On this page
- Resume guide for an internal auditor resume
- How to write an internal auditor resume
- Choosing the best resume format for an internal auditor resume
- Include your contact information
- Make use of a summary
- Right vs wrong: the same internal auditor summary, twice
- Outline your internal audit experience
- Write the audit plan and the follow-up register, not just the findings you raised
- Build a snapshot of your key skills
- List your education and certifications
- Choose the right layout and design
- Internal auditor job market and outlook
- What salary you can expect as an internal auditor
- Key takeaways for an internal auditor resume
- Related business and management resume examples
- FAQ
In short, an internal auditor resume is a one to two page document about a plan. That is, not a client list, not a busy season, not a set of engagements somebody else staffed you on. The annual audit plan, how it got risk-ranked, who you reported to when it was uncomfortable, and what happened to your findings after the report went out.
That last item is the one almost nobody writes and the one a chief audit executive looks for. Moreover, raising a finding is the easy half. In contrast, getting management to agree an action, watching the date pass, chasing it, and verifying the control now works is the half that costs relationships.
If you are still choosing between external and internal audit, our auditor resume example sets out the fork. This page assumes you have picked internal.
Resume guide for an internal auditor resume
To that end, this guide and the corresponding internal auditor resume example will cover:
- To begin with, how to write an internal auditor resume, block by block
- The annual audit plan, and how to show you helped build it rather than execute it
- Then, three adaptable summaries: associate, senior and audit manager
- Also, the follow-up register, the block that separates this file from an external audit file
- Finally, what the job market looks like and what you can expect to earn
How to write an internal auditor resume
Overall, six blocks: contact header, summary, the audit plan and coverage, experience, the follow-up record, and education and certifications. However, the header has a job the external audit header does not: it places you on an organization chart. How large the function is, where it sits, and whether you have ever been in a room with an audit committee.
BlockWhat it is answeringWhere it goes
- Plan and coverageHow big is the plan, how was it ranked, what share did you own?Under the summary
- Reporting lineWho does the function report to, functionally and administratively?One line in the header
- ExperienceWhat did you audit, and what changed because of it?Reverse chronological, one number per bullet
- Follow-upWhat happened to the findings after the report?Its own labeled block
- CertificationsCIA and anything else, with the issuing body and the yearLast, explicit rather than implied
Put the reporting line in the header, because it is the whole job
Internal audit only works if it is positioned where management cannot quietly manage it. The IIA's Global Internal Audit Standards make that structural: of the 15 principles, principle 7 is "Positioned Independently" and principle 8 is "Overseen by the Board", and Domain III requires chief audit executives to work with the board "to establish the internal audit function, position it independently, and oversee its performance" (The IIA, accessed 14 September 2026).
So write the line. "Functional reporting to the audit committee, administrative reporting to the chief financial officer" tells a reader what kind of function you came out of. If yours reported only to a finance executive with no board line, say that too; it is common, it is not a disqualification, and describing it accurately beats implying a governance structure you did not have.
Run the finished file through the free ATS resume checker before you submit. Internal audit postings filter on the certification, the framework and the systems, and a two-column template scrambles all three.
Choosing the best resume format for an internal auditor resume
Reverse chronological, single column. One page for your first three years, two once you plan audits rather than perform them.
For example, an associate executes a program somebody wrote; a senior scopes the audit and writes the findings; a manager owns a slice of the plan and presents to a committee. Keep those as separate entries even inside one employer, because the promotion dates are the evidence. Indeed, a functional format fails here: the work is documentation, sequence and evidence, and a file that removes the sequence is an odd artifact to hand someone who reviews workpapers for a living.
Include your contact information
Teodora Vlahovic
Senior Internal Auditor, CIAHealth system, 14-engagement plan, functional reporting to the audit committee(216) 555-0664, teodora.vlahovic@example.com, Cleveland, OHTeodora Vlahovic
Audit and risk professionalExperienced in internal controls, risk and compliance(216) 555-0664, teodora.audit.ohio@example.comAbove all, the third line does the work of a paragraph. Sector, plan size and reporting line say whether you have worked at their scale and inside their governance structure, before anyone reads a bullet.
Make use of a summary
Four lines: function and sector, the plan and your share of it, the reporting line, and one thing that changed because you audited it.
Internal audit associate adaptable resume summary example
Senior internal auditor adaptable resume summary example
Internal audit manager adaptable resume summary example
Right vs wrong: the same internal auditor summary, twice
The right column says what you were accountable for and whether it stuck. In contrast, the left column is what the other thirty files said.
