An internal audit resume is a one- or two-page document that gets an auditor an interview by showing, in the first thirty seconds of reading, the scope they have handled, the outcomes they have produced and the credentials that make them safe to hire. The difficulty is specific to the profession: the work is confidential, the deliverable is a report that nobody outside the organization saw, and the value often lies in what the organization avoided. Most audit resumes respond by describing duties (“performed risk-based audits in accordance with the IIA Standards”) and are indistinguishable from one another. The resumes that get interviews describe scope and results in numbers, respect confidentiality by writing at the level of category rather than case, and are built to pass both the software that screens them and the audit manager who reads them.
This guide shows how to write that resume. It covers what the two readers (an applicant tracking system and a hiring manager) each look for, the section-by-section anatomy, the formula for a bullet that carries scope and result, impact verbs organized by audit activity, the confidentiality rules for describing findings and employers, keywords by career level, formatting that survives parsing, three before-and-after rewrites for a staff auditor, a senior and a manager, the mistakes that get otherwise qualified people rejected, and a worked example of a senior auditor’s rewrite and what happened next. It pairs with the job description guide, which shows what employers are asking for, and the interview questions guides, which cover the step the resume earns.
In this guide
- The two readers and what each wants
- Anatomy: the sections and their order
- The summary: three lines that decide the read
- Gathering the numbers
- The bullet formula: verb, scope, method, result
- Impact verbs by audit activity
- Confidentiality: what you may say about findings and employers
- Keywords by level
- Formatting that survives the applicant tracking system
- Before and after: staff auditor
- Before and after: senior auditor
- Before and after: audit manager
- Special cases: changers, gaps, consulting firms, relocations
- Mistakes that get audit resumes rejected
- Worked example: a senior auditor’s rewrite and its results
- Questions about internal audit resumes
- Related guides
The two readers and what each wants
| Reader | How it reads | What it rewards | What defeats it |
|---|---|---|---|
| Applicant tracking system (ATS) | Parses the file into fields (name, employers, dates, titles, skills) and matches terms against the posting; a recruiter then filters and searches | Standard section headings; the posting’s own terms (certifications, systems, frameworks, process names); dates in a consistent format; a plain file | Text in tables, columns, text boxes or headers that parsers skip; graphics; unusual headings (“My Journey”); acronyms without the spelled-out form |
| Hiring manager (usually an audit manager or director) | Thirty seconds on the first page, looking for scope, outcomes and risk; reads the rest only if the first page earns it | Numbers (population sizes, dollar exposure, team size, findings closed); recognizable processes and systems; credentials; evidence of writing ability in the resume itself | Duty lists; jargon without substance; anything that suggests a confidentiality breach; typos, which in an audit resume are disqualifying |
The two readers are not in conflict. A resume written for the hiring manager, with plain headings and the posting’s vocabulary, passes the software; the mistake is to write for the software first and produce a keyword list no manager wants to read.
Anatomy: the sections and their order
| Section | Content | Length | Notes |
|---|---|---|---|
| Header | Name; city and state or country; phone; email; LinkedIn address; certifications after the name (Jane Doe, CIA, CPA) | Two lines | No street address; a professional email; the credential letters are the first keywords the software reads |
| Summary | Three lines: level and years; sectors and processes; two or three distinguishing strengths with evidence | Three lines, no more | Written last; specific (“eight years in bank internal audit, lending and treasury; led 30 engagements; CIA, CRMA”) not aspirational (“results-driven professional”) |
| Experience | Employer, title, dates; one line of context (size, sector, function size); four to six bullets for the current role, fewer for older ones | 60 percent of the page | Reverse chronological; each bullet follows the formula below |
| Certifications | Full name, awarding body, year; in progress with parts passed | Two to four lines | Spell out: Certified Internal Auditor (CIA), The Institute of Internal Auditors |
| Skills and systems | Analytics tools, audit management systems, ERPs audited, frameworks, languages (SQL, Python) | Three to five lines | Only what you can be interviewed on; the SQL guide sets a fair bar for listing SQL |
| Education | Degree, institution, year (year optional after fifteen years) | One or two lines | Below experience for anyone past entry level |
| Optional | Publications, speaking, professional volunteering (IIA chapter roles), languages | As needed | Only if relevant and recent |
Length: one page for under about seven years of experience, two for more, never three. A chief audit executive’s resume is still two pages; the CAE interview guide describes the separate leadership document that sometimes accompanies it.
