An audit manager’s job is not to run audits. It is to run a portfolio of audits, each led by someone else, so that the whole set delivers on time, on budget and at the function’s quality standard, while the manager also presents to the committee, develops people and keeps the business relationships warm between engagements. Managers who come up through the in-charge role usually arrive believing the job is the same thing at larger scale, and discover that it is a different thing: the unit of work is the portfolio, the instrument is the dashboard, and the skill is knowing when to step into an engagement and when to leave it alone. This guide covers the portfolio view: the dashboard that makes five engagements legible at once, the intervention triggers that tell a manager when to step in, the context-switching discipline that stops the day dissolving, resource-conflict arbitration, and the weekly portfolio review that catches trouble at week two rather than week eight.
In this guide
- The portfolio is the job
- The portfolio dashboard
- Intervention triggers: dive in or trust the lead
- Context-switching survival
- Resource-conflict arbitration
- Sequencing the quarter so engagements do not peak together
- Developing leads through the portfolio
- The weekly portfolio review
- Quality at portfolio level
- The stakeholder portfolio between audits
- How portfolios fail
- Worked example: an audit manager at Fernhill Communications
- Frequently asked questions
- Related guides
The portfolio is the job
A manager in a mid-sized function typically has four to eight engagements in flight at any time, at different stages, led by in-charges of different experience, with staff shared between them and a co-source firm on one or two. The manager’s accountability is for all of them simultaneously, which creates a problem the in-charge never had: attention is finite and every engagement wants it. The way out is to manage by exception, which requires a system that makes exceptions visible without the manager reading every workpaper.
| Dimension | In-charge | Manager | Implication |
|---|---|---|---|
| Unit of work | One engagement | Four to eight engagements plus committee, people and stakeholders | Attention must be allocated, not given |
| Information | Direct: you see the work | Indirect: you see status notes, dashboards and samples | The information system is the manager’s eyes |
| Intervention | Continuous | Episodic and triggered | Diving in without a trigger steals the lead’s job and the manager’s week |
| Quality | First review of everything | Second review of samples; first review of findings and reports | Review depth must be chosen deliberately |
| People | Direct a team on one engagement | Develop leads across engagements; arbitrate resource conflicts | The leads’ development is the manager’s leverage |
| Stakeholders | The engagement’s sponsor and contacts | A standing relationship with business heads across the universe | Relationships are maintained between audits, not only during them |
| Reporting | Friday note to the manager | Portfolio status to the CAE; sections of the committee pack | The manager is the function’s information layer |
The in-charge playbook describes the leap from doing to deciding; the manager’s leap is from deciding to designing the system in which others decide. A manager who still reviews every workpaper, runs every closing meeting and chases every PBC item has not made the leap, and the signs are the same at every function: the manager works sixty hours, the leads are not developing, and the committee pack is late.
The portfolio dashboard
The dashboard is a single page, refreshed weekly from the leads’ status notes, that shows every engagement on the same scales. Its purpose is comparison: an engagement that looks fine on its own looks different next to its peers. The columns below are the minimum; functions with audit management software can automate most of them, and the implementing audit management software guide covers that.
| Column | Source | Scale | Why it is on the page |
|---|---|---|---|
| Stage | Lead’s note | Planning / fieldwork / reporting / follow-up | Different stages need different attention |
| Hours: spent vs planned, and % of fieldwork complete | Timesheets + lead’s estimate | Two numbers side by side | The divergence between them is the earliest overrun signal |
| Milestone status | Lead’s note | Next milestone, date, on time / slipped by n days | Slips compound; three days now is three weeks later |
| Evidence outstanding | PBC tracker | Items past due, oldest in days | Evidence delay is the usual cause of fieldwork slip |
| Emerging findings | Findings skeleton | Count by provisional rating | The committee will ask; the sponsor should already know |
| Sponsor temperature | Lead’s judgment | Green / amber / red with one line of reason | Relationship problems are cheaper early |
| Lead confidence | Lead’s self-assessment | On track / at risk / needs help | Leads who say “needs help” early are rewarded, not marked down |
| Manager’s next action | Manager | One line | The dashboard produces decisions, not just information |
Two design rules. Every column is filled by the lead except the last, which keeps the manager out of data entry and makes the leads own their numbers. And the page is one page: a dashboard that needs scrolling is a report, and reports do not get read on Monday morning. The function’s KPIs (plan completion, timeliness, budget variance) are the portfolio dashboard aggregated over the year, so a manager who keeps the page current is also keeping the committee pack current.
