Moving from internal audit into risk management is the most common exit in the profession, and the least examined. Every auditor knows someone who made the move; almost nobody describes what actually changes on the Monday after. This guide does. It covers what the second line really does all day, which of your audit strengths transfer and which quietly become liabilities, how to read a second-line job offer (first-line assurance teams and second-line risk teams are different jobs with the same title), what practitioners report about pay, and the question most people only ask after they have jumped: can you come back?
It is written for auditors at every level from senior associate to director who are weighing the move, and for audit leaders who keep losing good people to it and want to understand why. For the wider map of destinations, start with the internal audit exit opportunities guide; this one goes deep on a single door.
In this guide
- Why risk management is the default exit
- What actually changes: six shifts
- What transfers, what becomes a liability
- Reading the offer: first-line assurance vs second-line risk
- Compensation: what practitioners report
- Preparing for the move while still in audit
- Are you ready? Signals that you are, and that you are not
- The first ninety days in the second line
- The one-way-door question
- Worked example: a senior auditor at Lakeshore Bancorp
- Frequently asked questions
- Related guides
Why risk management is the default exit
Three structural reasons make the second line the natural landing spot, and none of them is that auditors are bored. First, proximity: an auditor who has spent three years auditing credit, operational or compliance risk has already read the frameworks, the policies and the committee packs that the second line produces. No other function sees that material as a complete set. Second, the hiring manager usually knows you. Chief risk officers and heads of operational risk sit across the table from internal audit in every engagement that touches their framework; when they have a vacancy, the auditor who wrote a fair report about them is a known quantity. Third, the Three Lines Model itself makes the move legible to HR: the second line is a recognised adjacent function with its own career ladder, not a leap into a business role where audit experience has to be explained from scratch.
The pull is real, but so is the push. Auditors leave for the second line most often between years three and seven, at the point where the engagement cycle starts to repeat. The second planning memo for the same process is interesting; the fourth is not. Risk management offers a way to stay inside the governance world, keep the regulatory literacy that took years to build, and stop producing findings about other people’s work. Whether that trade is a good one depends on what you actually want from the next decade, which is why the honest assessment starts with what changes.
What actually changes: six shifts
The job title on the offer letter understates the change. An auditor and a second-line risk manager can sit in the same meeting, read the same loss event and reach the same conclusion, yet their relationship to the outcome is different in kind. Six shifts account for most of the adjustment.
| Shift | In internal audit | In second-line risk | Why it is harder than it sounds |
|---|---|---|---|
| Posture | Independent assurance; you are deliberately outside the process | Advisory and oversight; you are inside the governance machinery and partly responsible for it | You lose the ability to say “not my job to fix” and gain accountability for a framework you did not design |
| Output | Findings, ratings and reports with a defined lifecycle | Policies, appetite statements, limits, KRIs, challenge memos, committee papers | There is no finding hammer; influence has to come from argument and relationships |
| Cadence | Engagement cycles: plan, fieldwork, report, move on | Continuous: monthly packs, quarterly reviews, annual framework refresh, live breaches | The work never closes; the satisfaction of a finished report disappears |
| Standard of proof | Sufficient appropriate evidence; conclusions documented to a reperformance standard | Judgment under time pressure; the committee meets Thursday whether or not the data is clean | Auditors over-document and under-decide in the first year |
| Audience | Audit committee and senior management, through a report | Business heads, the CRO, the board risk committee, regulators, and internal audit itself | You become an auditee; the report about your work is now written by your former colleagues |
| Independence | Protected by charter, reporting line and standards | Functional independence from the first line, but inside the management structure and its incentives | Pressure to soften a challenge comes from people who now sign your appraisal |
The posture shift is the one people underestimate. In audit, when a control fails you document the exception and the business owns the remediation. In the second line, when the loss event lands the question in the room is why the framework did not catch it, and the framework is yours. Auditors who enjoyed being the one asking questions discover that being the one answering them is a different temperament test. Those who found the audit posture artificial, who always wanted to help fix the thing rather than write it up, find the shift liberating. Knowing which of those two people you are is most of the decision.
The cadence shift matters more than it looks on paper. Audit work has edges. A finding has a lifecycle; an engagement has a closing meeting; the report goes out and the file is locked. Second-line work is a river. The operational risk team produces the monthly loss-event pack, reviews new-product approvals as they arrive, responds to the regulator’s information request, refreshes the risk and control self-assessment on a rolling basis and briefs the risk committee on whatever broke last week. Auditors who thrive on completion sometimes find the absence of closure draining; auditors who disliked the stop-start rhythm of engagements find the continuity calming.