The summary: three lines that decide the read
The summary is read first and written last. Its job is to tell the hiring manager, before the eye reaches the experience section, that the candidate is at the right level, has worked in the right places and brings something specific. Three lines: level and years; sectors, processes and scale; two or three strengths with a number or credential attached. Nothing aspirational, no adjectives about yourself, no objective statement about what you are seeking (the application says that). The three examples below belong to the three rewrites that follow.
| Level | Summary |
|---|---|
| Staff | Internal auditor with three years across external audit and a distributor’s internal audit function; fieldwork on nine engagements in accounts payable, cash, payroll and operations; full-population testing in SQL; CIA Part 1 passed. |
| Senior | Senior internal auditor with six years in bank internal audit at a $9 billion OCC-regulated institution; led 16 engagements in commercial lending, treasury and SOX 404; CIA and CRMA; presented to the audit committee as lead auditor. |
| Manager | Internal audit manager who helped build a manufacturer’s function from its second hire: audit universe, risk assessment, three annual plans delivered in full, methodology written to the Global Internal Audit Standards; manages staff and a co-source budget; CIA, CPA. |
Gathering the numbers
The bullets above depend on figures most auditors have never written down about themselves, and the first hour of a rewrite is spent recovering them. The sources are non-confidential documents the auditor legitimately holds or remembers: the engagements led or worked, from the plan or from memory; population and dollar sizes, from scoping memos and from public filings for the employer (revenue, assets, headcount); findings by category and rating, from the function’s issue log; recoveries and remediation outcomes, from closed-issue records; hours and efficiency gains, from time records; team sizes and budgets, from the plan. Where an exact figure would disclose something confidential, round it (“eight figures”, “a top-five customer”). Where no figure exists, the bullet probably describes a duty and should go. Keep the list as a private career file and add to it at the end of every engagement; the auditor who records “41,000 invoices, $96 million, nine duplicates, $47,300” in the week the audit closes never has to reconstruct it.
| Number | Where to find it | Confidentiality check |
|---|---|---|
| Employer scale (revenue, assets, employees, locations) | Public filings, annual report, website | Public |
| Population tested (invoices, loans, users, journal lines) | Scoping memo, analytics workpaper, memory | Scale is not confidential; round it |
| Dollar exposure of a finding | The finding’s effect statement | Round to one significant figure; no customer or person |
| Findings written, accepted, closed | Issue log, engagement summaries | Counts and categories only |
| Efficiency (hours saved, cycle time) | Time records; before-and-after plan budgets | Internal but not sensitive |
| Team and budget | The annual plan and resourcing section | Headcount and rounded budget are standard resume facts |
| Committee presentations | Meeting calendar | Count and role, not content |
The bullet formula: verb, scope, method, result
Every experience bullet carries four elements in roughly this order: an impact verb in the past tense (present for the current role is acceptable but past is safer); the scope, in numbers (the population, the dollar exposure, the number of locations, systems, people); the method, briefly, where it distinguishes you (full-population analytics, a new program, a framework applied); and the result, in numbers where possible (findings, recoveries, risk reductions, time saved, ratings, adoption). The result is the element most audit resumes omit, because auditors feel that outcomes belong to management. They do; the resume claims the identification, the quantification and the influence, not the fix. “Led the accounts payable audit” is a duty. “Led the accounts payable audit of 41,000 invoices and $96 million in annual spend, applied full-population analytics in SQL, identified 31 unverified vendor bank account changes with $1.1 million paid behind them and secured a verification control implemented within 60 days” is a bullet, and the five Cs structure auditors use for findings is visibly behind it: condition, criteria, cause, consequence, corrective action, compressed to one line.