The most useful single number on the page is the gap between hours spent and fieldwork complete. An engagement at 45 percent of hours and 40 percent of fieldwork is fine; one at 45 percent of hours and 20 percent of fieldwork is going to overrun by half, and the dashboard shows it in week three, when the engagement budget can still be managed (the fieldwork guide describes the phase shape that makes this visible). Leads under-estimate fieldwork completion when they are behind, so the manager calibrates the lead’s estimate against milestones: if walkthroughs are not complete, fieldwork is not 40 percent done whatever the note says.
Intervention triggers: dive in or trust the lead
The central judgment of portfolio management is when to step into an engagement. Step in too often and the lead stops leading; too rarely and the manager finds out at the closing meeting. Triggers, written down and shared with the leads, turn the judgment into a rule that both sides can predict.
| Trigger | Threshold | Manager’s intervention | What the manager does not do |
|---|---|---|---|
| Hours vs completion gap | Hours % exceeds completion % by 15 points or more | Re-plan conversation with the lead within two days; options, not instructions | Take over the engagement |
| Milestone slip | Any milestone more than five working days late, or two slips in a row | Ask the lead for the cause and the recovery; decide whether to add resource | Move the date without a cause |
| Evidence past due | Any critical item more than ten working days late | Escalate with the lead per the ladder; the manager speaks to the contact’s manager | Chase the item personally |
| Emerging High | Any provisional High rating | Review the evidence and the rating rule with the lead that week; brief the CAE | Rewrite the finding |
| Sponsor red | Any red temperature | Call the sponsor within 48 hours; hear the problem first-hand | Wait for the closing meeting |
| Lead asks for help | Any “needs help” | Same-day conversation; help with the specific problem, then step back | Treat the request as weakness |
| First-time lead | Weeks one and two of their first engagement | Daily ten-minute check-in; review the budget table and the PBC list before issue | Review every workpaper |
| Quality sample fails | Second-review sample finds a form failure the lead should have caught | Coaching conversation with the lead about their review; widen the sample for that engagement | Silently redo the review |
The triggers share a shape: a threshold, a defined intervention that works through the lead, and a stated restraint. The restraint is the half managers forget. A manager who responds to a milestone slip by taking over the closing meeting has solved this week’s problem and created next year’s, because the lead has learned that slipping gets the manager to do the hard part. The review notes guide makes the same point about coaching: the intervention that develops the lead is the one that leaves them with the problem and a better way to solve it.
There is one trigger that overrides the restraint: suspected fraud or a regulatory matter, which goes to the CAE and the first 48 hours protocol immediately, with the manager in the loop from the first hour. Leads should know that this is the one case where the manager will step in without discussion, and why.
Context-switching survival
A manager’s day is interrupted on average every twenty minutes by a different engagement, and each switch costs the recovery time to reload the engagement’s context. Managers who let the day happen to them end it with nothing finished. The discipline is to batch, protect and prepare.
| Practice | How | What it protects |
|---|---|---|
| Engagement blocks | Each engagement gets a fixed weekly slot (an hour for a routine engagement, two for one in reporting); leads bring everything to the slot unless it meets a trigger | Depth of attention per engagement |
| Interrupt rule | Leads interrupt only for triggers; everything else waits for the slot or the stand-up | The manager’s unbroken hours |
| Review windows | Two fixed windows a day for report and finding review; nothing else in them | The function’s report timeliness |
| Context sheets | One page per engagement, maintained by the lead: scope, key contacts, emerging findings, open questions for the manager | Reload time; the manager can be useful in five minutes |
| Decision log | Every decision the manager makes on an engagement, one line, dated | Consistency across engagements; memory |
| Committee weeks | The week before a committee meeting, engagement slots shorten and the leads run on their own; they know this in advance | The pack, and the leads’ independence |
The context sheet is the device that makes the rest work. A manager who can read one page and be back inside an engagement in five minutes can manage eight; one who has to ask the lead to explain where things stand can manage three. The sheet is the lead’s to maintain, which also keeps the lead thinking at the engagement level rather than the workpaper level.
Resource-conflict arbitration
Staff are shared across engagements, co-source hours are finite, and the specialist (the analytics auditor, the IT auditor) is wanted by everyone at once. The manager arbitrates, and the arbitration is fairer and faster when it follows stated rules rather than whoever asks loudest.