Outline your internal audit experience
Then give the employer, what the organization does and how large it is, the size of the audit function, and dates. Then four to six bullets, each naming a process and what management did about it.
- Instead of
Performed internal audits of various departments
UseLed 7 of 14 engagements in the plan, covering revenue cycle, supply chain and third-party management
- Instead of
Tested internal controls
UseTested 48 key controls across three cycles, 19 of them by reperformance rather than inquiry
- Instead of
Identified control weaknesses
UseRaised 22 observations, 6 rated high, all 6 with an agreed action, a named owner and a date before issue
- Instead of
Followed up on audit findings
UseRan a register of 61 open actions, closing 54 and verifying 41 by retesting rather than by assertion
- Instead of
Assisted with the annual audit plan
UseContributed the residual risk ranking for 9 of 34 auditable entities on a documented model
Adaptable resume employment history example
Senior Internal Auditor, Thornemere Health Partners, Cleveland, OH, March 2023 to Present
Lead 7 of the 14 engagements in the annual plan for a health system of roughly 6,000 employees, covering revenue cycle, supply chain, third-party management and physician contracting.
Contribute the residual risk ranking for 9 of the 34 auditable entities, on a documented likelihood and impact model refreshed every six months.
Scope each engagement, write the program and test the key controls: 48 tested last year, 19 by reperformance.
Raised 22 observations, 6 rated high, each with an agreed action, a named owner and a date settled before the report issued.
Own the follow-up register: 61 open actions, 54 closed, 41 verified by retesting rather than by assertion, 3 overdue and escalated to the audit committee.
Write the audit plan and the follow-up register, not just the findings you raised
This block separates an internal auditor's resume from an external auditor's; however, it is missing from nearly all of them. In short, two halves: what you planned, and what stuck.
Adaptable resume audit plan and follow-up example
Plan: 14 engagements and about 5,200 audit hours a year. Audit universe of 34 auditable entities, 21 covered in the last three-year cycle. Team of four plus a co-source partner for technology work.
Risk ranking: documented likelihood and impact model over inherent risk, control maturity and residual risk, refreshed every six months with input from enterprise risk management and the executive team. 61 percent of hours on the eight highest residual risk processes, up from 34 percent under the previous annual rotation.
Areas owned: revenue cycle, supply chain and purchasing, third-party and vendor management, physician contracting, and the annual follow-up audit.
Engagement work: 48 key controls tested last year across three cycles, 19 by reperformance and the balance by inspection, observation and inquiry. Walkthroughs documented for every in-scope process.
Observations: 22 raised, 6 rated high, 11 moderate, 5 low, each written as condition, criteria, cause, effect and recommendation with an agreed management action before issue.
Follow-up register: 61 open actions carried into the year, 54 closed, 41 verified by retesting the control, 13 closed on documentary evidence, 3 overdue and escalated to the audit committee with a revised date. Repeat observations 7 percent, down from 23 percent two years earlier.
Reporting: functional to the audit committee, administrative to the chief financial officer. Four committee papers a year, plus the annual plan and the quality assurance and improvement program update.
In addition, three things make that block credible, and each is an interview question.
How the plan was ranked. A plan built by annual rotation and one built by residual risk are different artifacts. Say what the model scored, how often it was refreshed and who fed it. If your function rotates rather than ranks, write that.
Coverage of the universe. The auditable universe is what could be audited; the plan is the subset that will be. Give both numbers and the cycle: "34 auditable entities, 21 covered in three years" says more than any adjective. Count the controls you reperformed too, not only those you tested, because inquiry is evidence and reperformance is better evidence.
What management agreed to, and what actually closed. An observation with no agreed action and no date is an opinion in a file, so say how many of yours had an action agreed before the report issued. Then count the register: actions carried, closed, verified by retesting rather than by assertion, and overdue. Add the repeat observation rate, the hardest number in internal audit to flatter. Principle 15 of the Standards is "Communicate Engagement Results and Monitor Action Plans" (The IIA, accessed 14 September 2026), and the monitoring half is where most functions are weakest.
The audited organization's control failures are not portfolio material
Internal audit findings describe your employer's weaknesses. They are the employer's information and they stay off the page permanently, including after you leave.
Off the page: any division, site, vendor or system tied to a finding; any dollar figure for an exposure, loss, misstatement or fraud; the content of an investigation; anything specific enough to identify the organization from industry, size and geography together.
On the page: your own work. Engagement counts, hours, processes audited by generic name, control counts and testing methods, observation counts and ratings, actions agreed and closed, overdue counts, repeat rates, and a finding described by type, as "a segregation of duties observation in purchase to pay".