Impact verbs by audit activity
| Activity | Verbs that carry weight | Verbs to retire |
|---|---|---|
| Planning and risk assessment | Built, redesigned, scoped, prioritized, mapped, risk-ranked, calibrated | Assisted with, participated in, was involved in |
| Fieldwork and testing | Tested, traced, reconciled, re-performed, sampled, analyzed, interrogated (data), identified, quantified | Performed, conducted, carried out, helped |
| Analytics and technology | Automated, scripted, modeled, profiled, matched, flagged, reduced (hours), built (a tool, a query library) | Used, utilized, worked with |
| Findings and reporting | Identified, quantified, surfaced, wrote, rated, negotiated, secured (an action plan), presented, briefed | Documented, communicated, reported on |
| Leadership and management | Led, managed, supervised, coached, hired, mentored, delivered (a plan), budgeted, resourced | Oversaw, was responsible for, handled |
| Stakeholder and committee work | Presented to, advised, influenced, aligned, escalated, partnered with | Liaised, interfaced, interacted |
| Methodology and quality | Authored, standardized, implemented (the Standards), passed (an external assessment), designed (templates, a QAIP) | Ensured, maintained, supported |
| Fraud and investigations | Detected, investigated, substantiated, recovered, referred, prevented (with evidence) | Looked into, reviewed |
Confidentiality: what you may say about findings and employers
The Standards bind auditors to protect information acquired in their work (Principle 5 of the Global Internal Audit Standards), and most employment contracts add their own terms. A resume that reads “found that the CFO had overridden controls at the Ohio plant” ends the candidacy, because every hiring manager knows that the same candidate would describe their new employer the same way. The rules that allow a resume to be specific without breaching confidentiality are these. Name the employer, your title and your dates; those are public. Describe the process, the population and the scale (“accounts payable, 41,000 invoices, $96 million”); scale is not a secret. Describe findings by category and effect, never by person, location or unpublished detail (“identified a gap in vendor bank account verification with seven-figure exposure”, not “found that the AP supervisor bypassed verification for a vendor owned by her brother”). Quantify recoveries and exposures in rounded figures. Never disclose anything that identifies an investigation subject, a regulatory matter not public, a customer or a pending transaction. If the employer is itself confidential (a private client of a co-sourcing firm), describe it generically (“a $9 billion regional bank”) and name the firm.
| Breaches confidentiality | Says the same thing acceptably |
|---|---|
| “Investigated the plant controller for inventory manipulation and found $2.3 million overstated” | “Led a financial reporting investigation at a manufacturing site that substantiated a seven-figure inventory overstatement and supported restatement decisions” |
| “Identified that our largest customer, [name], had unauthorized credit terms” | “Identified unauthorized credit terms on a top-five customer account, quantified the exposure at eight figures and secured a credit committee approval control” |
| “Reported to the OCC that the bank’s BSA program failed” | “Audited the BSA/AML program; findings on alert disposition were remediated ahead of the regulatory examination” |
| “Found the CIO had approved his own vendor’s invoices” | “Identified a segregation-of-duties gap in technology procurement approvals, escalated it to the audit committee and confirmed the control redesign” |
Keywords by level
Keywords are the terms the posting uses and the recruiter searches for. They belong in the summary, the bullets and the skills section, spelled out once with the acronym in parentheses so both forms match. The table lists the terms that recur in postings at each level, drawn from the job description analysis; tailor to each posting rather than including everything.
