A chief audit executive, usually abbreviated CAE, is the person who leads an organization’s internal audit function and is accountable for it: for its mandate and charter, its independence, its strategy and plan, its people and budget, the quality of its work and the assurance it provides to the board and senior management. The Global Internal Audit Standards define the role in their glossary as the leadership role responsible for effectively managing all aspects of the internal audit function and ensuring the quality performance of internal audit services in accordance with the Standards, and add that the job title and responsibilities may vary across organizations. The title is a role, not a rank: in a bank it may be a general auditor at executive vice president level reporting to a board committee; in a 300-person company it may be one person who also does the fieldwork.
This guide explains what the role is and does. It covers the definition and its three parts, the reporting lines the Standards require and why the functional line to the board is the whole point, the standards that assign duties to the CAE (there are more than thirty), the title variants and what each signals, the calendar of a CAE’s year, how the role differs from an audit director’s, how CAEs are appointed, evaluated, paid and removed, and what the first year looks like. It is written for three readers: an auditor deciding whether to aim for the role (see also how to become a CAE and the career ladder), a board member who oversees one (see hiring a CAE), and an executive who has just been told the CAE does not report to them.
In this guide
- The definition, in three parts
- Reporting lines: functional to the board, administrative to management
- The board’s side of the relationship
- The standards that assign duties to the CAE
- The responsibilities, grouped
- Title variants and what they signal
- A CAE’s year
- CAE versus audit director: the difference that matters
- Appointment, evaluation, remuneration and removal
- When the CAE wears other hats
- The role in small and large organizations
- What the role requires of the person
- Template: the CAE role description for a charter or job posting
- Worked example: Brightwater Foods’ first chief audit executive, year one
- Questions about the chief audit executive role
- Related guides
The definition, in three parts
The glossary definition has three load-bearing phrases. “Leadership role” means the CAE is defined by accountability, not by a title or a grade; whoever holds the accountability holds the role. “All aspects of the internal audit function” means nothing in the function sits outside the CAE’s responsibility: not the co-source firm’s work, not the SOX team’s testing if it reports into audit, not the quality of a staff auditor’s workpapers. “Quality performance in accordance with the Standards” means the CAE is the person who answers for conformance, which is why the Standards address so many requirements to the CAE by name.
| Phrase in the definition | What it establishes | Consequence |
|---|---|---|
| Leadership role | The role exists wherever the function exists; it may be held by a person of any grade | A one-person function has a CAE; an outsourced function has one on the organization’s side (Standard 7.2 addresses this) |
| Responsible for effectively managing all aspects of the function | Strategy, plan, resources, methodology, communication, quality, people, budget, technology | Domain IV’s sixteen standards are addressed to the CAE |
| Ensuring quality performance in accordance with the Standards | Conformance is personal accountability | The CAE signs the conformance statement, owns the QAIP and answers to the external assessor |
| Job title and responsibilities may vary | The Standards do not care what the role is called | Head of internal audit, chief auditor, general auditor and inspector general are all CAEs if they hold the accountability |
Reporting lines: functional to the board, administrative to management
The defining structural feature of the role is the dual reporting line. Standard 7.1, Organizational Independence, requires the CAE to report functionally to the board, and the board’s essential conditions in Domain III list what functional reporting means: the board approves the charter, the plan, the budget and resource plan, and the CAE’s appointment, removal and remuneration; it receives communications from the CAE directly; it meets the CAE privately without management present; and it makes inquiries of management and the CAE about scope or resource limitations. Administratively the CAE may report to the chief executive or another senior executive for day-to-day matters: office space, payroll, performance process logistics. The Three Lines Model says the same thing in its footnote: for administrative purposes the CAE may also report to an appropriately senior level of management.