What transfers, what becomes a liability
The transfer list is long, which is why the move is so common. The liability list is short but consequential, because the habits on it are precisely the ones audit rewarded most.
| Audit strength | Transfers as | Second-line value | Watch-out |
|---|---|---|---|
| Control evaluation | Design and operating assessment inside RCSA, new-product review and change risk | High: most second-line teams are weak at evaluating control design rigorously | Do not run the RCSA like a test of controls; the first line owns the assessment |
| Evidence discipline | Challenge that is grounded in data rather than opinion | High: a challenge memo with a reperformed number beats one with an adjective | Time budgets are shorter; aim for decision-grade, not reperformance-grade |
| Framework literacy (COSO, ISO 31000, Basel, regulatory guidance) | Framework ownership and design | High: you have read the material the framework must conform to | Reading a framework and running one are different skills; defer to operators for a year |
| Report writing | Committee papers, policy drafting, breach narratives | Medium-high: clarity under length limits is rare in risk teams | Drop the finding structure; committees want options and a recommendation, not condition-criteria-cause-effect |
| Interviewing and walkthroughs | Risk identification workshops, scenario analysis facilitation | High | Facilitation is not interrogation; the room has to volunteer, not confess |
| Regulatory relationship experience | Exam management, MRA remediation ownership | Very high in banks and insurers | You now own the remediation dates you used to validate |
| Independence reflex | Willingness to say no to the first line | Essential | Calibrate: the second line says no to a product launch perhaps twice a year, not twice a week |
| Finding-first mindset | Nothing directly | Negative in year one | Reflexively cataloguing what is wrong reads as unhelpful when you are supposed to be designing what is right |
The habits that become liabilities are the finding reflex and documentation maximalism. A new second-line risk manager who responds to a draft appetite statement with eleven observations about its weaknesses has done something an auditor would be praised for and a risk partner would be quietly sidelined for. The second line earns its seat by producing the better version, not by grading the first draft. Documentation maximalism is subtler. Auditors are trained to write workpapers that a reviewer could reperform; second-line teams are expected to decide and move. A challenge memo that takes three weeks to reach reperformance standard arrives after the decision it was meant to challenge.
One strength transfers so well that it becomes a career edge: the ability to evaluate whether a control actually works. Most second-line functions are strong on taxonomy and reporting and weak on control effectiveness. An ex-auditor who can look at a key control in the RCSA and say, with evidence, that it does not operate as described is worth more to a head of operational risk than three people who can build a heat map. If you want to understand what the second line is supposed to produce before you join it, the guides on building an operational risk framework, the KRI program and appetite, tolerance and capacity describe the artefacts you will own.
Reading the offer: first-line assurance vs second-line risk
The single most common mistake in the move is accepting a job called risk management that is really something else. Four roles get advertised under similar titles, and they are different careers.
| Role as advertised | Where it sits | What the work really is | Who it suits | Career trajectory |
|---|---|---|---|---|
| Risk manager, second-line operational risk | Reports to the CRO organisation, independent of the business | Framework ownership, challenge, aggregation, committee reporting, regulatory interface | Auditors who want to design and oversee | Head of operational risk, deputy CRO, CRO in smaller firms |
| Business risk manager, first-line assurance or control testing | Reports to a business head or COO | Running the business’s own control testing, RCSA execution, issue remediation | Auditors who want to be closer to the business and fix things | Business COO track, control function head; sometimes a dead end if the team is seen as back office |
| Risk and controls, SOX or ICFR program | Finance, under the controller | Scoping, testing coordination, deficiency evaluation for the external auditor | Auditors who like SOX and want a finance route | Controller track or back into audit; see the guide on who does what across audit, SOX, compliance and ERM |
| Enterprise risk management | Often the CFO or strategy office, sometimes the CRO | Risk register, appetite framework, board reporting, emerging risk | Auditors with strong writing and board exposure | Chief risk officer in corporates, strategy roles; thin in banks where ERM is one desk among many |
First-line assurance roles deserve particular care. They are frequently staffed by ex-auditors, pay similarly to the second line and are advertised with the word “risk” in the title, but the work is control testing on behalf of management, and the independence that made your judgment valuable disappears entirely. That can be exactly right for someone who wants to run a business control function. It is the wrong move for someone who wanted the policy, challenge and committee exposure of the second line and discovers after six months that they are running a testing calendar with less protection than they had in audit.
