one business pillar or region inside a large function, usually at managing director grade in banks: owner of that pillar’s audit universe, plan, opinion, issue population and regulator relationships, counterpart to the divisional CEO, reporting to the group chief audit executive. Titles vary: portfolio head, head of audit for a division, regional head of audit.
How is a divisional chief auditor different from an audit director?
Completeness and exposure. The audit director delivers a slice of the plan with a team; the divisional chief auditor owns a whole pillar end to end, writes its control-environment opinion, meets its regulators alone and sits with its CEO as a peer. The seat is a CAE role for one pillar inside a group function.
What do regulators expect of a divisional chief auditor in a bank?
A complete and risk-rated universe for the pillar, a defensible plan, demonstrable independence from the divisional CEO, rigorous validation of supervisory findings, a team competent in the pillar’s products, and candour about what the function actually thinks, including about management.
How does the matrix between business-aligned audit and central methodology work?
The business-aligned line owns what to audit and the engagement judgment; the centre owns the methodology, quality assurance, specialist practices and group reporting. The divisional chief auditor’s posture is to own the judgment and adopt the method: argue for methodology changes through the centre and apply the current method faithfully meanwhile.
What is the path from divisional chief auditor to group CAE?
The seat is the main internal route to the top job in large organisations and the profession’s main export route to CAE roles at smaller institutions. Searches look for a pillar opinion owned, a lead regulator faced alone, a function of scale run, and a documented disagreement with a divisional CEO that was held and vindicated.
Why is the role graded at managing director level?
Because the divisional CEO deals with managing directors as peers and with lower grades as staff, and an audit counterpart who is structurally a visitor cannot hold a rating against the CEO or speak candidly to the regulator. Functions that have run the layer at lower grades have usually regraded it after the stature gap showed up in softened ratings.
Related guides
- Internal audit by role — the careers hub, with the full grade ladder and the leadership layer.
- The internal audit career ladder — staff to CAE, level by level.
- How to become a chief audit executive — the paths, the skills and the timing.
- CAE compensation — understanding the package at the top of the profession.
- Internal audit in banking — the complete guide to the most regulated audit job.
- The bank internal audit universe — a worked example with 126 entities, ratings and cycles.
- MRAs, MRIAs and consent orders explained — a field guide to bank supervisory findings.
- Managing multiple concurrent audits — the portfolio view the directors run.
- Your first 90 days as chief audit executive — the destination, day by day.
Leave a Reply