| Matter | Functional line (the board, usually the audit committee) | Administrative line (usually the CEO) |
|---|---|---|
| Charter | Approves | Consulted |
| Audit plan and changes | Approves; told of limitations | Consulted; provides input to the risk assessment |
| Budget and resources | Approves adequacy | Processes through the organization’s budget cycle |
| CAE appointment and removal | Decides | Participates in recruitment; cannot remove |
| CAE performance evaluation and pay | Decides, with management input | Provides input on administrative performance |
| Engagement results and the annual conclusion | Receives directly (Standard 11.3) | Receives as a client of the function |
| Accepted risks (Standard 11.5) | Informed when management accepts a risk the CAE considers unacceptable | Makes the acceptance decision |
| Private sessions | At least annually without management | Not present |
| Day-to-day administration | Not involved | Office, systems, HR process, expenses |
The arrangement exists because the function audits management, and a function whose head can be dismissed or starved of budget by the people it audits cannot be relied on. Domain I states the condition plainly: internal auditing is most effective when the function is independently positioned with direct accountability to the board. The independence and objectivity guide works through the cases where the line is impaired and what the CAE must disclose; the Domain III guide covers the board’s essential conditions in full.
The board’s side of the relationship
A CAE’s effectiveness depends as much on the board as on the CAE. The Three Lines Model lists what the governing body owes the function: establishing an independent, objective and competent internal audit function; hiring and firing the CAE; serving as the primary reporting line; approving and resourcing the plan; receiving and considering the CAE’s reports; and enabling free access, including private sessions. The Standards’ Domain III turns these into essential conditions and adds the annual performance evaluation of the CAE, the review of the charter, and the external quality assessment at least every five years. A CAE whose committee does none of these has a job title and no role; the audit committee playbook describes the committee’s obligations from its own side, and the presenting to the audit committee guide covers the CAE’s quarterly ten minutes.
The standards that assign duties to the CAE
The Standards name the chief audit executive in the requirements of more than thirty standards. The table groups them; the reference map has every standard’s title.
| Area | Standards naming the CAE | What the CAE must do |
|---|---|---|
| Ethics (Domain II) | 1.1, 1.2, 1.3, 2.1, 2.2, 2.3, 3.1, 3.2, 4.1, 4.2, 5.1, 5.2 | Establish the policies and processes that make the ethics principles operate: integrity, courage, objectivity safeguards, competency, due care, confidentiality; address impairments; confirm the Code is followed |
| Governance (Domain III) | 6.1, 6.2, 6.3, 7.1, 7.2, 8.1, 8.2, 8.3, 8.4 | Draft and maintain the mandate and charter; discuss them with the board; report functionally to the board; secure the board’s support for resources; maintain the QAIP and arrange the external assessment |
| Strategy and plan (Domain IV, Principle 9) | 9.1, 9.2, 9.3, 9.4, 9.5 | Understand governance, risk management and control; develop the function’s strategy; establish methodologies; build and maintain the risk-based plan; coordinate with other assurance providers and decide reliance |
| Resources (Principle 10) | 10.1, 10.2, 10.3 | Manage financial resources; recruit, develop and deploy competent people; obtain and use technology |
| Communication (Principle 11) | 11.1, 11.2, 11.3, 11.4, 11.5 | Build relationships; set communication standards; communicate results to the board and management; correct errors; communicate accepted risks |
| Quality (Principle 12) | 12.1, 12.2, 12.3 | Internal assessments; performance measurement; oversight and improvement of engagement performance |
| Engagements (Domain V) | 13.1 to 15.2 (through the function’s methodologies and supervision) | Ensure engagements are planned, performed, documented and communicated to the Standards; confirm implementation of actions |
The responsibilities, grouped
Translated out of the Standards’ numbering, the role has seven jobs. Most CAEs find that three of them (the plan, the people and the board) consume most of the year, and that the one they are least prepared for is the sixth.