- Risk first. The engagement covering the higher-rated area of the plan wins a conflict, other things being equal. This is what the risk-based plan was for; see building the audit plan.
- Committed dates second. An engagement with a report date promised to the committee or a regulator outranks one without.
- Sunk hours third. An engagement in the last 20 percent of fieldwork keeps its people; pulling someone from an engagement near completion wastes the most.
- Development is a tiebreaker, not a trump. When the first three rules do not decide, the assignment that develops someone wins.
- The loser is told why. The lead who loses the specialist for a fortnight hears the rule that decided it, and the dashboard shows the re-plan.
- Record it. Every arbitration goes in the decision log with the rule applied, so that the pattern is visible and the CAE can see whether the plan was under-resourced.
A persistent conflict is information. If the analytics auditor is wanted by six engagements a quarter, the function needs a second analytics auditor or a continuous monitoring layer that removes the repeated manual work; if the same lead always needs more hours, the lead’s scoping or the plan’s estimates are wrong. The year-level version of the same decisions is made when the plan is built and resourced, as the audit plan guide describes with its capacity model; the manager’s arbitration is the week-level version.
Sequencing the quarter so engagements do not peak together
Half of the resource conflicts a manager arbitrates were created at the start of the quarter, when six engagements were scheduled to start in the same fortnight because that was when the plan said they started. A portfolio has a shape, and the manager chooses it.
| Design choice | Weak shape | Better shape | Effect on the portfolio |
|---|---|---|---|
| Start dates | All engagements start in week one of the quarter | Staggered by two weeks so that one engagement is in planning while another is in testing | Review load and specialist demand spread across the quarter |
| Reporting dates | All reports due the week before the committee | Reports due across the quarter; the committee pack summarises issued reports | The manager’s review windows are not overwhelmed in committee month |
| Lead mix | Two first-time leads starting together | A first-time lead starts when an experienced lead is mid-engagement | The manager’s daily check-ins do not collide |
| Specialist use | Analytics needed in the same fortnight by three engagements | Analytics scheduled as a block per engagement, in sequence | The specialist works one engagement at a time |
| Co-source | Co-source hours drawn ad hoc | Co-source assigned to the two engagements that need depth, with a start and end | Predictable cost and a single point of coordination |
| Slack | Every hour allocated | Ten percent of the quarter unallocated | Regulator requests and overruns are absorbed without re-planning everything |
The staggered shape costs nothing and removes most arbitration. It also changes what the dashboard looks like on any given Monday: instead of six engagements at the same stage competing for the same attention, the manager sees one in planning, two in testing, two in reporting and one in follow-up, each wanting a different kind of time. The year-one plan guide shows the same principle at annual scale for a new function.
Developing leads through the portfolio
The portfolio is also the manager’s development instrument. Every assignment teaches the lead something or nothing, and over a year the pattern of assignments is the pattern of the lead’s growth. Managers who assign by availability produce leads who are good at whatever came up; managers who assign by design produce leads who are ready for the next rung.
- Each lead has one stretch assignment a year: a new process family, a first High, a first committee presentation, a first engagement with a co-source firm.
- Each lead has one repeat assignment a year: the engagement they ran last time, run again faster and better, which is where mastery is built.
- First-time leads get an engagement with an experienced staff auditor, a cooperative sponsor and no committee deadline in the first month.
- Leads who ask for help early get the harder assignments next, visibly, so the function learns that asking is rewarded.
- The development notes from the weekly review (minute 40) feed the next quarter’s assignments, not only the appraisal.
The career ladder guide sets out the scope markers for each rung; the manager’s assignments are how a lead accumulates them. A manager who can show the CAE that each lead’s last four engagements form a deliberate sequence has done the talent part of the job, and has usually also solved the retention problem that the pigeonhole guide describes from the auditor’s side.
The weekly portfolio review
The ritual that holds the portfolio together is a weekly review, forty-five minutes, in the same slot every week, that walks the dashboard and produces decisions. Functions that run it catch problems at week two; functions that rely on the leads to raise problems catch them at the closing meeting.