| Level | Credentials and frameworks | Process and technical terms | Leadership terms |
|---|---|---|---|
| Staff and senior (0 to 5 years) | CIA (or parts passed), CPA, CISA; Global Internal Audit Standards; COSO; SOX 404; GIAS | Walkthroughs, test of design and operating effectiveness, workpapers, sampling, data analytics, SQL, Excel, IDEA or ACL, TeamMate or AuditBoard, ERP names (SAP, Oracle, Workday, NetSuite) | Rarely needed; “coached interns” or “led fieldwork for” is enough |
| Lead and manager (5 to 10 years) | CIA, CPA, CISA, CFE, CRMA; risk-based audit plan; QAIP; ITGC; third-party risk | Audit universe, annual risk assessment, engagement planning, issue validation, continuous auditing, root cause analysis, regulatory exam support | Managed, supervised, reviewed, budget, staffing, co-source management, audit committee materials |
| Director and CAE (10+ years) | CIA, CPA; external quality assessment; GIAS conformance; Topical Requirements; ERM | Audit strategy, combined assurance, assurance mapping, regulatory relationships, transformation (analytics, agile auditing) | Audit committee reporting, board, function build or turnaround, headcount, budget size, stakeholder management, talent development |
Formatting that survives the applicant tracking system
| Element | Do | Avoid |
|---|---|---|
| File | The format the posting asks for; otherwise .docx, or PDF exported from a word processor (text-based, not scanned) | Pages or Google Docs native formats; image PDFs; two-column templates |
| Layout | Single column; standard headings (Summary, Experience, Certifications, Skills, Education); bullets with a standard bullet character | Tables for layout, text boxes, sidebars, icons, photos, headers and footers that carry content |
| Type | One common font at 10.5 to 12 points; bold for employers and titles only | Decorative fonts; color coding; skill bars and ratings graphics |
| Dates | Month and year for every role, consistent format (Mar 2021 to Present) | Years only (reads as gap-hiding); mixed formats |
| Terms | Spelled out with acronym: Sarbanes-Oxley (SOX), Certified Internal Auditor (CIA) | Acronym only; employer-internal names for processes or systems |
| Tailoring | Reorder bullets and adjust the summary for each posting; mirror its process names | A different resume for each application that drifts from the truth; keyword stuffing in white text, which parsers reveal and recruiters punish |
| Length and density | Margins of at least 0.6 inch; white space between roles | Eight-point type to fit a third page onto two |
Before and after: staff auditor
Two years at MidState Beverage, a three-state drinks distributor with a six-person internal audit function, after a year in external audit. The before version is the one most second-year auditors write.
Before. Staff Internal Auditor, MidState Beverage, 2025 to present. Performed operational and financial audits in accordance with IIA Standards. Prepared workpapers and documented testing results. Assisted in the preparation of audit reports. Participated in walkthroughs and interviews with process owners. Utilized data analytics to support audit testing.
After. Staff Internal Auditor, MidState Beverage (three-state beverage distributor, $221 million revenue, 12 depots), Mar 2025 to present. Executed fieldwork on nine engagements across accounts payable, route cash, payroll and depot operations, including the FY27 route cash audit of $31 million in annual cash collections across 300 drivers. Tested full populations in SQL where data allowed (41,000 invoices; 38,000 payments), identifying nine duplicate payments ($47,300, seven recovered during fieldwork) and 31 unverified vendor bank account changes that became the engagement’s High-rated finding. Wrote first drafts of 14 findings using the condition-criteria-cause-effect structure; 11 accepted by the audit manager with minor edits. Built the function’s first shared query library (20 parameterized tests) now used on every AP and payroll engagement. CIA Part 1 passed; Parts 2 and 3 scheduled.
Before and after: senior auditor
Six years at Lakeshore Bancorp, a $9 billion publicly traded regional bank holding company with a 22-person internal audit function, the last three as a senior leading engagements in lending and treasury.
Before. Senior Internal Auditor, Lakeshore Bancorp. Responsible for planning and executing risk-based audits in the commercial lending and treasury areas. Supervised staff auditors and reviewed their workpapers. Communicated findings to management and prepared audit reports. Assisted with the annual risk assessment and SOX testing. Strong knowledge of banking regulations.
After. Senior Internal Auditor, Lakeshore Bancorp ($9 billion OCC-regulated regional bank; 22-person internal audit function), Jun 2023 to present; Staff Internal Auditor, Jun 2020 to Jun 2023. Led 16 engagements end to end across commercial lending ($4.1 billion portfolio), treasury and interest rate risk, and SOX 404 key controls, supervising two to three staff per engagement and reviewing all workpapers. Identified a loan covenant monitoring gap affecting 140 commercial relationships; findings drove a monitoring control adopted bank-wide before the next regulatory examination. Redesigned the treasury audit program around the bank’s EVE and NII limits, cutting fieldwork hours 20 percent while adding model input testing. Owned SOX operating effectiveness testing for 38 of the bank’s 212 key controls with no control deficiencies missed in external auditor re-performance over three years. Presented engagement results to the audit committee twice as the lead auditor. Certified Internal Auditor (CIA), 2022; Certification in Risk Management Assurance (CRMA), 2024.
Before and after: audit manager
An audit manager at Brightwater Foods, a $180 million food manufacturer with three plants, who joined as the second hire of a newly established function and now applies for a director role at a larger company.