| Job | What it involves | Where it goes wrong | Guide |
|---|---|---|---|
| 1. Hold the mandate | Charter, independence, authority, scope; renegotiated whenever the organization changes | A charter last approved in 2017; reporting line drifts to the CFO | Charter; independence |
| 2. Know the organization and set the strategy | Understanding objectives, risks, governance; a three-to-five-year strategy for the function (9.2) | No strategy; the plan is last year’s plan | Domain IV |
| 3. Build and deliver the plan | Risk assessment, universe, plan, changes, reliance decisions, delivery to budget | Rotation instead of risk; silent reliance on second line work | Risk assessment; plan |
| 4. Lead the people | Hiring, competency, development, deployment, retention, co-source management | Competency gaps in technology; turnover with no pipeline | Certification roadmap; co-sourcing |
| 5. Own quality | Methodology, supervision, QAIP, external assessment, performance measures | Conformance claimed without an external assessment | QAIP playbook; EQA |
| 6. Communicate and escalate | Board reporting, management relationships, accepted risks, fraud escalation, regulatory interaction | Findings reported without an overall conclusion; accepted risks never reach the board | Presenting to the committee; risk acceptance; fraud protocol |
| 7. Run the function as a business unit | Budget, technology, data, tools, vendor management for the audit system | Audit management system bought without requirements; no analytics capability | System selection; software guide |
Title variants and what they signal
| Title | Where it is used | What it signals | Is it the CAE? |
|---|---|---|---|
| Chief Audit Executive | The IIA’s term; US corporates, increasingly global | C-level framing; functional reporting to the board expected | Yes |
| Head of Internal Audit | UK, Europe, Asia-Pacific, financial services | Functional head; grade varies widely | Yes |
| General Auditor | Large US banks and insurers; some utilities | Executive vice president or managing director grade; a large function with portfolio heads beneath | Yes |
| Chief Auditor | Banks (often with “Group” or a division name); some public bodies | At group level, the CAE; at divisional level, a portfolio head reporting to the group CAE | Group level yes; divisional level no (see the by-role hub on the leadership layer) |
| Vice President, Internal Audit; SVP Internal Audit | US mid-cap corporates | Grade label; the role depends on the reporting line | Yes if functionally accountable to the board |
| Director of Internal Audit | Mid-size organizations; universities; nonprofits | Often the CAE in substance; sometimes a director under a CAE | Depends on whether anyone sits above them in the function |
| Inspector General | US federal agencies and some state and local governments | Statutory role with investigative powers; reports to the agency head and the legislature | Yes, with duties beyond the Standards |
| Audit Executive (outsourced function) | Organizations whose internal audit is fully outsourced | The organization-side person accountable for the provider (Standard 7.2) | Yes; the provider’s partner is not the CAE |
A CAE’s year
The role has a calendar driven by the board’s calendar and the Standards’ annual requirements. A fiscal year that starts in January looks like the table; the committee deck template covers each quarterly meeting’s content.
| Quarter | Board-facing | Function-facing | Standards |
|---|---|---|---|
| Q1 | Annual report on the prior year: overall conclusion, plan completion, open actions, performance measures; charter review; private session | Prior-year engagements closed; performance review of staff; internal assessment results | 11.3, 12.2, 6.2, 8.1 |
| Q2 | Mid-year plan status; emerging risks; any plan changes for approval; external auditor coordination update | Risk assessment refresh begins; competency gaps and training; co-source review | 9.4, 9.5, 10.2 |
| Q3 | Plan changes; accepted risks; follow-up status with aged past-due actions; the CAE’s own evaluation input | Risk assessment and universe refresh; budget build for next year; QAIP self-assessment | 9.1, 9.4, 11.5, 12.1 |
| Q4 | Next year’s plan, budget and resource plan for approval; reliance decisions disclosed; strategy update; CAE performance evaluation and remuneration | Plan finalized; staffing; methodology updates for standards changes effective next year; technology roadmap | 9.2, 9.3, 9.4, 10.1, 10.3, 8.2 |
| Any time | Fraud escalation; significant findings; scope limitations; regulator interaction | Engagement supervision; quality reviews; management relationships | 1.3, 11.2, 11.3, 12.3 |
CAE versus audit director: the difference that matters
In many organizations the title “director of internal audit” is the CAE in substance. In large functions it is not: a director runs a team or a portfolio and reports to the CAE, and the difference is accountability for the whole. The by-role hub describes the leadership layer between director and CAE in large financial institutions (senior director, portfolio head or divisional chief auditor, deputy CAE, internal audit COO), which exists precisely because the CAE’s accountability cannot be delegated but the work can.