| Minute | Agenda item | Who speaks | Output |
|---|---|---|---|
| 0–5 | Dashboard refreshed; any trigger lines flagged | Manager | The list of engagements that need discussion |
| 5–25 | Triggered engagements, one by one: cause, options, decision | Lead, then manager | Decisions in the log; dashboard “next action” updated |
| 25–30 | Untriggered engagements: one sentence each from the lead | Leads | Confirmation; the manager hears the tone |
| 30–35 | Resource conflicts for the coming fortnight | Manager | Arbitrations recorded |
| 35–40 | Emerging findings across the portfolio: anything thematic, anything the CAE should hear this week | Manager | A note to the CAE; input to the committee pack |
| 40–45 | People: who is stretched, who is bored, who needs a different next engagement | Manager | Development notes |
Three rules make the review work. Leads bring the dashboard filled in; the review does not fill it. Untriggered engagements get one sentence, so that the time goes where the triggers are. And the review ends with the manager’s note to the CAE, which is how the function’s leadership hears about the portfolio without reading every status note. The quarterly committee pack is built from twelve of these notes, which is why the thematic item at minute 35 matters: a theme spotted in week two of three engagements becomes the committee’s most useful insight.
Quality at portfolio level
The manager cannot first-review everything and should not try; the lead first-reviews, and the manager second-reviews deliberately. The choice of what to second-review is a risk decision, and it should be made the same way the function makes other risk decisions.
| Item | Manager’s review depth | Rationale |
|---|---|---|
| Planning memo and scope | Full, before issue | Everything downstream depends on it |
| Work program | Full, before fieldwork | The test design is the engagement’s logic |
| Workpapers | Sample: every High-related workpaper; a random two per staff member per engagement; more for first-time leads and new staff | Risk-weighted coverage with a development signal |
| Findings | Full, as drafted | The findings are the product |
| Report | Full, with the rating rule applied independently | The manager’s name is on it |
| Lead’s review comments | Sample: read the comments the lead wrote on two workpapers | The quality of the lead’s review is the quality of the file |
| Closing meeting | Attend for first-time leads and for any engagement with a High; otherwise the lead runs it | Presence where the stakes are; absence where the lead needs the room |
The last two rows are the ones managers most often get wrong in both directions. Reading the lead’s review comments is the fastest way to know whether the file is sound, and most managers never do it. Attending every closing meeting is the fastest way to stop the leads from developing, and many managers do it out of habit. The review notes guide goes deeper on the reviewer’s craft; the portfolio point is that depth is allocated, not defaulted.
The stakeholder portfolio between audits
A manager owns a set of business relationships that persist across engagements, and the time between audits is where most of the relationship work happens. The trusted advisor guide describes the sequence at function level; the manager’s version is a short list of standing contacts and a cadence.
- A quarterly conversation with each business head in the manager’s portfolio that is not about an engagement: what is changing, what worries them, what they would want audit to look at.
- A monthly glance at the business’s own operating pack for each area, so that the next engagement starts with context rather than discovery.
- Follow-up on open findings handled as a conversation with the owner at each milestone, not as a tracker email; the management responses guide covers what to accept.
- A standing offer: when the business is about to change a process or a system, audit would rather see the design than audit the result. The offer is made with the independence boundary stated once.
- A record: one line per conversation in the stakeholder file, so that the next manager inherits relationships rather than names.
The presenting to the audit committee guide applies the same logic to the chair relationship. For the purposes of running the engagement portfolio, the point is that the stakeholder work is what keeps sponsor temperatures green and evidence flowing, which is what keeps the dashboard quiet.
How portfolios fail
| Failure | Symptom | Cause | Fix |
|---|---|---|---|
| The manager runs the biggest engagement | That engagement is excellent; the others drift | Comfort; it is the work the manager knows | Assign a lead; the manager takes the review role only |
| Status by narrative | Long notes, no numbers; problems emerge in prose on page two | No dashboard | The one-page dashboard with the same columns for every engagement |
| No triggers | The manager intervenes by mood | Triggers never written down | Publish the triggers to the leads |
| The specialist as bottleneck | Every engagement waits for the same person | Plan built without capacity check | Arbitration rules now; capacity fix in next year’s plan |
| Late reports | Fieldwork ends; the report takes six weeks | Reports written at the end; manager review in a queue | Findings skeleton from week one; fixed review windows |
| Leads who never ask | Problems arrive fully formed | “Needs help” is treated as weakness | Reward the early ask, visibly |
| The silent engagement | Nothing on the dashboard for three weeks; then a crisis | An engagement with no triggers tripped and no sentence in the review | The one-sentence rule for every engagement, every week |
| Committee month collapse | The portfolio drifts for three weeks every quarter | The pack consumes the manager | Committee weeks pre-announced; leads run alone by design |
Worked example: an audit manager at Fernhill Communications
Fernhill Communications is a regional telecom and media operator with about $4.8 billion of revenue, 9,400 employees and a 16-person internal audit function: a chief audit executive, three managers, nine auditors and three analysts, with 1,400 co-sourced hours a year. One manager owns the revenue and customer portfolio: billing, dealers, credits, roaming, and the revenue assurance follow-ups. In FY26 her portfolio held six engagements at once with four leads, two of them first-timers, and the function’s delivery record had been 71 and 68 percent of plan in the prior two years.