Most chief audit executives now own something other than audit
The Internal Audit Foundation's 2026 North American Pulse of Internal Audit, based on 373 responses with 84 percent from the United States, found roughly 86 percent of chief audit executives overseeing at least one area beyond internal audit, fraud investigation being the most common at 47 percent. The same study reported budget cuts rising from 11 percent to 19 percent of functions between 2024 and 2025 while budget increases fell from 34 percent to 23 percent (The IIA, 10 March 2026).
Budgets are tightening, so evidencing coverage per hour and closure rather than activity argues in the terms the function is being squeezed on. And because so many audit leaders hold a second hat, independence is a live question. So state one distinction explicitly: whether you audited a control or performed it. Writing a policy, running a reconciliation or owning a remediation project are first or second line work. Label them as what they were and say how the conflict was handled, because principle 2 of the Standards is "Maintain Objectivity".
Build a snapshot of your key skills
For skills, similarly, twelve to sixteen entries in three groups: audit and risk, processes, and systems. Also cut anything true of everyone on an audit team.
Adaptable resume skills example
Audit and risk: Risk-based audit planning, Residual risk assessment, Audit program design, Control testing and reperformance, Observation writing and rating, Management action plan negotiation, Follow-up and closure verification, Quality assurance and improvement program
Frameworks and processes: IIA Global Internal Audit Standards, COSO Internal Control Integrated Framework, IT general controls, Revenue cycle, Purchase to pay, Third-party and vendor management, Segregation of duties analysis
Systems: Workiva, AuditBoard, Oracle Fusion Cloud as an audited environment, SQL for population extraction, Microsoft Excel including Power Query, Power BI
Name the systems you audited inside, not only the audit tool. For instance, pulling a full population out of an enterprise resource planning system with SQL is a different capability from sampling what was handed over.
List your education and certifications
Put the certification first if you hold one, because internal audit reads the credential as a statement of intent rather than a license.
The IIA sets a three-part Certified Internal Auditor exam covering internal audit fundamentals, the internal audit engagement and the internal audit function, and pairs education with experience: a master's degree plus one year of internal audit experience, a bachelor's degree plus two years, or five years by the Internal Audit Practitioner route with two of the five in the past three years. Meanwhile, active CPA, CA and CISA holders take a one-part version. Specifically, candidates have three years from acceptance to complete the requirements, and renewal is by annual self-attestation. The IIA's page records more than 220,000 CIAs across 170 countries (The IIA, accessed 14 September 2026).
Internal audit is not an occupation where the CPA is the gate, because you sign nothing. If you are choosing which exam to sit while working, the CIA is the one addressed to the job.
Adaptable resume education and certifications example
Certified Internal Auditor, The Institute of Internal Auditors, 2024
Certified Information Systems Auditor, ISACA, 2026
Bachelor of Science in Business Administration, Accounting, Cleveland State University, Cleveland, OH, 2021
Continuing education: data analytics for auditors, third-party risk, and a Global Internal Audit Standards transition workshop, 2025.
Therefore, if you are working toward it, write the position honestly: "parts one and two passed, part three scheduled for February 2027" is a strong line and an easy one to verify.
Choose the right layout and design
Generally, single column, 11 or 12 point, no graphics and no risk heat map. Also set the plan and follow-up material as labeled lines, because a chief audit executive scans for plan size, reporting line and closure rate, and will not read prose to find them.
Do
- Put the reporting line in the header.
- Give the plan in engagements and hours, with the size of the universe and the cycle.
- Say how it was ranked and how often.
- Name the processes you audited.
- Count observations by rating.
- Report actions agreed, closed, verified by retesting and overdue.
- Give the repeat observation rate.
- Say where you performed a control rather than audited one.
Don’t
- Do not name a division, vendor, system or site attached to a finding.
- Do not publish an exposure, loss or fraud amount.
- Do not describe an investigation.
- Do not claim the plan if you executed it; "contributed the ranking for 9 of 34 entities" beats an unearned "owned the annual plan".
- Do not quote a closure rate whose criteria you cannot explain.
- Do not imply a board reporting line your function did not have.