| Dimension | Audit director (one team or portfolio) | Chief audit executive |
|---|---|---|
| Accountable for | A set of engagements and a team | The function: mandate, plan, people, quality, assurance to the board |
| Reports to | The CAE or a portfolio head | The board functionally; an executive administratively |
| Signs | Engagement reports in their portfolio | The annual conclusion; the conformance statement; the charter proposal |
| Board interaction | Occasional presentation of a significant engagement | Every meeting; private sessions; appointment and evaluation by the board |
| Plan | Delivers a share of it; proposes engagements | Owns the risk assessment and the whole plan; decides reliance; takes it to the board |
| Standards | Domain V and parts of 12.3 through supervision | Named in more than thirty standards across Domains II to IV |
| Independence | Objectivity at engagement level | Organizational independence of the function (7.1), personally |
| Career signal | Expertise and delivery | Judgment, courage and the relationship with the board (interviewing for CAE) |
Appointment, evaluation, remuneration and removal
The Standards place all four in the board’s hands as essential conditions. In practice the board usually delegates the process to its audit committee and the committee chair runs it: a search in which management participates but the committee decides; an annual evaluation led by the chair with input from the CEO and CFO on administrative matters; remuneration set or approved by the committee so that management cannot reward a quiet year; and removal only by the committee, with the reasons minuted. The hiring a CAE guide covers the search from the committee’s side; the first 90 days as CAE guide covers what a candidate should negotiate before accepting, starting with the functional reporting line. Regulated financial institutions add supervisory expectations: the OCC’s heightened standards and the UK senior managers regime both treat the head of internal audit as a prescribed role whose appointment and removal are notifiable, and the what regulators expect guide describes the examiner’s interest in the CAE’s independence.
When the CAE wears other hats
Smaller organizations often ask the CAE to run something else: enterprise risk management, compliance, the SOX program, investigations, or a combination. Standard 7.2, Chief Audit Executive Qualifications and Responsibilities Beyond Internal Auditing, addresses this directly: when the CAE has responsibilities beyond internal auditing, safeguards must be in place and the board must approve them, and the function may not provide assurance over areas the CAE is responsible for. The Three Lines Model says the same: assurance over such areas must come from a qualified third party. The practical safeguards are disclosure in the charter, a third-party review of the other activity on a cycle, and a plan to hand the activity back. A CAE who runs ERM for three years and audits nothing in the risk function has a conflict the external assessor will write up; the internal audit’s role in ERM guide sets out what the function can and cannot do.
The most common second hat is the SOX program. When management’s control testing reports into internal audit, the function is performing a management responsibility (SOX testing is management’s evidence for its own assessment under Section 404(a)), and the CAE must keep it visibly separate from the function’s own assurance work: separate workpapers, separate reporting, and a clear statement in the charter that SOX testing performed for management is advisory to management rather than third line assurance. The SOX 404 guide explains why the distinction matters to the external auditor as well as to the board.
The role in small and large organizations
| Dimension | Small (1 to 5 auditors) | Mid-size (6 to 25) | Large (25 to several hundred) |
|---|---|---|---|
| What the CAE personally does | Fieldwork, every report, the plan, the board | Supervision, significant engagements, the plan, the board, the people | Strategy, the board, regulators, portfolio heads, quality, the budget |
| Board interaction | Quarterly with a small committee; often the whole board | Quarterly audit committee; private session annually | Audit committee every meeting; risk committee; regulators; subsidiary boards |
| Hardest part | Independence when everyone knows everyone; covering the universe | Building competency in technology; the first external assessment | Consistency across portfolios; reliance decisions at scale; succession |
| Typical structure beneath | None, or one senior | Audit manager(s), seniors, staff, analytics or IT specialist | Deputy CAE, portfolio heads, directors, specialists, methodology and quality team |
| Co-sourcing | Essential for IT and specialist areas | Common for technology and cyber | Targeted; the function has most skills in-house |
| Example on this site | Small-company function; Brightwater’s first CAE below | MidState Beverage, six auditors | Lakeshore Bancorp, 22 auditors; the big-bank ladder in the by-role hub |
What the role requires of the person
Standard 7.2 also requires the CAE to have the qualifications and competencies to manage the function and to maintain them. The competencies that distinguish CAEs who succeed from those who merely hold the title cluster into five. Judgment about risk: knowing which of forty things matters this year. Courage: Standard 1.3 names professional courage as a standard, and the CAE is the person who has to report the finding the CEO does not want reported. Relationship with the board: the ability to give a chair a one-page view of a complex problem and to say “I do not know yet” when that is true. Leadership of auditors: hiring people better than oneself at the technical work and keeping them. And literacy in the organization’s business and technology, deep enough to be credible with the executives being audited. The becoming a CAE guide maps these to a career path, and the CFE, CISA and CIA guides cover the credentials boards look for; the CIA is the one most commonly expected.