Her first change was the dashboard. The six engagements had been reporting in six formats; she replaced them with one page, filled by the leads every Thursday, with hours-versus-completion as the first number. In week three it showed the broadband circuit audit at 48 percent of hours and 25 percent of fieldwork, with a first-time lead who had marked himself “on track”. The milestone column told the real story: walkthroughs were not complete. The trigger conversation found the cause in a day (the circuit inventory extract had been requested item by item and was three weeks late) and the fix was the lead’s, with the manager escalating the extract through the network operations director. The engagement finished at 112 percent of budget instead of the 160 percent it was heading for, and found the 14,200 unbilled circuits worth $6.1 million a year that became the function’s biggest finding of the year.
Her second change was the triggers, published to the leads in a one-page note with the restraints spelled out. The dealer activation review, led by an experienced senior, tripped the emerging-High trigger in week five: 23 suspect dealers and 3,100 activations. She reviewed the evidence and the rating rule with the lead that week, briefed the CAE, and did not attend the closing meeting, which the lead ran. The credits audit, with the other first-time lead, tripped nothing for four weeks and got one sentence a week in the review; it finished early. Her third change was the committee-week rule: the week before each of the eight committee meetings, engagement slots halved and the leads knew it.
At year end her portfolio had delivered nine of ten planned engagements on time (the tenth was deferred by the CAE for a regulator request), budget variance was under 10 percent in aggregate, and both first-time leads were running engagements with weekly notes the manager read in ten minutes. The function’s overall delivery, with the other two portfolios adopting the same dashboard, reached 84 percent, and the new external CAE who arrived in Q3 inherited a weekly note she could read in a single sitting.
Frequently asked questions
How many audits can one manager manage at the same time?
Four to eight in flight, depending on their size and the experience of the leads, provided the manager runs them as a portfolio: a one-page dashboard filled by the leads, published intervention triggers, fixed engagement slots, and a weekly review. A manager who first-reviews every workpaper can manage about three.
When should an audit manager step into an engagement?
When a published trigger is met: hours running more than 15 points ahead of fieldwork completion, a milestone more than five days late or two slips in a row, critical evidence more than ten days overdue, a provisional High, a red sponsor temperature, a lead asking for help, or a quality sample failing. The intervention works through the lead; taking over is reserved for fraud and regulatory matters.
What should an audit portfolio dashboard contain?
One page, every engagement on the same scales: stage, hours spent vs planned next to fieldwork percent complete, milestone status, evidence past due, emerging findings by rating, sponsor temperature, the lead’s own confidence, and the manager’s next action. The leads fill every column but the last.
How do you decide who gets a shared specialist when two audits need them?
By stated rules in order: the higher-rated risk area first, committed report dates second, engagements near completion keep their people third, development as a tiebreaker. The losing lead is told the rule that decided it, and the arbitration is logged so that persistent conflicts become evidence for next year’s plan.
How does an audit manager avoid being consumed by context switching?
Fixed weekly slots per engagement, an interrupt rule limited to triggers, two protected review windows a day, a one-page context sheet per engagement maintained by the lead, a decision log, and pre-announced committee weeks when leads run alone.
What is the weekly portfolio review?
A forty-five-minute meeting in the same slot every week: dashboard refreshed, triggered engagements discussed with options and decisions, one sentence from every other lead, resource conflicts for the fortnight, thematic findings for the CAE, and people. It catches problems at week two instead of at the closing meeting.
Related guides
- Running your first engagement as in-charge — the lead auditor’s playbook, one level down.
- How to build an internal audit plan — the worked plan and capacity model the portfolio runs against.
- Audit review notes done right — giving, receiving and clearing them.
- The trusted advisor path — how stature is earned between audits.
- Audit fieldwork — what happens, how to run it week by week.
- Internal audit KPIs — 30 metrics that show whether the function works.
- Reporting to the audit committee — the quarterly pack built from the weekly notes.
- The escalation ladder — when and how to go over someone’s head.
- Implementing audit management software — the first 120 days and migrating off Excel.
Leave a Reply