Five questions separate the roles in an interview. Who does the team report to, and is that person inside the business line? Does the team write the framework or execute someone else’s? Does the role present to a board or risk committee, and how often? Who challenges the team’s work, and is internal audit’s coverage of the function in the plan? What happened to the last two people who held the role? The last question is the most revealing; a role whose last two holders moved into business leadership is a different proposition from one whose last two holders went back to audit.
Compensation: what practitioners report
Compensation data for this specific move is thin and mostly anecdotal, so what follows is pattern rather than survey. Treat the figures as orders of magnitude and verify against the current salary guide and your own market.
| Pattern | What practitioners report | Why it happens | Caveat |
|---|---|---|---|
| Lateral move, same level | Typically flat to +5–10% base | Hiring managers pay market for the level, not a premium for audit experience | Bonus structures in risk are often richer at the same base |
| Move with a promotion (senior to manager, manager to senior manager) | +15–30% total compensation is commonly described | The second line in banks is often graded one notch above audit for equivalent scope | The promotion, not the function, drives most of the jump |
| Banks and insurers vs corporates | Financial-services second-line roles pay materially more and bonus more | Regulatory demand for second-line headcount since 2010 kept the market tight | Corporate ERM roles can pay below audit at the same level |
| Long-run ceiling | CRO and head-of-risk roles pay above most CAE roles in the same organisation | Risk is a management function with P&L adjacency; audit is deliberately not | The number of CRO seats is small and the competition includes quants and former business heads |
| Long-term incentive | More common in second-line leadership than in audit leadership below CAE | Risk leaders are usually classified as management; audit leaders below CAE often are not | LTI vests; it also makes the return to audit more expensive |
The honest summary is that the move itself is not a pay event; the level is. People who report big jumps almost always moved up a grade at the same time, often because the second line in their organisation grades a notch higher than audit for equivalent scope. People who moved laterally report modest changes in base and a different shape of bonus. Over a decade the second line has a higher ceiling because it is a management function, but the ceiling is reached by few. If compensation is the primary motive, the arithmetic usually favours staying in audit and pushing for the next rung on the audit ladder rather than moving sideways at the same grade.
Preparing for the move while still in audit
The best preparation for a second-line role is to audit the second line properly and to be the auditor the risk team wanted to hire afterwards. That means three deliberate choices in your last eighteen months in audit.
- Ask for the engagements that cover risk frameworks rather than processes: the audit of the ERM program, the operational risk framework, the model risk function, the compliance risk assessment. The guides on auditing ERM, auditing operational risk management and auditing model risk management describe what those engagements examine, which is also what the second line is measured on.
- Write at least one report the CRO respects. Risk leaders remember the auditor who understood their framework well enough to find a real design gap and described it without theatre. That report is your reference.
- Build the credential the second line recognises. The CRMA is the IIA’s risk management assurance designation and signals the pivot; the FRM or PRM carries more weight in market and credit risk; a CISA or CRISC helps in technology risk. The certification roadmap by career stage sets out which to earn when.
- Learn the second line’s vocabulary and produce one artefact in it: draft a KRI with thresholds, write a one-page appetite statement for a risk you audited, or build a loss-event taxonomy for a process. Interviews for second-line roles test whether you can build, not whether you can critique.
- Keep the relationship with your audit leadership clean. The CAE who learns of your move from the CRO rather than from you has just lost a reference point for your return, and the second line checks references inside the building.
There is a quieter form of preparation: spend time with the second-line team outside engagements. Attend the risk committee as an observer when the CAE allows it, sit in on a new-product approval, read the monthly risk pack cover to cover. Auditors who do this discover either that the work is what they imagined or that it is not, and both discoveries are cheap before the move and expensive after it.