Internal auditor job market and outlook
However, the Bureau of Labor Statistics publishes no Occupational Outlook Handbook profile for internal auditor, and no single published profile matches the title. Instead, internal auditors are counted inside accountants and auditors, which holds external audit, tax, financial reporting and internal audit together, with no split published between them. Even so, the Handbook does describe the work: internal auditors are "employed by the organization they are auditing" and "identify ways to improve the processes for finding and eliminating waste, fraud, and other financial risks to the organization" (BLS Occupational Outlook Handbook, published 27 August 2026).
| Measure | Accountants and auditors |
|---|---|
| Jobs, 2025 | 1,595,200 |
| Projected change, 2025 to 2035 | 5 percent, faster than average, +79,400 |
| Projected annual openings | About 115,300 |
| Typical entry-level education | Bachelor's degree |
| Work experience in a related occupation | None |
| Median annual wage, May 2025 | $83,680 |
Internal auditor pay by industry
The industry table is the most useful part of that profile here, because it maps where internal audit sits. For example, external audit fills the first row below. Internal audit fills the other three.
| Industry | Share of employment | Median annual wage, May 2025 |
|---|---|---|
| Accounting, tax preparation, bookkeeping and payroll services | 21 percent | |
| Finance and insurance | 8 percent | |
| Government, excluding state and local education and hospitals | 8 percent | |
| Management of companies and enterprises | 6 percent |
Meanwhile, the professional body gives the other half. The IIA released the Global Internal Audit Standards in January 2024 and they took effect on 9 January 2025, structured into five domains and 15 principles, with all internal audit functions expected to be in conformance (The IIA, 16 January 2025, and The IIA Standards page, accessed 14 September 2026). A resume written in 2026 that does not name them was written before the biggest change the profession has made in a decade.
What salary you can expect as an internal auditor
There is no federal wage series for the title, so read the occupation that contains it. Specifically, accountants and auditors had a median annual wage of $83,680 in May 2025, or $40.23 an hour, with the lowest 10 percent under $56,020 and the highest 10 percent over $144,090 (BLS Occupational Outlook Handbook, May 2025). Moreover, BLS publishes no separate figure for internal against external audit, and this page will not invent one.
In fact, sector is the largest lever, and the industry table shows it: finance and insurance paid a median of $93,290 and management of companies and enterprises $91,940, against $81,490 in public accounting (BLS, May 2025). Internal audit, in other words, lives in the higher rows, which is the arithmetic behind the standard move out of a firm into a corporate function. Scale is the second, measured in the plan rather than in headcount. The third is a second specialism: technology, data analytics, third-party risk and fraud investigation are priced above general operational audit, and the Pulse finding that 86 percent of audit leaders hold a responsibility beyond audit predicts what your next job will ask for (The IIA, 10 March 2026).
Key takeaways for an internal auditor resume
- Firstly, put the functional and administrative reporting lines in the header.
- Secondly, give the plan in engagements and hours, with the audit universe and the cycle.
- Likewise, say how the plan was risk-ranked and how often the ranking was refreshed.
- Equally, name the processes you audited and how many controls you reperformed.
- Count observations by rating, and say how many had an agreed action before issue.
- In addition, publish the follow-up register: closed, verified by retesting, overdue, repeat rate.
- Finally, name the IIA Global Internal Audit Standards and lead with the CIA.
- Say plainly where you performed a control rather than audited one.
Related business and management resume examples
- Business analyst resume
- Senior business analyst resume
- Consultant resume
- Consulting resume
- Project manager resume
- Program manager resume
- Business intelligence resume
- Supply chain analyst resume
- Chief of staff resume
- Chief operating officer resume
- Business management resume
- Manager resume
Internal auditor resume questions, answered
How long should an internal auditor resume be?
One page for your first three years, two once you scope audits, own part of the plan or manage people. The second page should be the plan, the coverage and the follow-up register, not a longer list of procedures.
Do I need a CPA to be an internal auditor?
No. The CPA matters in external audit because signing authority depends on a license, and BLS notes that any accountant filing a report with the Securities and Exchange Commission must be a licensed CPA (published 27 August 2026). Internal audit signs nothing. The Certified Internal Auditor is the credential addressed to this job, and The IIA offers a one-part route to active CPA, CA and CISA holders (The IIA, accessed 14 September 2026).
How do I show audit findings without disclosing anything?
By count, rating and type. "22 observations, 6 rated high, including two segregation of duties observations in purchase to pay" is your work and identifies nobody. Drop the division, the vendor, the system name and the amount.
I performed controls as well as auditing them. How do I write that?
Label it. If you wrote a policy, ran a reconciliation, sat on an approval or led a remediation project, put it in as that work and say how the conflict was managed, usually by excluding yourself from that engagement. Principle 2 of the IIA Standards is "Maintain Objectivity" (The IIA, accessed 14 September 2026), and raising the conflict first is answering the real question.
I am moving from external audit into internal audit. What changes on the page?
The unit of work. External experience is written in engagements, clients and opinions; internal audit is written in a plan, processes, risks and what management did next. Rewrite each bullet so it names a process rather than an engagement, states the risk it addressed, and ends with an agreed action and whether it closed.