Template: the CAE role description for a charter or job posting
The Chief Audit Executive. The chief audit executive leads the internal audit function and is accountable for all aspects of it: the mandate and charter, organizational independence, the function’s strategy and risk-based plan, its people, budget and technology, the methodologies under which it works, the quality of its services and its conformance with the Global Internal Audit Standards, and the assurance, advice, insight and foresight it provides to the board and senior management. The CAE reports functionally to [the audit committee of the board], which approves the charter, the plan, the budget and the CAE’s appointment, removal, performance evaluation and remuneration, receives the CAE’s communications directly, and meets the CAE in private at least annually. The CAE reports administratively to [the chief executive officer]. The CAE has unrestricted access to all records, personnel and premises relevant to the function’s work, communicates to the board any risk management decision the CAE believes exposes the organization to an unacceptable level of risk, and escalates matters of suspected fraud under the organization’s protocol. [Where the CAE holds responsibilities beyond internal auditing, those responsibilities, the safeguards and the arrangements for independent assurance over them are set out in Schedule [x], approved by the board.] The CAE maintains the qualifications and competencies required to lead the function, including [the Certified Internal Auditor designation or equivalent] and continuing professional development in accordance with the Standards.
Worked example: Brightwater Foods’ first chief audit executive, year one
Brightwater Foods is a $180 million food manufacturer with three plants and about 600 staff, used in examples across this site. For years its internal audit was a co-sourced arrangement sponsored by the finance director, which meant the function had a provider but no chief audit executive: nobody on the organization’s side held the accountability the Standards describe. When the board formed an audit committee, it hired its first CAE, a senior manager from a larger manufacturer, whose first act, described in detail in the first 90 days guide, was to negotiate functional reporting to the committee chair before accepting the role. The committee approved a charter, the CAE’s appointment and a budget that funded a second in-house auditor from the eleven-page day-90 report.
The rest of year one shows the seven jobs in sequence. The mandate: charter approved in month three, with the co-source firm’s reporting rerouted from the finance director to the CAE. Knowing the organization: 26 listening conversations and a rebuilt audit universe in six weeks. The plan: a risk-based plan approved in month four, which included the function’s first cybersecurity assessment against NIST CSF 2.0 (76 of 106 subcategories, nine findings) and the ransomware readiness review that found no immutable backup copy and a nine-day recovery estimate against a five-day tolerance. The people: the second auditor hired in month five; the co-source firm kept for technology work under a statement of work the CAE now owned. Quality: a methodology adopted from the co-source firm’s and localized; the first self-assessment scheduled for year two. Communication and escalation: in week five the CAE escalated the 60-days-past-due immutable-backup action to the committee, which funded it; the first annual report gave the committee an overall conclusion on the control environment rather than a list of engagements. Running the function: a time-recording habit, an issue log and a decision not to buy an audit management system until the function had more than five people.
| CAE job | Before (co-sourced, no CAE) | End of year one |
|---|---|---|
| Mandate | Engagement letters with the provider; no charter; sponsor was the finance director | Board-approved charter; functional reporting to the committee chair |
| Strategy and plan | Provider proposed engagements annually | Risk-based plan approved by the committee; three-objective strategy |
| People | Provider’s staff only | CAE plus one in-house auditor; provider for technology under the CAE’s statement of work |
| Quality | Provider’s methodology, unreviewed | Localized methodology; self-assessment scheduled |
| Communication | Reports to the finance director; committee saw summaries | Direct reporting; private session held; one escalation funded in week five |
| Function as a business unit | No budget line; provider invoices through finance | Approved budget; time records; issue log |
| Health check (day 90, ten areas) | 8 of 10 absent | 4 of 10 absent, 4 developing, 2 established |
Questions about the chief audit executive role
Is the chief audit executive a C-suite role?