Before. Internal Audit Manager, Brightwater Foods. Manage the internal audit function’s day-to-day operations. Develop the annual audit plan and oversee its execution. Manage a team of auditors and co-source providers. Report to the Chief Audit Executive and present to the Audit Committee. Ensure compliance with professional standards.
After. Internal Audit Manager, Brightwater Foods ($180 million food manufacturer, three plants, 600 staff), Sep 2024 to present. Second hire into a new internal audit function; built the audit universe (61 auditable entities), the annual risk assessment and the first three risk-based audit plans, delivering 100 percent of planned engagements in each year. Manage two staff auditors and a co-source relationship ($180,000 annual budget) covering IT general controls and cyber resilience. Delivered findings that led to immutable backup implementation after a cyber resilience review found a 41-hour ERP restore against a 24-hour target, and to supplier qualification changes after a third-party resilience review identified a sole-source closure component with three weeks of stock. Authored the function’s methodology manual and workpaper standards against the Global Internal Audit Standards; the function’s first internal quality assessment found conformance across all domains. Present to the audit committee quarterly; drafted the committee’s first internal audit charter. Certified Internal Auditor (CIA); Certified Public Accountant (CPA); Certified Information Systems Auditor (CISA) in progress.
Special cases: changers, gaps, consulting firms, relocations
| Situation | What to do |
|---|---|
| External audit to internal audit | Translate client work into process and control language; lead with the industries and processes the target function audits; show any controls, fraud or advisory work; the transition guide gives the vocabulary |
| Career gap | Month and year dates with the gap visible; one line if the reason is simple (study, caregiving, relocation); credentials earned during the gap count as activity |
| Co-source or consulting firm experience | Name the firm; describe clients generically by sector and size (“a $9 billion regional bank”); group engagements by type with totals (“22 SOX and operational engagements across six financial services clients”) |
| Many short roles | Group contract roles under one heading with the agency or “independent contractor”; emphasize scope and outcomes per engagement rather than tenure |
| International or relocating candidate | State work authorization plainly if the posting asks; convert currencies with the original in parentheses; map local credentials to their international equivalents and the CIA versus ACCA comparison if relevant |
| Returning to audit after another function | Lead with what the other function taught that audit values (process ownership, control operation, data); keep the audit years detailed even if older |
| Aiming at a first management role | Pull every supervisory fact forward: staff reviewed, engagements led, budgets managed, presentations given; the career ladder guide lists what distinguishes the level |
Cover letters and the LinkedIn profile follow the same rules. The cover letter, where one is required, is three short paragraphs that connect two or three of the resume’s bullets to the posting’s stated priorities; it never restates the resume. The LinkedIn profile carries the summary and the headline bullets, written at the same category level, because recruiters search it with the same keywords and a profile that contradicts the resume is a question in the first interview.
Mistakes that get audit resumes rejected
| Mistake | Why it fails | Fix |
|---|---|---|
| Duty lists | Every auditor performs audits; the reader learns nothing about you | The four-element bullet; cut any bullet with no number |
| Typos and inconsistencies | An auditor who cannot proof two pages will not be trusted with a report | Read aloud; have someone else read it; check every date |
| Confidentiality breach | Shows how you will treat the next employer’s information | Category and effect, never person or unpublished detail |
| “Strong knowledge of” claims | Unverifiable; invites a hard interview question | Show the knowledge in a bullet with a result instead |
| Listing every tool you have seen | Interviewers test the list; the case study interview exposes it | List what you can demonstrate |
| Credentials buried | The first screen is often a credential search | Letters after the name; a certifications section; parts passed if in progress |
| Hiding dates or gaps | Reads as evasion; the manager will ask anyway | Month and year; one line of explanation for a gap if needed |
| Generic summary | “Results-driven professional” is the sentence every rejected resume shares | Level, sectors, scope, two strengths with evidence |
| No tailoring | The posting’s process names are what the recruiter searches | Mirror the posting’s vocabulary and reorder bullets to lead with its priorities |
Worked example: a senior auditor’s rewrite and its results
The Lakeshore Bancorp senior whose before-and-after appears above had applied to eleven senior and manager roles over four months with the before version and received two screening calls and no interviews. The rewrite took one weekend and followed the sequence this guide recommends: list every engagement led, with population and dollar figures from memory and from non-confidential plan documents; for each, write the finding category and the result in one line; choose the six that best matched the target postings (bank internal audit manager roles emphasizing lending, treasury and SOX); draft bullets with the four elements; strip anything that identified a customer, an individual or an unpublished regulatory matter; add the two credentials to the header; rebuild the file as a single-column document with standard headings; and tailor the summary to each posting’s first three requirements.
