Internal Audit Job Description

An Internal Auditor is a qualified finance or risk professional responsible for providing independent assurance to the board and the audit committee that the organisation’s risk management, controls and governance processes are operating effectively. Internal audit is a distinct discipline from external audit: where the external auditor provides an independent opinion on the truth and fairness of the financial statements, the internal auditor provides an ongoing assessment of whether the business’s internal risk management and controls are designed and operating effectively across all areas of the business — financial, operational, IT and compliance.

This page provides a complete Internal Audit job description template for 2026, alongside qualification requirements, salary benchmarks and the career paths available to internal audit professionals. See the Financial Accountant JD for the external audit equivalent and the What Is an Audit Senior? guide for the external audit career path.

Internal Audit Job Description — 2026 Template

Role title: Internal Auditor / Senior Internal Auditor / Internal Audit Manager  |  Reports to: Head of Internal Audit / Audit Committee  |  Salary: £50,000–£95,000 depending on level  |  Updated: June 2026

Role Overview

The Internal Auditor provides independent, objective assurance and advisory services to the organisation by evaluating and improving the effectiveness of risk management, controls and governance processes. Reporting functionally to the Audit Committee (for independence) and administratively to the Head of Internal Audit or CFO, the Internal Auditor plans and executes risk-based audit assignments across the business, identifies control weaknesses and improvement opportunities, reports findings with recommendations to management and the Audit Committee, and follows up to confirm that agreed actions have been implemented.

Key Responsibilities

Risk-based audit planning. Contribute to the internal audit universe — the mapping of all significant processes and risk areas in the business that may be subject to audit — and participate in the annual risk assessment that prioritises which areas of the universe will be audited in the coming year. Prepare or review individual audit scoping documents that define the objectives, scope, approach and timing of each audit assignment.

Audit fieldwork execution. Execute audit procedures to gather evidence that the controls identified in the audit scope are designed and operating effectively. For financial process audits, this may include transaction testing, reconciliation review, segregation of duties assessment and management override testing. For operational audits, this may include process walkthroughs, data analytics, policy compliance review and exception reporting analysis.

Audit findings and recommendations. Document audit findings clearly — the specific control weakness or risk identified, the root cause of the weakness, the potential impact if not remediated, and a specific, actionable recommendation for improvement — and present them to the business area management for factual accuracy confirmation before inclusion in the audit report.

Audit reporting. Prepare formal internal audit reports for distribution to the relevant business area management, the CFO and (for significant findings) the Audit Committee. Reports should be clear, concise and action-oriented — the standard that distinguishes a strong internal audit report from an average one is that the reader can understand the finding, the risk and the recommended action in two minutes without specialist audit knowledge.

Management action tracking. Maintain a tracking schedule of management actions agreed in response to internal audit findings. Follow up with business area management at agreed intervals to confirm that actions have been implemented and, where they have not, escalate overdue or unresolved actions to the Head of Internal Audit or the Audit Committee.

Audit Committee support. Contribute to the preparation of internal audit reports for the Audit Committee, including the summary of audit activity in the period, the overall opinion on the control environment and any significant outstanding management actions.

Control advisory. Provide advisory support to business area management on the design of new processes, systems and controls — helping the business build effective controls into new activities from the outset rather than identifying control failures after the fact.

Qualifications and Experience Required

Qualification: ACA, ACCA or CIMA qualification — or the Chartered Internal Auditor (CIA) qualification awarded by the Institute of Internal Auditors (IIA) — is the market standard for Internal Auditor roles at £50,000 and above. The CIA is the primary professional qualification specifically for internal auditors and is increasingly required at Internal Audit Manager level and above. ACA or ACCA qualifications are particularly valued where the internal audit function’s scope includes significant financial process audit and financial controls assurance. CIMA is valued where the operational and commercial audit dimensions are primary.

Experience: Two to six years of internal audit experience, including experience of planning and executing risk-based internal audit assignments independently. Experience of presenting audit findings to management and of writing formal audit reports to a professional standard. At Internal Audit Manager level: experience of managing a team of internal auditors and of presenting to the Audit Committee.

Technical skills: Familiarity with internal audit methodologies (COSO, Three Lines of Defence, risk-based internal auditing per the IIA Standards). Data analytics capability is increasingly valued — the ability to use ACL, IDEA, SQL or Excel-based data analytics to identify exceptions and patterns in large transaction datasets. Understanding of IT general controls and application controls is valued at businesses with significant ERP or digital system exposure.

Internal Auditor Salary Benchmarks — 2026

These benchmarks reflect the 2026 market for internal audit professionals at Accountancy Capital’s placement threshold. Financial services firms — banks, asset managers, insurers — typically pay at the upper end of each range, reflecting the regulatory complexity and the specific FCA or PRA internal audit requirements that apply to regulated businesses. See London Accountancy Salary Guide 2026 for all qualified finance role benchmarks.

Internal Audit vs External Audit: Key Differences

Internal Audit Career Path

The internal audit career path within an in-house function typically progresses: Internal Auditor → Senior Internal Auditor → Internal Audit Manager → Senior Internal Audit Manager → Head of Internal Audit / Chief Audit Executive. The timeline from qualified IA to Head of Internal Audit is typically ten to fifteen years, depending on the size of the organisation, the pace of the internal audit function’s development and the professional’s specific audit experience.

A significant proportion of experienced internal audit professionals transition into risk management, compliance, finance business partnering or Financial Controller roles at the Senior Manager or Manager level — typically at five to eight years of internal audit experience — where the analytical and organisational knowledge developed through internal audit provides a differentiated perspective in operational finance or risk roles. Accountancy Capital places internal audit professionals transitioning into broader finance roles through the Qualified Finance Recruitment service.

The Three Lines of Defence: Internal Audit’s Role

The Three Lines of Defence (now more commonly referred to as the Three Lines model following the IIA’s 2020 update) is the primary framework for understanding where internal audit sits within an organisation’s governance structure.

First line: operational management — the business units and functions that own and manage risk as part of their day-to-day operations. They implement and maintain controls as part of normal business activity.

Second line: risk management and compliance functions — the risk management team, the compliance function, the legal function — that provide oversight, frameworks and tools to support the first line’s management of risk.

Third line: internal audit — which provides independent, objective assurance to the governing body (the board and the audit committee) on the effectiveness of risk management and controls across both the first and second lines. Internal audit’s independence from both the first and second lines is what gives its assurance credibility — it is not part of the management structure it is assessing.

Internal Audit in Different Business Contexts

Listed and listed-adjacent businesses. The most mature internal audit functions — with a dedicated team, a formal audit committee, a structured annual internal audit plan and a Chief Audit Executive (CAE) reporting directly to the audit committee chair — are found at listed and listed-adjacent businesses. The FRC and the UK Corporate Governance Code set expectations for the internal audit function at premium-listed companies that drive the development of the most sophisticated in-house internal audit practices.

PE-backed businesses. Many PE funds now require their portfolio companies to have an internal audit function or to use a co-sourced internal audit provider — particularly at businesses above £30m–£50m revenue with a group structure. The PE-backed internal audit function typically focuses on financial controls assurance, financial reporting risk and acquisition integration.

Financial services / FCA-regulated businesses. Internal audit in FCA-regulated businesses has specific obligations under the FCA’s Senior Management and Certification Regime (SMCR) and the PRA’s expectations for regulated firms. The Head of Internal Audit at a regulated firm is often designated as a Senior Management Function (SMF5) under the SMCR, carrying personal accountability for the adequacy of the firm’s internal audit arrangements. See FCA Regulated Firms Accountancy Recruitment for the specific regulatory context.