By accountability, yes: the CAE answers to the board for a whole function, like a CFO or a general counsel. By grade, it varies: in large banks the general auditor is an executive vice president; in a mid-cap the CAE may be a vice president; in a small company the role may be held by a manager. The reporting line to the board, not the grade, is what makes the role.
Who does the chief audit executive report to?
Functionally to the board, usually through its audit committee, which approves the charter, plan, budget and the CAE’s appointment, evaluation, pay and removal. Administratively to a senior executive, usually the CEO, for day-to-day matters. Reporting functionally to the CFO does not conform with Standard 7.1.
What is the difference between a CAE and a head of internal audit?
None in substance. Chief audit executive is the IIA’s term; head of internal audit is the usual title in the UK, Europe and Asia-Pacific. Both describe the person accountable for the whole function.
Can the CAE also be the chief risk officer or chief compliance officer?
The Standards permit responsibilities beyond internal auditing with board-approved safeguards (Standard 7.2), but the function then cannot provide assurance over those areas, which must be reviewed by a qualified third party. In regulated financial institutions supervisors generally expect the roles to be separate.
What qualifications does a CAE need?
Standard 7.2 requires the qualifications and competencies to manage the function. Boards commonly look for the Certified Internal Auditor designation, often alongside a CPA, CISA or CFE depending on the organization, plus ten to fifteen years of audit and leadership experience and literacy in the organization’s industry and technology.
How is a CAE’s performance evaluated?
By the board, usually the audit committee chair, at least annually, with input from management on administrative matters. The evaluation draws on the function’s performance measures (Standard 12.2), the quality program’s results, plan delivery and the committee’s own assessment of the assurance it received.
What does a CAE earn?
It ranges from the upper end of director pay in a mid-size company to seven figures for a general auditor at a global bank. The salary guide gives published ranges by level with sources and dates, and explains why aggregator figures understate large-institution pay.
Related guides
- How to become a chief audit executive — the path to the role.
- Your first 90 days as chief audit executive — the day-by-day plan.
- Hiring a chief audit executive — the committee’s guide to the search.
- Interviewing for CAE — the audit committee panel.
- The internal audit career ladder — staff to CAE, level by level.
- Internal audit by role — the leadership layer between director and CAE.
- GIAS Domain III: Governing the function — the board’s essential conditions.
- GIAS Domain IV: Managing the function — the sixteen standards addressed to the CAE.
- Independence and objectivity in internal audit — reporting-line cases.
- How to create an internal audit charter — the mandate document.
- The audit committee playbook — the relationship from the committee’s side.
- Presenting to the audit committee — the quarterly ten minutes.
- The CAE’s audit committee deck template — the slides.
- Five essential tips for CAEs — practical advice for the role.
- Internal audit’s role in ERM — when the CAE is asked to run risk.
- Internal auditor salary guide — what the role pays.
- The audit committee charter — a clause-by-clause template.
- The audit committee annual agenda — the quarter-by-quarter calendar.
- Internal audit KPIs and metrics — measuring the function without gaming it.
- GIAS Domain I: the purpose of internal auditing — the Standards’ statement of what the function is for.
- The One-Person Internal Audit Shop: Operating Manual — running a credible function alone: proportionate method, quality without a reviewer, independence and the case for a second person
- The Year-One Internal Audit Plan: What to Audit First — foundation audits, early wins, sizing and sequencing for a new function’s first twelve months, with three example plans
- Your First Audit Committee Meeting as CAE: How to Prepare — pre-meeting one-on-ones, the content arc, candor on inherited problems and the rituals to propose.
Leave a Reply