Internal audit, from where you sit.

The career guide

Understanding internal audit roles

Internal audit job titles are famously inconsistent, the career ladder bends and stretches from one company to the next, and the org chart rarely looks the way outsiders imagine. This section unpacks how it really works.

The typical career ladder

Most internal audit careers follow a recognizable arc, even when the labels differ:

• Analyst / Staff / Junior Auditor — executes test steps, gathers and documents evidence, and drafts workpapers on someone else’s engagement.
• Senior / In-charge Auditor / Audit Lead — runs an individual engagement day to day: builds the program, does the harder testing, supervises juniors, and owns the auditee relationship on the ground.
• Audit Manager — owns several engagements at once, plans and resources them, reviews the team’s work, and usually starts formally managing people.
• Senior Manager / Audit Director — runs a whole audit area or team and owns senior stakeholder relationships.
• Senior Director / Portfolio Head — owns an entire business pillar or region end to end; Managing-Director grade at a large bank. This is the aspirational, high-paid tier just below the top (a whole section on it is below).
• Deputy CAE / IA COO — the leadership team’s number-twos: the CAE’s deputy and successor, and the executive who runs the audit function’s own operations.
• Chief Audit Executive (CAE) / Head of Audit — owns the entire function, sets strategy and the audit plan, and reports functionally to the audit committee.

Around this ladder sit the people internal audit works with rather than in: the board and audit committee (who oversee it), the executives and C-suite (who sponsor it), and the auditees and process owners (who are audited). The exact rungs vary a lot — many functions are far flatter, and the titles are wildly inconsistent. Both are worth understanding.

Typical years in each role

How long does each step take? Broadly — and it really is broad, because internal audit hires mid-career and tenure varies enormously. The IIA’s global CBOK research finds a median chief audit executive reports around 13 years of audit experience, but at a large firm the back half of this table is not one step — it is several tiers of director and senior leadership, which is why reaching the very top routinely takes 20-plus years.

Two caveats. First, external audit at the Big Four runs a faster, more rigid “up-or-out” clock toward partner; in-house internal audit is slower and more tenure-variable (CAEs at smaller companies often arrive far sooner). Second, these are ranges, not rules — people arrive from other fields, jump levels by changing companies, or stall for years. The Manager-to-Director step, and again the Director-to-leadership step, are where many audit careers plateau.

It’s a diamond, not a pyramid

Picture an audit department and you probably imagine a pyramid — a wide base of juniors narrowing to a point. Real internal audit rarely looks like that. Most functions are small and senior-skewed, and the larger ones are often middle-heavy — sometimes described as a “reverse pyramid” or a diamond, with as many or more managers than juniors.

The numbers back this up. In global surveys, roughly half of internal audit functions have five or fewer staff, and around 70% have ten or fewer — at that size, almost everyone is a senior, a manager, or the head of audit. Even at very large companies, a surprising share keep lean in-house teams. Why so few juniors? Several forces push the same way:

• Junior work gets co-sourced or offshored. Around 60% of audit functions (and roughly 70% in financial services) use outsourcing or co-sourcing — pushing testing, documentation, and specialist work like cyber, IT, and SOX outside the in-house junior ranks.
• The review model is layered. Workpapers pass from preparer to senior reviewer to manager to quality assurance — many senior hands per audit, which favors experienced staff over a wide junior base.
• Audit hires mid-career. It is largely a lateral market; plenty of departments rarely hire fresh graduates at all.
• Most teams are simply small. With five or ten people, there is no room for a broad base.

This shape has a hard consequence at the top. There are many audit-manager seats, fewer director seats, and exactly one chief audit executive per company. For a lot of auditors, manager is effectively the ceiling — advancing further usually means waiting out a rare internal opening, moving to another company, or leaving audit altogether. The IIA has even written about “the CAE bottleneck.” It is a big part of why internal audit is so often described as a stepping stone.

The top of the house

Between director and CAE: the leadership layer

Most career maps jump straight from “audit director” to “chief audit executive.” At a large organization that skips the most competitive — and best-paid — stretch of the whole journey. Between a line audit director and the single CAE sits an entire leadership layer, and it is where most senior auditors are actually trying to go:

What a “portfolio” means

An audit “portfolio” is a defined slice of audit coverage — a business pillar (Markets, Consumer Bank, Wealth, Technology) or a region — that one leader owns end to end: its risk assessment, its audit plan, its delivery, and its regulator relationships. Owning a portfolio is the real leap from managing audits to owning a piece of the audit universe.

These are concrete, named roles. RBC posts a “Managing Director, Head of Internal Audit – U.S. Capital Markets” that reports to a Deputy U.S. CAE; Citi runs multiple “Chief Auditor” roles that each own a pillar (Markets; Legal, Compliance & Risk; Technology), sometimes reporting to a more senior Chief Auditor above them; State Street titles its markets-audit head “Head of State Street Markets Audit, Managing Director.” At the very largest banks you can find six distinct layers between a staff auditor and the CAE.

One subtlety worth knowing: a “Senior Director” of internal audit is usually an Executive-Director / SVP-grade role, while a “Head of [business] Audit” or divisional Chief Auditor is a full Managing-Director grade — a real step up, even though both titles contain the word “director” or “head.”

Audit vs. the alternatives

How internal audit compares to other careers

Internal audit sits in the “third line” of an organization’s governance. The first line is the business itself — the managers and process owners who own risk day to day. The second line is risk management and compliance, which set policy and monitor the first line. The third line — internal audit — independently checks that the first two are working, and reports to the board’s audit committee rather than to management. That positioning shapes the whole career.

Compared with the first line, audit trades P&L ownership (and often faster pay) for independence and a cross-business vantage point; auditors frequently exit into the business. Compared with the second line, the skills overlap heavily, but audit is independent of the risk and compliance teams it also reviews, and reports to the board rather than management — which is why risk and compliance are the most common places auditors move to, and vice versa. Compared with external audit at the Big Four, internal audit is broader (operations and risk, not just the financial statements), continuous rather than year-end, and a cost center inside one company rather than a revenue-generating partnership on an up-or-out track. And compared with technology careers, audit is more hierarchical, with earlier board exposure but flatter pay ceilings for pure ICs; the bridge is IT audit, which tends to pay a bit more and opens doors into tech risk and GRC.

What is genuinely unique about an audit career

A few things set internal audit apart. It has real independence by design — you report to the audit committee and never own the controls you review, a structural separation no other corporate function has. It offers unusual breadth — few roles give you a front-row seat across the entire business, sometimes rotating between areas or even countries. And it delivers senior exposure early, with even junior auditors presenting to leadership and the board. That breadth is why auditors exit so well — into controllership, CFO and finance-leadership tracks, risk, compliance, and consulting, or laterally into a CAE seat at a smaller company. The honest counterweight: some worry audit can pigeonhole you, and the very top job (CAE) is increasingly seen as a destination for career auditors rather than a stepping stone.

A note on this guide: it combines practitioner experience with public data — including the IIA’s global CBOK research, Robert Half’s 2026 salary guide, published corporate-grade ladders, and live job postings from major banks. Titles, timelines, and pay vary enormously by company, country, industry, and year, so treat everything here as a broad, expert map — not a precise measurement.