Are you ready? Signals that you are, and that you are not
Hiring managers in the second line see two kinds of audit candidates: those who are moving towards the work and those who are moving away from audit. The first kind usually thrives; the second kind usually repeats the dissatisfaction in a new building. A short self-check separates them.
| Signal | Points towards the move | Points against it, for now |
|---|---|---|
| What you enjoyed most in audit | Designing the test, understanding the business, the planning conversations with management | The moment the exception was confirmed, the independence, the finished report |
| How you react to a weak framework | You want to redraft it and have already sketched how | You want to document why it fails and let someone else fix it |
| Your relationship with the risk team | They have asked for your view outside engagements | You know them only through fieldwork requests |
| Your reason for leaving | A specific framework, regulator or risk you want to own | Repetition, a manager, or a pay number |
| Your tolerance for unfinished work | You can leave a pack imperfect to meet the committee date | An unreviewed workpaper keeps you awake |
| Your engagement record | Two or more risk-framework audits with findings management respected | Mostly process and SOX engagements; no framework exposure yet |
If the right-hand column describes you, the better move may be inside audit: a different cluster of engagements, a credential that opens the risk-framework work, or a conversation with your CAE about the next rung. The second line is not a cure for a bad year in audit; it is a different job that happens to use the same vocabulary.
The first ninety days in the second line
Most ex-auditors who struggle in the second line struggle in the first quarter, and for predictable reasons. The ninety-day plan below is built around avoiding them.
| Weeks | Priority | Audit habit to retire | Second-line habit to build | Evidence you are on track |
|---|---|---|---|---|
| 1–3 | Learn the framework as its owner, not its auditor | Listing gaps on first read | Asking what each element is for and who relies on it | You can explain the appetite cascade to a business head without notes |
| 3–6 | Take ownership of one recurring deliverable (a pack section, a KRI set, a policy) | Waiting for a complete file before drafting | Shipping a decision-grade draft on the committee’s calendar | Your first pack section goes out on time with one question from the chair, not six |
| 6–9 | Build relationships with the first-line heads you now partner | Treating meetings as interviews | Offering help on their control problems before asking about their risks | A business head calls you before a launch rather than after a breach |
| 9–12 | Deliver one piece of credible challenge | Writing a finding | Writing a challenge memo with an alternative and a recommendation | The decision changes, or the record shows why it did not |
| 12–13 | Reset with your manager | Asking for a rating | Asking what the CRO needs from the role in year two | You have a year-two objective that is not “keep the pack going” |
The hardest moment usually arrives around week eight, when internal audit opens an engagement on your function. Former colleagues request your RCSA evidence and your challenge log. Resist two temptations: defending the framework you inherited as though you built it, and over-helping the audit team by writing their findings for them. The right posture is the one you wished your auditees had taken: give complete evidence quickly, correct factual errors in the draft, accept the fair findings and negotiate only the ratings that are wrong. The guides written for auditees on writing management action plans and disputing a finding now apply to you.
The one-way-door question
Can you come back? Usually yes, with three conditions that are rarely stated at the time of leaving.
| Return scenario | How common | What makes it work | What blocks it |
|---|---|---|---|
| Return to the same audit function within 2–3 years | Common in large banks; rare in small functions | A clean exit, a CAE who wanted you back, and second-line experience that fills a gap in the audit plan (risk framework audits) | A cooling-off requirement: the Standards expect auditors not to assess activities they were responsible for in the prior year, so your first year back excludes your old function |
| Return to audit at a different organisation, one level up | Very common | Second-line experience is prized in audit hiring for risk-heavy plans; the move reads as breadth | Pay: second-line LTI and bonus can make the return expensive |
| Return at CAE level | Increasingly common | Boards like CAE candidates who have run something; the CRO-to-CAE route exists in banks | Independence optics if you return to the firm whose risk function you led; many boards prefer an external CAE in that case |
| Never return, by choice | The majority | The second line leads to CRO, COO and business roles that audit does not | None; this is the point for most people |
The practical constraint is the one-year rule. The Global Internal Audit Standards expect that auditors do not provide assurance over activities for which they had responsibility within the previous year, and most charters mirror the restriction. Returning to audit the function you just left is therefore not an option in year one, and a small audit function may not have enough other work to place you. In a 22-person function like Lakeshore’s that is a scheduling problem; in a six-person function like MidState’s it can make the return impossible for a year. Ask the CAE before you leave how a return would be handled; the answer tells you how the door really works.
The second constraint is reputational and harder to see. An auditor who leaves for the second line and returns within a year is read, fairly or not, as someone who could not make the transition. Returns after two or three years with a framework built, a committee served and a regulator exam survived are read as breadth. If you are going to go, go properly.