| Measure | Before version (11 applications, 4 months) | After version (9 applications, 6 weeks) |
|---|---|---|
| Recruiter screening calls | 2 | 6 |
| Hiring manager interviews | 0 | 4 |
| Case study or technical rounds | 0 | 3 |
| Offers | 0 | 1 (audit manager at a $14 billion bank; a second process withdrawn after acceptance) |
| Interview questions driven by resume bullets | Not applicable | Most of the first interview in each process, by the candidate’s account: the covenant monitoring finding, the treasury program redesign and the SOX re-performance record |
| Confidentiality challenges from interviewers | Not applicable | None; two interviewers noted the category-level phrasing approvingly |
The candidate’s own assessment of what changed was that the numbers did the work: the same six years, described with populations, dollar figures and results, read as a track record rather than a job description, and the interviews became conversations about specific engagements she could discuss in depth, which the manager interview guide describes as the pattern that leads to offers. The salary outcome, a step to manager with the increase that implies, is the subject of the salary guide.
Questions about internal audit resumes
How long should an internal audit resume be?
One page for under about seven years of experience, two pages for more, never three. Directors and chief audit executives stay at two pages and use a separate leadership summary if the process asks for one.
Can I describe audit findings on my resume without breaching confidentiality?
Yes, at the level of category and effect: the process, the population, the type of gap, the exposure in rounded figures and the outcome. Never name individuals, customers, locations where that identifies people, investigation subjects or regulatory matters that are not public.
Should certifications go after my name?
Yes, for earned credentials (CIA, CPA, CISA, CFE). Credentials in progress go in the certifications section with the parts passed and the scheduled date, not after the name.
How do I show results when the fix belonged to management?
Claim what was yours: identifying the issue, quantifying the exposure, rating it, securing the action plan and confirming the remediation. “Identified … quantified … secured a control implemented within 60 days” is accurate and strong without claiming the fix.
Does an ATS reject resumes with tables or columns?
Parsers vary, and some handle them, but text inside tables, text boxes, headers and footers is the content most often lost or scrambled. A single-column layout with standard headings removes the risk at no cost.
Should I tailor the resume to each posting?
Yes: adjust the summary to the posting’s first three requirements, reorder bullets so the most relevant lead, and mirror the posting’s process and system names. Keep every fact the same across versions.
What should a career changer from external audit emphasize?
Controls testing, process understanding, client scope and industry exposure, translated into internal audit vocabulary; the external-to-internal transition guide covers the translation and the questions to expect.
Related guides
- Internal auditor job description — what postings ask for, level by level.
- Internal audit interview questions — the step the resume earns.
- Audit manager interview questions — the manager-level conversation.
- Chief audit executive interview — the leadership process.
- Audit case study interview — where tool claims are tested.
- Questions to ask your audit interviewer — the other side of the table.
- The ultimate guide to internal audit interviews — technical, behavioral and beyond.
- Technical interview questions — what the bullets must survive.
- Internal auditor salary guide — what the next step pays.
- The internal audit career ladder — levels and what distinguishes them.
- Certification roadmap by career stage — which credentials to earn when.
- From external audit to internal audit — translating the experience.
- Becoming a chief audit executive — the leadership resume.
- Internal audit exit opportunities — the same resume aimed outward.
- The five Cs of audit findings — the structure behind a strong bullet.
- Business writing for auditors — concision that shows on the page.
- SQL for auditors — earning the skill before listing it.
- Essential soft skills for internal auditors — what to evidence, not claim.
- From internal audit to risk management — what changes, what transfers and what it pays.
- Big Four vs industry internal audit — how the two paths differ and how to choose.
Leave a Reply