Worked example: a senior auditor at Lakeshore Bancorp
Lakeshore Bancorp is a $9 billion regional bank with a 22-person internal audit function and a 40-person compliance department. One of its senior auditors, five years into the function with the CIA and most of the bank’s credit and operational risk engagements behind her, was approached by the head of operational risk to lead the RCSA program. The approach followed the function’s operational risk management audit, in which she had written the finding that the bank’s loss-event data was 91 percent complete against the general ledger and that nine of the 38 key risk indicators had no thresholds.
She used the five offer questions. The role reported to the head of operational risk, who reported to the CRO: second line, not first-line assurance. The team owned the framework and was rebuilding it after the audit. The role presented the quarterly operational risk section to the board risk committee. Internal audit’s FY27 plan included a follow-up on the operational risk findings, so her own work would be audited within a year. The previous holder had moved to a business COO role, the one before to the central ERM team.
The offer was a one-grade promotion to assistant vice president with a base increase of 12 percent and a bonus target of 20 percent against her audit target of 12; no long-term incentive at that grade. Her CAE’s reaction was the deciding factor: he confirmed the one-year restriction would exclude her from the operational risk follow-up and the FY27 risk-framework engagements if she returned early, and that he would otherwise welcome her back at manager level after two or three years with the second-line experience the plan needed.
Her first ninety days followed the shape above. The RCSA refresh she inherited had 34 level-two risks and a scoring scale nobody used consistently; her first deliverable was a two-page calibration guide rather than a list of defects. The audit follow-up arrived in month nine and found the KRI thresholds set and the loss-data completeness at 97 percent; it also found that the RCSA scores for the wire operations unit had not been updated after the wire operations audit, which she accepted as a fair finding and fixed within the quarter. Eighteen months in, she had presented to the risk committee six times and had been asked to lead the bank’s response to the OCC’s observations on interest rate risk governance alongside the treasurer. The door back to audit was open; she had not used it.
Frequently asked questions
Is moving from internal audit to risk management a step up or a lateral move?
By itself it is lateral. The level you move at determines the pay and the scope, and many people combine the move with a promotion because second-line teams in banks grade a notch higher for equivalent scope. A lateral move at the same grade changes the work far more than the pay.
Which risk function is the easiest transition for an auditor?
Operational risk, because the framework (RCSA, loss events, KRIs, scenario analysis) maps most directly onto control evaluation, and because most operational risk teams need exactly the control-effectiveness skill auditors bring. Compliance risk is the next easiest for auditors with regulatory engagements behind them. Market and credit risk require quantitative depth that audit alone does not build.
Do I need the CRMA or FRM before applying?
No, but one of them shortens the conversation. The CRMA signals the pivot and is quick to earn for a CIA; the FRM is the stronger credential for market, credit and liquidity roles and takes a year of study. Hiring managers weight relevant engagements and a strong report above either.
Will I lose my independence protections?
Yes, in the formal sense. The second line is independent of the first line but sits inside management, reports to executives and is appraised by them. Your protection becomes the quality of your argument and the CRO’s backing, not a charter.
How soon can I return to internal audit if it does not work out?
You can return whenever a role is open, but the Standards and most charters keep you from auditing the function you worked in for at least a year, which can make an early return impractical in a small audit team. Returns after two or three years with a framework built are the ones that read as breadth rather than retreat.
What do second-line interviewers test that audit interviews do not?
Whether you can build rather than critique. Expect to be asked to draft an appetite statement, design a KRI with thresholds, or outline how you would challenge a product approval. Bring one artefact you have produced, not a list of findings you have raised.
Related guides
- Internal audit exit opportunities — the field guide to every destination, with what each values from audit experience.
- Is internal audit a dead end? — the pigeonhole debate examined with the data on where auditors actually land.
- The internal audit career ladder — staff to CAE, level by level, with the scope markers for each rung.
- The Three Lines Model explained — the six principles and the roles that define where the second line sits.
- Building an operational risk framework — the taxonomy, tools and governance you will own in the second line.
- Designing a KRI program — from a metric wishlist to an early warning system.
- The CRMA — whether the risk management assurance credential is worth it for the pivot.
- Internal auditor salaries — how to read the market, not just the averages.
- Internal audit by role — the careers hub, with the full grade ladder and the leadership layer.
Leave a Reply